Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A security vulnerability (CVE-2024-54661) has been identified in the socat utility used in Red Hat Enterprise Linux 9. The flaw allows arbitrary file overwrite via a predictable /tmp directory, which could lead to unauthorized modification of files. Red Hat has issued a security advisory (RHSA-2025:10353) rating the impact as moderate and providing updated packages to address the issue. The vulnerability is related to CWE-377 (Insecure Temporary File). No known exploits are reported in the wild. Users of affected Red Hat Enterprise Linux 9 versions should apply the provided updates to remediate this vulnerability.

The socat utility, which facilitates bi-directional byte streams between various channels, contains a vulnerability (CVE-2024-54661) that allows arbitrary file overwrite due to predictable temporary file usage in the /tmp directory. This security flaw affects multiple Red Hat Enterprise Linux 9 variants and socat versions. Red Hat Product Security has released updated socat packages to fix this issue, as detailed in advisory RHSA-2025:10353. The vulnerability is classified under CWE-377, indicating insecure temporary file handling. No CVSS score is provided, but the severity is rated moderate by Red Hat.

Detailed information about Red Hat Security Advisory: socat security update affecting Red Hat Product Security Red Hat. Get real-time updates, technical details

Red Hat Security Advisory: socat security update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2025:10353

https://access.redhat.com/security/updates/classification/#moderate

2330297

Canonical URL

Red Hat Security Advisory: socat security update

socat

readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.

CVE-2024-54661 is a critical security vulnerability affecting the socat utility, specifically versions 1.6.0.0 and 2.0.0-b1, prior to the patched version 1.8.0.2. The vulnerability is categorized under CWE-61, which involves unsafe symbolic link following. The root cause is that socat's readline.sh script relies on a temporary file located at /tmp/$USER/stderr2. Because /tmp is a world-writable directory and the filename is predictable, an attacker can create a malicious symbolic link pointing this file to an arbitrary location. When socat writes to or reads from this file, it may inadvertently overwrite or disclose sensitive files or execute unintended commands. This symlink race condition can be exploited remotely without authentication or user interaction, leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score of 9.8 reflects the critical nature of this flaw, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects the dest-unreach project within socat, a widely used multipurpose relay tool for bidirectional data transfer. Although no exploits have been observed in the wild yet, the ease of exploitation and high impact make this a severe threat. The lack of an official patch link suggests that users must monitor vendor advisories closely and apply updates once available or implement workarounds to mitigate risk.

Detailed information about CVE-2024-54661: CWE-61 UNIX Symbolic Link (Symlink) Following in dest-unreach socat affecting dest-unreach socat. Get real-time updat

CVE-2024-54661: CWE-61 UNIX Symbolic Link (Symlink) Following in dest-unreach socat - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-54661: CWE-61 UNIX Symbolic Link (Symlink) Following in dest-unreach socat


Red Hat Security Advisory: socat security updateCVE-2024-54661 0 A security vulnerability (CVE-2024-54661) has been identified in the socat utility used in Red Hat Enterprise Linux 9. The flaw allows arbitrary file overwrite via a predictable /tmp directory, which could lead to unauthorized modification of files. Red Hat has issued a security advisory (RHSA-2025:10353) rating the impact as moderate and providing updated packages to address the issue. The vulnerability is related to CWE-377 (Insecure Temporary File). No known exploits are reported in the wild. Users of affected Red Hat Enterprise Linux 9 versions should apply the provided updates to remediate this vulnerability. MediumVulnerability#gcve #csaf #cve-2024-54661 Join the discussion	GCVE Database	07/07/2025, 02:52:30 UTC Added: 06/02/2026, 21:43:37 UTC
CVE-2024-54661: CWE-61 UNIX Symbolic Link (Symlink) Following in dest-unreach socatCVE-2024-54661 0 readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file. CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+12#cve #cve-2024-54661 #cwe-61 Join the discussion	CVE Database V5	12/04/2024, 00:00:00 UTC Added: 02/25/2026, 21:38:12 UTC

Threats Tagged 'cve-2024-54661'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-54661'

Lead Pen Test Professional