Geesondog - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/geesondog/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 11:41:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRhaPHP: Server-side request forgery (CVE-2026-116256)https://feed.craftedsignal.io/briefs/2026-10-rhaphp-ssrf/Mon, 26 Oct 2026 11:41:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rhaphp-ssrf/An SSRF vulnerability in the RhaPHP Mp Module Media Proxy allows remote attackers to perform unauthorized requests via the url argument in the image function.CVE-2026-116256 describes a server-side request forgery (SSRF) vulnerability in the RhaPHP application, specifically within the Mp Module Media Proxy component. The vulnerability resides in the 'image' function of the file 'application/mp/controller/Show.php'. A remote attacker can trigger this vulnerability by manipulating the 'url' argument, which lacks sufficient validation. Public exploit material exists for this issue. RhaPHP uses a rolling release model, and the vendor has not provided a patch.

Impact

An attacker can leverage this SSRF vulnerability to make arbitrary requests from the RhaPHP server, potentially interacting with internal services, metadata endpoints, or other network-accessible resources that are not exposed to the public internet.

Recommendation

  1. Inventory all instances of RhaPHP within the environment.
  2. Implement strict egress filtering on the host running RhaPHP to prevent the application from making requests to sensitive internal subnets or cloud provider metadata services (e.g., 169.254.169.254).
  3. Deploy WAF rules to inspect HTTP GET/POST requests targeting 'application/mp/controller/Show.php' and flag/block requests where the 'url' parameter contains suspicious schemes (e.g., file://, dict://) or internal IP addresses.
]]>highadvisory