The Exploit Bulletin

How to Test

Confirm the running kernel version and verify it contains one of the stable fix commits listed in the advisory (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or the Debian LTS update from the October 2025 debian-lts-announce; identify hosts where kernel TLS offload (the kernel tls socket option) is enabled in the TLS-terminating service, since only those expose the vulnerable receive path. On such hosts review kernel logs for TLS-related oopses or warnings and unexpected TLS sessions from unknown peers around the time of exposure.

How to Patch

Upgrade to a kernel containing the stable fix commits (2902c3ebcca5, c09dd3773b59, 3439c15ae91a, 29c0ce3c8cdb, 62708b9452f8) or your distribution's equivalent (Debian LTS: see the October 2025 debian-lts-announce update; Siemens customers: SSA-032379) and reboot. If an upgrade must wait, disable kernel TLS offload in the TLS-terminating application so the vulnerable receive path is not used.

How to Test

In WordPress admin, check Plugins for the Gravity Forms version; anything at or below 3.1.0.4 is vulnerable. Identify forms that contain a file upload field (the exploit requires one). Review the Gravity Forms upload directory and the web server's writable directories for recently added files with executable extensions (e.g. .php) and check access logs for unauthenticated POST submissions to those forms followed by direct requests to uploaded file paths.

How to Patch

Update Gravity Forms to 3.1.1 (the patched version per Patchstack). If the update must wait, remove or disable file upload fields on publicly reachable forms.

How to Test

Check the deployed Conductor server version; anything from 3.21.21 up to but not including 3.30.2 is vulnerable. Review workflow API access logs and stored workflow definitions for unexpected inline workflow submissions containing INLINE, LAMBDA, DO_WHILE or SWITCH tasks whose JavaScript or Python expressions reference Java classes, reflection, Runtime, ProcessBuilder or subprocess calls, and check the Conductor host for unexpected child processes spawned by the server JVM.

How to Patch

Upgrade to Conductor 3.30.2 (release of 3 June 2026 containing PR #1123 'Restrict graaljs further' / commits 87a7d96a and c691e35e, which deny script access to Class, ClassLoader, reflection, Runtime, ProcessBuilder, Process, System and Thread). If the upgrade must wait, remove direct network exposure of the workflow API and place it behind authentication so untrusted clients cannot submit workflow definitions.