dlopen() is a Unix and Linux runtime loading function that opens a shared library while a program is running. It is widely used for plugins, optional features, and compatibility modules, because software can load code only when it is needed instead of linking everything at startup.
In cyber security, runtime loading is important because it turns a filename or path into executable code. If an attacker can influence what library is loaded, where it is found, or which modules are accepted, they may be able to inject code, bypass sandboxing, or escalate privileges. Defenders reduce this risk by using fixed library paths, avoiding writable search directories, checking permissions, and disabling unnecessary dynamic loading. In audits, dlopen() often appears in attack surfaces around plugin systems, desktop services, and compatibility layers, where trust in external components must be tightly controlled.