Today most (by volume) Linux attacks are against IoT devices that run Linux and SSH with weak/no auth.

Behind that are attacks on Linux web servers where exploits in the web application (e.g. WordPress) or the web framework (e.g. Rails) are the attack vector.