Loading story…
dCERT issued advisories for two Python-related vulnerabilities affecting Red Hat Enterprise Linux and CPython. One advisory warns that a flaw in python-wheel on Red Hat Enterprise Linux can allow privilege escalation and arbitrary code execution, creating a path for attackers to gain elevated access and run malicious code on affected systems.
A second dCERT advisory reports a CPython vulnerability that can bypass security measures, indicating that protections relying on expected interpreter behavior may be undermined on vulnerable deployments. Together, the advisories highlight risk across both the Python runtime and packaging ecosystem, with potential impact ranging from weakened defensive controls to full code execution on enterprise Linux environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
dCERT issued Advisory 2026-1492 for CPython, describing a vulnerability that could allow manipulation of data. The advisory was published on 2026-05-15.
dCERT issued Advisory 2026-1444 for CPython, describing a vulnerability that could allow denial of service. The advisory was published on 2026-05-12.
dCERT issued Advisory 2026-1198 for CPython, describing a vulnerability that could allow an unspecified attack. The advisory was published on 2026-04-22.
dCERT issued Advisory 2026-1093 for CPython, describing a vulnerability that could allow manipulation of data. The advisory was published on 2026-04-15.
dCERT issued Advisory 2026-1066 for CPython, describing multiple vulnerabilities. The advisory was published on 2026-04-14.
dCERT issued Advisory 2026-1045 for CPython, describing multiple vulnerabilities. The advisory was published on 2026-04-13.
dCERT issued Advisory 2025-2548 for CPython, describing a vulnerability that could allow denial of service. The advisory was published on 2026-01-01.
dCERT issued Advisory 2026-0802 for Python, describing a vulnerability that could allow code execution. The advisory was published by dCERT on 2026-03-23.
dCERT issued Advisory 2026-0709 for CPython, describing a vulnerability that could allow manipulation of files. The advisory was published on 2026-03-13.
dCERT issued Advisory 2026-0599 for CPython, describing a vulnerability that could allow bypassing security measures.
dCERT issued Advisory 2026-0298 for Red Hat Enterprise Linux (python-wheel), describing a vulnerability that could allow privilege escalation and code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CPython disclosed two medium-severity vulnerabilities affecting distinct parts of the runtime and tooling. **CVE-2026-1502** allows CR/LF bytes to pass through HTTP client proxy tunnel header or host handling, creating a header-injection risk in proxy tunnel scenarios. The issue was published through Python security channels and the `oss-sec` mailing list, with remediation details tracked in the CVE record and an associated CPython pull request. A second flaw, **CVE-2026-5713**, affects CPython remote debugging and introspection features and can trigger out-of-bounds read and write behavior when a privileged Python process connects to a malicious or compromised Python target. The bug impacts newer capabilities including `profiling.sampling` in Python 3.15+ and asyncio inspection commands such as ``` python -m asyncio ps python -m asyncio pstree ``` in Python 3.14+, and exploitation is expected to be unstable because the connecting process is likely to crash under ASLR.
Jun 29, 2026
Red Hat Enterprise Linux users were alerted to multiple package-level vulnerabilities that can cause denial of service, affecting both **`urllib3`** and **Python Protobuf** components distributed for the platform. One advisory reported multiple flaws in **`urllib3`** that could be abused to disrupt application availability, while a separate advisory identified a denial-of-service vulnerability in **Python Protobuf**. The notices indicate that the impact is centered on service interruption rather than code execution, but the affected libraries are widely used in Python-based applications and backend services on Red Hat Enterprise Linux systems. Organizations running exposed or business-critical workloads that depend on these packages should prioritize reviewing installed versions, applying Red Hat-provided updates, and validating that dependent applications remain stable after remediation.
Jun 29, 2026
Security reporting from Palo Alto Networks, GitHub, and Cisco Talos shows software supply-chain abuse continuing to intensify, with open-source ecosystems facing rising volumes of vulnerabilities, advisories, and malware. Incident responders said attackers increasingly target developers and build environments because they provide access to source code, CI/CD pipelines, cloud infrastructure, and enterprise endpoints, turning package repositories into an efficient initial-access vector. Cisco Talos detailed how malicious Python packages can execute payloads during installation as well as at runtime by abusing build hooks and package contents, including `setup.py` command classes, `.pth` files, `sitecustomize` and `usercustomize` hooks, `PYTHONPATH` manipulation, import-time code in `__init__.py`, `__main__.py`, and hijacked entry points. The research cited real-world supply-chain cases including TeamPCP activity, the `litellm` compromise, VIPERTUNNEL abuse of site hooks, and the lightning compromise, while defenders were urged to harden package intake with lock files, cryptographic hashes, isolated build environments, SBOM generation, dependency cooldowns, package auditing, and PyPI Trusted Publishing via OIDC.
Jul 14, 2026