Hackers plant GSocket on Linux servers for persistent access

Attackers are leveraging GSocket, a legitimate open-source tool, to maintain persistent footholds on Linux servers even after the initial vulnerability is remediated — meaning patching alone is insufficient once an adversary has established persistence mechanisms. By disguising GSocket as kernel threads and embedding it in cron jobs, systemd services, and shell startup files, threat actors ensure their access survives reboots and routine security responses. The exploitation of CVE-2026-43284 ('Dirty Frag') to gain root privileges compounds the risk by granting attackers full system control. This incident highlights that effective defense requires both proactive vulnerability patching and continuous monitoring for unauthorized persistence artifacts, not just reactive patching of disclosed CVEs.