Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

brew

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)

CVE-2024-42381 is a vulnerability identified in the Homebrew package manager's brew tool for Linux systems, specifically in versions before 4.2.20. The flaw stems from the use of the ldd utility to load ELF (Executable and Linkable Format) files obtained from untrusted sources. The vulnerability exploits the handling of the .interp section within ELF binaries. The .interp section specifies the program interpreter for the binary, and by crafting a malicious ELF file with a custom .interp section, an attacker can cause arbitrary code execution during the binary relocation phase. This phase occurs before the user expects any downloaded package content to execute and is unsandboxed, meaning the code runs with the privileges of the user invoking brew without containment. The vulnerability is categorized under CWE-830, which involves improper validation of a binary's relocation information, leading to unexpected code execution. The CVSS v3.1 base score is 8.3, indicating high severity, with attack vector as network (AV:N), attack complexity high (AC:H), no privileges required (PR:N), user interaction required (UI:R), and impacts on confidentiality, integrity, and availability all rated high (C:H/I:H/A:H). Although no known exploits are reported in the wild, the nature of the vulnerability allows an attacker to execute arbitrary code by convincing a user to install or load a malicious ELF binary via Homebrew. This can lead to full system compromise, data theft, or denial of service. The vulnerability affects Linux users of Homebrew, particularly those who install packages from untrusted or third-party sources. The lack of sandboxing during the relocation phase exacerbates the risk. The vulnerability was reserved and published on July 31, 2024, and no official patches or mitigations beyond upgrading to brew 4.2.20 have been documented yet.

Detailed information about CVE-2024-42381: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-42381: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-42381: n/a

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional