Threat video1:00
Git 2.56.1 Patches 6 Clone RCE Flaws: Detection & IOCs
Git 2.56.1 (backports to 2.50.2) patches six flaws, led by CVE-2026-111760; hunt with 9 detection rules, 4 IOCs and a free Splunk SPL rule.
Read the full threat intel for Git 2.56.1 Patches 6 Clone RCE Flaws: Detection & IOCs →
Chapters
- 0:00The hookGit fixed 6 vulnerabilities, one enabling code execution.
- 0:05The storyFixes shipped with backports to older branches.
- 0:11Attack pathA malicious repository is hosted for cloning.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise4 indicators to hunt: 2 file names, 1 path and 1 package name.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:43Remediation11 remediation steps are listed, 3 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Git fixed 6 vulnerabilities, one enabling code execution.
0:05Fixes shipped with backports to older branches.
0:08No exploitation is reported.
0:11A malicious repository is hosted for cloning.
0:15Git believes only recursive clones trigger it.
0:17Git may then run attacker hooks with victim privileges.
0:21Other flaws cause crashes, corruption and file reads.
0:27No threat actor is attributed. Confidence: low.
0:324 indicators to hunt: 2 file names, 1 path and 1 package name.
0:387 ATT&CK techniques, from initial access to impact.
0:4311 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.