Patching the Hacked Website Isn’t the End of It: Microsoft Tracks Attackers Who Stay on Linux Servers Through a Public Relay
Microsoft says attackers who break into web applications are installing GSocket, an open-source relay tool, so they keep access to Linux servers even after the original hole is patched. Detections rose 356.2% from March to August. Here is the five-stage pattern and the layers that interrupt it.
Here Is How Layered Defenses Close the Back Door That Patching Leaves Open
When a company website gets hacked, the natural instinct is to patch the plugin or application that let the attacker in and move on. New research from Microsoft shows why that is not enough. Attackers are planting a small open-source remote access tool called GSocket on compromised Linux servers, and it keeps working long after the original weakness is fixed.
This walkthrough is based on Microsoft’s security blog analysis of GSocket abuse, with additional coverage from BleepingComputer.
The numbers behind the warning
- Devices with GSocket-related detections in Microsoft’s endpoint telemetry rose 356.2% from March through August 2026, though not evenly month to month.
- Web applications and hosting made up 87.1% of the incidents Microsoft could attribute. Within that group, PHP web applications and cPanel hosting accounted for 63.9% and Apache for 24.3%.
- Education and research organizations were the largest share of those affected (30.7%), followed by technology and telecommunications (22.9%). Microsoft attributes this to exposure, such as sprawling, loosely managed web estates, rather than deliberate targeting.
The attack in five stages
- Break in through the website. The attacker exploits a vulnerable internet-facing application, often a PHP site, and gains the ability to run commands as the web server account.
- Download and stage the tool. A one-line command fetches a script that checks the system, picks the right GSocket build and drops it into writable or memory-backed folders such as /dev/shm.
- Connect out, not in. Both the hacked server and the attacker make outbound connections to the public Global Socket Relay Network, which pairs them over an encrypted channel. There is no attacker-owned address to block, no listening port to find, and inbound firewall rules never see it. The attacker reconnects later using only a shared secret.
- Hide and dig in. The process is renamed to look like a kernel thread, and persistence is layered through cron jobs, systemd services, shell startup files, watchdogs and spare copies. Staging files are then deleted.
- Try for root. In a few incidents, attackers attempted to exploit a Linux kernel flaw, CVE-2026-43284 (also called Dirty Frag), to move from the web account to full control.
The key point, in Microsoft’s words, is that patching the application does not remove the relay client or its persistence.
Where the layers break the chain
- Patch and trim web applications (stage 1). Keep CMS platforms, plugins and app servers current, remove what is unused, and restrict upload and admin paths. A web application firewall adds a second screen in front.
- Make temporary folders non-executable (stage 2). Mounting memory-backed and temp directories so programs cannot run from them, and alerting when something executes from a hidden or world-writable path, blocks the usual staging spot.
- Control outbound traffic (stage 3). Servers rarely need to talk to the whole internet. Deny-by-default egress rules with an allow list, plus monitoring of connections to relay services, cut the channel GSocket depends on.
- Audit persistence on purpose (stage 4). After any compromise, review cron, systemd units with plausible-sounding names and shell profiles. Killing the running process alone leaves the other copies in place.
- Patch the kernel on public servers first (stage 5). Local privilege-escalation fixes matter most on machines that face the internet.
- Run endpoint detection on Linux too (stages 2 through 5). Linux servers are often left without the monitoring Windows PCs get. Behavior-based tools, Microsoft Defender for Endpoint on Linux being one example, can flag a web server spawning shells, masqueraded processes and new services.
What this means for your company
Many small and mid-size businesses run their website, client portal or booking system on exactly the kind of PHP and cPanel hosting Microsoft describes. If one of those sites has ever been hacked and simply patched, it is worth confirming that nothing was left behind. Going forward, treat a website compromise as a server investigation, not just a software update: check for unfamiliar processes, scheduled tasks and outbound connections, and put outbound filtering and endpoint monitoring in place so the next intruder cannot quietly stay. No single tool covers all five stages, which is why the layers matter.
Want to know whether your web servers would catch an intruder who stays after the patch? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
