Storm⚡Watch: Unplugged - July 9th, 2024

Summary: On July 1, 2024, Qualys disclosed CVE-2024-6387, a high-severity OpenSSH server flaw (CVSS 8.1) affecting versions 8.5p1 through 9.7p1 that could let unauthenticated remote attackers execute code with root privileges, with Palo Alto Networks' Xpanse counting over 7 million exposed instances globally as of that date. The same episode covers CVE-2024-6409, a race condition in OpenSSH's privilege-separated child process disclosed July 8, 2024, and CVE-2024-29510, a Ghostscript format-string flaw in versions 10.03.0 and earlier that was exploited with EPS files disguised as JPG images to gain shell access.
Bottom line: A malicious archive posing as a CVE-2024-6387 proof-of-concept has been circulating on social media, and it installs malware on the systems of the researchers who open it - the people doing the defending are the target. With more than 7 million exposed OpenSSH instances and a Ghostscript flaw already used in a real intrusion, the patch window is the exposure.

Read the original at GreyNoise Blog ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2024-29510 CVE-2024-6387 CVE-2024-6409
Related: Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability Cyber Risks ·
OpenSSH CVE-2024-6387 RCE Vulnerability: Risk & Mitigation | Qualys Cyber Risks ·
University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026