Malicious Remote Code Execution in Perl Module IO::Socket::SSL::SelfCertificate 1.00
This is a supply-chain compromise, not a traditional bug: version 1.00 of the Perl CPAN distribution IO::Socket::SSL::SelfCertificate ships embedded malware (CWE-506) rather than legitimate code. When the module's generate_certificate function runs, it executes a Python script disguised as a sample certificate file (lib/IO::Socket::SSL/SelfCertificate/sample/cert.pem), which decodes a base64-obfuscated hardcoded HTTP URL, downloads code from it, and executes the response body directly in memory, leaving no dropped script on the host. An attacker gains arbitrary code execution with the privileges of the user who installed or ran the module. Anyone who downloaded and installed the 1.00 release (tarballs with the published SHA-256 digests ba24ee8e... or d483cb7b...) is affected; the release has no test scripts or build hooks, suggesting the payload may be intended to fire after installation. This mirrors the same scheme as CVE-2026-95831 in the module Crypt::SelfCertificate; no fixed version exists because the entire release is malicious, and no public PoC, CISA KEV listing, or confirmed mass exploitation has been reported.
What to do: Uninstall IO::Socket::SSL::SelfCertificate 1.00 immediately — do not upgrade, as no clean release exists — and treat any copy matching the published SHA-256 digests as compromised. Sweep hosts, CI runners, and container images for the path IO/Socket/SSL/SelfCertificate/sample/cert.pem (digest 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac) and hunt for Python child processes spawned from Perl contexts making outbound plain-HTTP connections, rotating any credentials on affected machines. Also check environments for the sibling malicious module Crypt::SelfCertificate tied to CVE-2026-95831, which uses the same dropper technique.
| Product | Affected |
|---|---|
| IO::Socket::SSL::SelfCertificate (Perl module) | 1.00 (only release; both IO-Socket-SSL-SelfCertificate-1.00.tar.gz and IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz are malicious) |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly. The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host. The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation. The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem. This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate. The SHA-256 digests of the files are ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz
Malicious Perl package IO::Socket::SSL::SelfCertificate 1.00 (CVE-2026-97230) executes Python from an obfuscated URL.
Today 1.6K readers · 2.5K views · 780 reads · all time 189K views