Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A security update for PHP on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including cookie bypass, erroneous password verification, filter bypass, multipart form data parsing errors, configuration bypass, log manipulation, heap buffer over-read, single byte overread, and CRLF injection. These issues collectively pose moderate security risks such as account takeover and information leakage. The update fixes nine distinct CVEs and is rated with moderate severity by Red Hat Product Security.

This Red Hat security advisory covers a set of moderate-impact vulnerabilities in the PHP 8.2 module used in Red Hat Enterprise Linux 9. The fixed issues include CVE-2024-2756 (host/secure cookie bypass due to a partial fix of a previous vulnerability), CVE-2024-3096 (password_verify function erroneously returning true, risking account takeover), CVE-2024-5458 (filter bypass in filter_var with FILTER_VALIDATE_URL), CVE-2024-8925 (erroneous parsing of multipart form data), CVE-2024-8927 (bypass of cgi.force_redirect configuration via environment variable collision), and CVE-2024-9026 (PHP-FPM log manipulation vulnerability). Additional related vulnerabilities are also addressed in the update. Red Hat has provided patches for these issues in the PHP 8.2.25 update for RHEL 9, covering multiple architectures and extended update support versions.

Detailed information about Red Hat Security Advisory: php security update affecting Red Hat Product Security Red Hat. Get real-time updates, technical details, 

Red Hat Security Advisory: php security update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2025:7315

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index

https://access.redhat.com/security/updates/classification/#moderate

2275058

2275061

2291252

2317049

2317051

2317144

2327960

2328521

2328523

RHEL-71275

Canonical URL

https://access.redhat.com/errata/RHSA-2024:10949

RHEL-65837

https://access.redhat.com/errata/RHSA-2024:10950

Red Hat Security Advisory: php:8.1 security update

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

CVE-2024-9026 is a vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12, specifically affecting the PHP-FPM SAPI when configured with catch_workers_output set to yes. This setting captures the output of PHP worker processes for logging purposes. The vulnerability stems from improper neutralization of null byte (NUL) characters in log messages, categorized under CWE-158 and CWE-117, which relate to improper handling of null bytes and improper output neutralization respectively. An attacker with limited privileges (local access with low privileges) can craft log messages containing null bytes that manipulate the final log output, either polluting the logs or removing up to four characters from log entries. When PHP-FPM is configured to send logs to syslog, the vulnerability can be exploited to remove additional log data, further compromising log integrity. This can hinder forensic investigations or security monitoring by corrupting or omitting critical log information. The vulnerability does not allow for confidentiality breaches or denial of service but impacts the integrity of logs, which are essential for incident detection and response. Exploitation requires local access and no user interaction, with low complexity. No public exploits or active exploitation have been reported to date. The issue is resolved in PHP versions 8.1.30, 8.2.24, and 8.3.12 by properly handling null byte characters in log messages to prevent log pollution or truncation.

Detailed information about CVE-2024-9026: CWE-158: Improper Neutralization of Null Byte or NUL Character in PHP Group PHP affecting PHP Group PHP. Get real-time

CVE-2024-9026: CWE-158: Improper Neutralization of Null Byte or NUL Character in PHP Group PHP - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-9026: CWE-158: Improper Neutralization of Null Byte or NUL Character in PHP Group PHP


Red Hat Security Advisory: php:8.1 security updateCVE-2024-2756 0 A security update for PHP on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including cookie bypass, erroneous password verification, filter bypass, multipart form data parsing errors, configuration bypass, log manipulation, heap buffer over-read, single byte overread, and CRLF injection. These issues collectively pose moderate security risks such as account takeover and information leakage. The update fixes nine distinct CVEs and is rated with moderate severity by Red Hat Product Security. MediumVulnerability#gcve #csaf #cve-2024-2756 Join the discussion	GCVE Database	12/11/2024, 16:20:57 UTC Added: 06/27/2026, 22:08:41 UTC
CVE-2024-9026: CWE-158: Improper Neutralization of Null Byte or NUL Character in PHP Group PHPCVE-2024-9026 0 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability. LowVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2024-9026 #cwe-158 Join the discussion	CVE Database V5	10/10/2024, 07:13:42 UTC Added: 11/03/2025, 22:53:13 UTC

Threats Tagged 'cve-2024-9026'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-9026'

Lead Pen Test Professional