tag: Public-Poc · 9 items
- Engineer — Act: A turnkey scanner for the handler-mismatch + LFI → shell chain is now trending on GitHub, lowering the bar for mass exploitation; any PHP deployment should be patched to fixed versions for CVE-2026-109618 and CVE-2026-109619 and audited for handler misconfigurations immediately, even though EPSS is low and KEV is not yet triggered.
- SOC/IR — Plan: A no-dependency scanner trending on GitHub means opportunistic exploitation attempts against PHP hosts are likely soon; build or tune detections for LFI probe patterns and php2shell session-chain anomalies (unusual session handler requests followed by file-read behavior) in web server and WAF logs before active campaigns emerge.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Act: A public PoC on GitHub demonstrates unauthenticated RCE against Node.js 24.22.0 on Linux arm64 — a plausible production target in cloud environments. Verify whether your Node.js 24.x deployments run on arm64, apply the Node.js project patch as soon as it is released, and consider blocking or sanitizing untrusted Brotli input at the application boundary in the interim.
- SOC/IR — Plan: No active exploitation is reported (EPSS 0.00, not in KEV), but a public PoC raises the chance of in-the-wild attempts. Build or tune detections for anomalous child process spawning from Node.js worker processes, which is the expected exploitation footprint for a runtime RCE of this class.
- Leader — Plan: Node.js is pervasive across modern application stacks; a confirmed RCE with a public exploit warrants a near-term inventory check. Ask engineering to confirm which Node.js 24.x arm64 deployments exist and to track the upstream patch — escalate to Act if CISA adds this to KEV or exploitation is reported in the wild.
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Heap UAF in PHP’s session.upload_progress with a public PoC on GitHub creates immediate RCE risk on any internet-facing PHP stack; patch PHP to the fixed release now, or disable session.upload_progress in php.ini if the feature is unused.
- SOC/IR — Plan: A working PoC is public but mass exploitation isn’t confirmed yet — build detections for anomalous POST requests targeting session.upload_progress endpoints and tune WAF rules this sprint before an exploitation wave arrives.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources
- Engineer — Act: Public PoCs exist on GitHub for both CVEs and a national NCSC is warning exploitation is imminent — patch Check Point VPN gateways to the vendor-fixed version immediately and verify no unauthorized access preceded the patch.
- SOC/IR — Act: Edge VPN devices with public PoCs and an imminent-exploitation warning require an assume-breach posture — hunt for anomalous authentication events and lateral movement originating from Check Point VPN nodes since the CVEs were disclosed, and tune detections for post-exploitation activity on network edge appliances.
- Leader — Act: Confirm whether Check Point VPN is present in your estate and verify emergency patching is already in motion; a government NCSC imminent-exploitation warning on a widely-deployed VPN with public PoC is likely to generate customer and board questions if exploitation materializes at scale.
- Signals: CVE-2026-85102 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub · CVE-2026-85103 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: A public PoC for a KASLR-defeating info leak on iOS 26.6 lowers the bar for full exploit chain development; audit MDM-enrolled iOS devices in your fleet and track Apple’s patch release for this build.
- SOC/IR — Learn: A KASLR defeat primitive is a meaningful step toward mobile exploitation chains, but with no active campaign, no IOCs, and EPSS at 0.00, there is no detection or hunt action available yet.
- Leader — Skip
- Signals: CVE-2026-65343 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Public PoC is live and attackers are already exploiting this critical SharePoint flaw — patch SharePoint on-prem deployments immediately and audit SharePoint ULS and IIS logs for anomalous authentication or anonymous access patterns from the PoC release date forward.
- SOC/IR — Act: Active in-the-wild exploitation means an immediate hunt is warranted — query SIEM for unusual SharePoint authentication events, abnormal REST/SOAP API calls, or unexpected file-access patterns since Rapid7’s PoC publication date, and tune alerts on SharePoint edge access.
- Leader — Plan: A critical SharePoint vulnerability with a public PoC and confirmed exploitation warrants confirming on-prem SharePoint exposure with your engineering team and ensuring an emergency patch window is scheduled this week if not already done.
- Engineer — Act: A public PoC now exists for a domain-hijack flaw in AD Certificate Services; audit your PKI templates for misconfigured enrollment permissions and apply any available patch or Microsoft-recommended mitigation immediately.
- SOC/IR — Plan: Build detections for anomalous certificate enrollment requests and CA template abuse (e.g., unusual Enrollee Supplies Subject flag usage); no confirmed active exploitation reported yet, but PoC availability shortens the runway.
- Leader — Learn: A PoC for a Windows domain-compromise vulnerability is now public; no board-level action needed yet, but monitor for escalation to active exploitation that could affect enterprise AD environments.
- Engineer — Act: A working public exploit now exists for this six-week-old GitLab flaw; any authenticated user with push access on an unpatched self-managed instance can achieve RCE. Upgrade to the patched version released June 10 immediately and verify no self-managed GitLab instances remain on 18.11.3.
- SOC/IR — Act: PoC publication on July 24 makes exploitation imminent; hunt for anomalous Jupyter notebook pushes followed by commit-diff access on self-managed GitLab instances, and look for unexpected git-process child execution in EDR telemetry as of that date.
- Leader — Plan: A public exploit for GitLab RCE elevates CI/CD pipeline compromise risk this week; confirm with engineering that all self-managed GitLab instances are on the June 10 patched release before this becomes an active incident requiring notification.
- Engineer — Act: A public Docker lab with a working one-payload exploit now exists for fastjson 1.2.66–1.2.83; critically, autoType=OFF and parseObject binding are not effective mitigations. Audit your dependency tree for fastjson in this range and upgrade to 1.2.84+ (or fastjson2), treating autoType-disabled deployments as unprotected.
- SOC/IR — Plan: The public exploit lab lowers the bar for threat actors to weaponize this Spring Boot class-loading RCE chain. Build or tune detections for unexpected outbound SSRF from Java application hosts followed by remote class loading activity; the SSRF→defineClass pattern is a distinct behavioral signal to hunt for in proxy and EDR telemetry.
- Leader — Skip