Loading story…
Researchers detailed exploitation of CVE-2024-29510, a format string vulnerability in Ghostscript, showing how the flaw can be abused to achieve command execution on Linux systems. The issue is especially relevant to environments that process untrusted PostScript or PDF content through Ghostscript, including document conversion pipelines and applications that invoke Ghostscript indirectly through other software.
Splunk published a detection analytic for identifying likely exploitation by monitoring for ghostscript or gs spawning shell commands such as:
sh -c ...
The detection is designed for Splunk Enterprise Security deployments using Sysmon for Linux or equivalent EDR telemetry mapped to the Endpoint data model, and it warns that legitimate document-processing workflows may generate false positives, particularly where Ghostscript is used by file conversion services or embedded in LibreOffice-driven processes.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Splunk Research updated and published a detection analytic titled "Linux Ghostscript Exploitation" for identifying Ghostscript or gs spawning shell commands on Linux, mapped to CVE-2024-29510. The analytic is intended for Sysmon for Linux/EDR telemetry in Splunk Enterprise Security and is disabled by default.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in HP Linux Imaging and Printing (**HPLIP**), tracked as **`CVE-2026-14544`**, allows unauthenticated remote attackers to trigger arbitrary code execution, privilege escalation, denial of service, or memory corruption by sending specially crafted print data to the **`hpcups`** processing path. The bug is an integer overflow (**`CWE-190`**) and has been rated **CVSS 9.8**. Researchers and downstream reporting described it as an incomplete fix for the earlier **`CVE-2026-8631`**, meaning prior remediation did not fully eliminate the underlying issue. The flaw affects HPLIP versions prior to **`3.26.4`** and has broad exposure because HPLIP is widely deployed on Linux systems that support HP printers. Upstream reportedly fixed the issue in **`3.26.4`**, while Linux vendors including Ubuntu, Debian, SUSE/openSUSE, Oracle Linux, and Red Hat have identified affected products or begun issuing and backporting updates; Red Hat said **RHEL 8, 9, and 10** are affected, while **RHEL 6 and 7** are not. Until patches are fully available across distributions, defenders have been urged to apply vendor security updates as they are released, restrict network exposure to printing services such as CUPS, isolate print servers, monitor print activity, and remove HPLIP where it is not required.
Jul 9, 2026
A four-CVE chain affecting CUPS and its `cups-browsed` component allows unauthenticated attackers to trigger remote command execution on vulnerable Linux systems, with potential exposure for macOS hosts using CUPS. An attacker can send a crafted UDP packet to port `631`, induce `cups-browsed` to retrieve data from an attacker-controlled IPP server, and inject malicious printer attributes into a temporary PPD file; execution occurs when a user submits a print job. The resulting commands run as the `lp` user and may be constrained by the `cupsd` AppArmor profile. Internet-exposed CUPS services face the highest risk. Security teams should investigate unexpected UDP/631 traffic, untrusted or anomalous `lp`-owned files, `foomatic-rip` executions, and known proof-of-concept marker files; the attack was publicly disclosed with an RCE proof of concept before CVEs and patches were broadly available.
Sep 9, 2026
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026