Microsoft telemetry shows 356% surge in GSocket backdoor detections on Linux servers as 59 kernel bugs surface

Microsoft said it observed multiple incidents in which threat actors deployed GSocket, an open-source remote-access tool, on internet-facing Linux servers to maintain access after the original vulnerabilities were addressed. Telemetry showed devices with GSocket-related detections rose 356.2% from March through August 2026. The activity was most associated with PHP web applications, cPanel hosts and Apache, with education and research the largest targeted sector, followed by technology and communications, manufacturing and government.

The evidence Microsoft cited is operational rather than exploit-level: GSocket relays traffic through a shared public network, leaving no attacker-owned IP address or domain for defenders to block. Microsoft said defenders should hunt for deployment, persistence, privilege escalation and outbound connections, not treat application patching alone as complete remediation. The same weekly roundup listed 59 Linux kernel bugs and Falcon spyware, but the available excerpt did not provide CVE identifiers, exploitation evidence or independent attribution.

The pattern is familiar but worsening: attackers use trusted or open-source tools to hide inside legitimate infrastructure, and patching a web application does not remove a relay that already exists on the host. A large kernel-bug count in a weekly roundup also points to foundational software pressure, because Linux hosts much of the internet's servers and container infrastructure. Falcon spyware was listed as a threat, but without technical details it cannot be tied to a specific campaign or actor.

The immediate exposure is broad: Linux servers running PHP, cPanel and Apache are common in universities, research labs, technology firms, manufacturers and government sites. If GSocket remains installed after patching, an attacker can retain access and move laterally while defenders focus on the original bug. For organizations that treat patching as the end of an incident, the operational risk is that the compromise continues invisibly through a relay that is difficult to block by network address alone.