Microsoft said on 11 November that several attackers have installed GSocket, a free remote access tool, on hacked Linux servers. The attackers got in through flaws in web applications. They then used the tool to keep access after those flaws were fixed. Microsoft said devices with GSocket detections in its Defender for Endpoint data rose 356.2% from March to August 2026, though not evenly each month. BleepingComputer reported the findings on 12 November.
Microsoft said web applications and hosting made up 87.1% of the incidents it could attribute. PHP web apps and cPanel hosting were 63.9%, and Apache was 24.3%. Education and research made up 30.7% of affected organisations. Microsoft said this likely reflects exposure, not deliberate targeting. In a few cases, attackers tried to use Dirty Frag, a Linux kernel flaw (CVE-2026-43284), to gain root access. Not every step occurred in every intrusion. Microsoft did not confirm in every case that access survived a reboot or that the relay link worked. The reports do not name the attackers.
GSocket links the server and the attacker through a shared public relay, so there is no attacker address to block. Microsoft said patching the web flaw is not enough. Teams must also remove the tool, its startup entries and leftover files, and limit outbound traffic from servers.