X-twitter Facebook-f Pinterest-p
X-twitter Facebook-f Pinterest-p

Vendefoul Wolf is a Linux distro that goes against the grain with terrific results


Vendefoul Wolf

Jack Wallen/ZDNET

Follow ZDNET: Add us as a preferred source on Google.

ZDNET key takeaways

  • Vendefoul Wolf is a Linux distro with an old-school twist.
  • You get SysVinit and XLibre, and a bare-bones list of apps.
  • Vendefoul Wolf can be downloaded and installed for free.

From the beginning, Linux hasn’t played by the rules. Over the years, there have been distributions that took that ideology even further and broke from what others were doing.

One example is when systemd became the de facto standard init system for Linux. That change irked many developers, who then created alternative distributions that used a different system. Even the windowing system saw a bit of rebellion when it became obvious that Wayland was the future. In other words, there were alternatives to the alternatives.

Also: The 6 Linux distros I expect to rule 2026 – as someone who’s tested hundreds

That situation is the case with Vendefoul Wolf. Not only is the name different, but the distribution follows the beat of a different drummer.

Vendefoul Wolf is based on Devuan, which is a fork of Debian. Think of this system as a lightweight version of Debian.

How is Vendefoul Wolf different?

First off, this distribution shuns systemd in favor of SysVinit. The key difference between the two systems is that SysVinit defaults to a sequential execution model for service start, based on runlevels, and SystemD opts for parallel service startup and manages each service via unit files. 

Most believe SystemD is a vast improvement over SysVinit because it’s easier to manage and faster. The appeal of SysVinit is its simplicity. SysVinit is also considerably older than SystemD, with its origins dating back to the 1980s.

Also: Your Linux PC has a Secure Boot problem – what to do first (and the workaround to avoid)

Another big difference is the X server. Venedfoul Worlf is the first distribution to default to the XLibre Graphics Server. XLibre is a community-managed display server for X11. The goal of XLibre is to keep X going while improving it and making it future-proof.

Those two differences alone set Vendefoul Wolf Linux apart from most distributions. Vendefoul also focuses on privacy, so there’s no telemetry, and the highly secure LibreWolf is the default web browser. 

My experience with Vendefoul Wolf

It all begins with the installation. I downloaded the SonicDE version (a project aimed at keeping KDE Plasma working with X11) of the distribution, but it constantly failed to install. After several tries, I decided to try the Budgie version. I’ve always been a fan of Budgie, so I figured, “Why not?”

Fortunately, the Budgie version of Vendefoul installed without a hiccup. I did discover that the Budgie version didn’t include everything listed on the website. For example, there was no KeePassXC, the cache cleaner, or init changer.

Vendefoul Wolf

Budgie runs like lightning on Vendefoul Wolf.

Screenhot by Jack Wallen/ZDNET

I discovered the kernel manager, Aconita. The default kernel shipped with Vendefoul Wolf is 6.18.2-vendefoul. Using the kernel manager, I could easily install the 7.1.1-vendefoul kernel. I always appreciate a GUI kernel manager because it puts me in the driver’s seat of the foundation of a distribution.

Vendefoul Wolf

I love a good kernel manager.

Screenhot by Jack Wallen/ZDNET

Vendefoul Wolf does ship with a bare-bones list of software. There’s no LibreOffice, no email client, and no modern app store (you get Synaptic on the Budgie version). 

Also: I tested the best MacOS alternative on Linux again – and it even mimics Liquid Glass now

Another oddity was the lack of a universal package manager (such as Flatpak). Oddly enough, there’s the flatpak-config command, but not flatpak itself. I installed Flatpak via Synaptic, which made the process quite simple.

Vendefoul Wolf

Synaptic might be old-school, but it works.

Screenhot by Jack Wallen/ZDNET

I was also a bit disappointed with the aesthetic. The Budgie desktop can look gorgeous, but on Vendefoul, it’s fairly pedestrian. And (of course) it defaulted to a dark theme. I don’t get why so many distributions prefer dark themes, but thankfully Budgie makes it easy to switch to lighter fare. 

Sadly, it does seem that the Budgie of today isn’t exactly the Budgie of yesterday. For example, if you switch the panel to dock mode, you get square corners (like Xfce). To get rounded corners, you have to edit CSS rules. 

Also: Windows Subsystem for Linux gives developers a compelling reason to stick with Microsoft – here’s why

However, I did enjoy my time with Vendefoul Wolf. Although I prefer SystemD and Wayland, I did find this distribution to perform very well; it boots quickly (especially with the 7.1.1 kernel), apps open almost immediately, and it feels quite stable. 

In the end, I found Vendefoul Wolf to be a terrific throwback to old-school Linux. Often reminding me of my earlier days with the open-source operating system, I did smile quite a bit while using this distribution.

Who is Vendefoul Wolf for?

Simply put, Vendefoul Wolf is for people who aren’t interested in following trends and want a Linux distribution that’s fast, lightweight, and stable. If you don’t mind learning a different window server and init system, Vendefoul Wolf should be quite appealing. 

If you have an aging computer lying around and you want to give it new life, you can’t go wrong with Vendefoul Wolf.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

AI coding costs could top developer salaries by 2028

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog

Google Fi is the best carrier I’m not allowed to use

Why Frontier AI makes prioritization the most important part of your CTEM program

Cisco Unified CM Flaw CVE-2026-20230 Actively Exploited in the Wild

U.S. CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 plugin flaws to its Known Exploited Vulnerabilities catalog

Recent Reviews

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)





Source link

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Third-Party Cyberattack Impacts Patient Information at The Oncology Institute

Lazarus APT unveils fileless RAT designed to evade detection

Copyright © 2024 All Rights Reserved.