ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Perl”

14 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 58Malware 34Exploit / PoC 28Ransomware 7Industry 6Advisory 5Threat actor 4Tools 2AI tools & infra 2Phishing & fraud 2Research 1Policy & legal 1Data breach 1
SeverityAllcritical 57high 44medium 30low 16info 4

CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Authen::SASL::Perl::DIGEST_MD5 before 2.2100 for Perl accepts replayed DIGEST-MD5 authentication responses via unverified nonce handling (CVE-2026-86219).

CVE-2026-86219 affects Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl. The server_step function does not verify the nonce, allowing replayed authentication responses to be accepted in DIGEST-MD5 SASL exchanges. The fix is available in version 2.2100 of the perl-authen-sasl distribution.

oss-security · 10d agoVulnerabilityCVE-2026-862191

USN-8675-2: Perl vulnerabilities

Ubuntu issued USN-8675-2 fixing two Perl flaws (CVE-2026-12087, CVE-2026-13221) enabling information disclosure and regex-based security bypass on 26.04 LTS.

Ubuntu released USN-8675-2, extending the fixes from USN-8675-1 to Perl packages on Ubuntu 26.04 LTS. The update addresses CVE-2026-12087, an out-of-bounds heap read in the Socket module when handling short source addresses, which could lead to information disclosure. It also fixes CVE-2026-13221, where regular expressions containing many fixed string alternatives could produce incorrect matches and bypass security restrictions. No exploitation is reported in the notice.

Ubuntu Security Notices · 7d agoAdvisoryCVE-2026-12087CVE-2026-13221

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.

Palo Alto Unit 42 · 28d agoMalware in the wild

CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.

Robert Rothenberg disclosed CVE-2026-85485 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders some error messages into HTML without escaping, which can enable cross-site scripting in applications using its rendered output. The issue is fixed in version 0.410002.

oss-security · 8d agoVulnerability 2 sourcesCVE-2026-854851

CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.

CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.

oss-security · 8d agoVulnerability 2 sourcesCVE-2026-19872

CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

CVE-2026-86287: Net::IP::LPM Perl library before 1.12 accepts malformed IP prefix lengths, risking incorrect longest-prefix-match results.

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths, per an oss-security disclosure posted September 7, 2026. The lax input validation in this longest-prefix-match library could produce incorrect matching behavior. The fix is available in version 1.12 on CPAN.

oss-security · 9d agoVulnerabilityCVE-2026-86287