# Check installed Python 3.12 version
python3.12 --version

# List all Python 3.12 packages
rpm -qa | grep python3.12

# Check if python3.12 is installed via dnf
dnf list installed python3.12

# Find all Python 3.12 executables
find /usr -name "python3.12*" -type f 2>/dev/null

---
title: Suspicious Python Process Execution with Network Activity
id: 8f2a9c41-3d5e-4b67-a890-1c4f7e2d9a31
status: experimental
description: Detects Python processes spawning network connections to unusual destinations, potentially indicating exploitation or C2 activity.
references:
  - https://attack.mitre.org/techniques/T1059/006/
  - https://linuxsecurity.com/advisories/fedora/fedora-44-python3-12-2026
author: Security Arsenal
date: 2026/04/07
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1059.006
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/python3.12'
      - '/python3'
      - '/python'
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  filter:
    DestinationPort:
      - 80
      - 443
      - 53
  condition: selection and not filter
falsepositives:
  - Legitimate Python applications making internal API calls
  - Development tools and package managers
level: medium
---
title: Python Spawning Shell Commands
id: 2b7f4e91-8a3c-4d56-b012-9e6f3a8c5d47
status: experimental
description: Detects Python processes spawning shell interpreters, a common post-exploitation technique.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/04/07
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/python3.12'
      - '/python3'
      - '/python'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
  condition: selection
falsepositives:
  - Legitimate automation scripts and system administration tools
  - Package installation and configuration scripts
level: high
---
title: Python Executing from Unusual Directories
id: 5c9e1a73-4f2b-4d89-a567-8e3c6b9d2f15
status: experimental
description: Detects Python interpreters executing from temporary or user-writable directories, potentially indicating malicious payload execution.
references:
  - https://attack.mitre.org/techniques/T1059/006/
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/04/07
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059.006
  - attack.t1027
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/python3.12'
      - '/python3'
      - '/python'
    CommandLine|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/home/'
  filter_system:
    CommandLine|contains:
      - '/usr/lib/'
      - '/usr/share/'
  condition: selection and not filter_system
falsepositives:
  - User scripts and development environments
  - Virtual environment activation
level: medium

// Identify systems running Python 3.12
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName contains "python3.12" or ProcessName contains "python3"
| summarize Count = count() by Computer, ProcessName
| order by Count desc

// Hunt for Python processes making network connections
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName contains "python"
| where SyslogMessage contains "connect" or SyslogMessage contains "socket"
| extend DestinationIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| where isnotempty(DestinationIP)
| summarize ConnectionCount = count() by Computer, ProcessName, DestinationIP
| order by ConnectionCount desc

// Detect Python spawning shell processes
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4688
| where ParentProcessName contains "python"
| where NewProcessName in ("bash", "sh", "zsh", "dash", "cmd.exe", "powershell.exe")
| project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine, AccountName
| order by TimeGenerated desc

// Hunt for suspicious Python module imports in process command lines
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName contains "python"
| where SyslogMessage has_any ("pickle", "subprocess", "os.system", "eval", "exec")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for Python processes with network connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, 
       netstat().LocalIP as LocalIP, 
       netstat().LocalPort as LocalPort,
       netstat().RemoteIP as RemoteIP, 
       netstat().RemotePort as RemotePort,
       netstat().Status as ConnectionStatus
FROM pslist()
WHERE Name =~ 'python'
   OR Exe =~ 'python'
   OR CommandLine =~ 'python'

-- Hunt for Python files in suspicious locations
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/tmp/**/*.py', '/var/tmp/**/*.py', '/dev/shm/**/*.py'])
WHERE Mtime > ago(7 * 24 * 60 * 60)  -- Files modified in last 7 days
ORDER BY Mtime DESC

-- Hunt for Python processes spawned by web servers (potential exploitation)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       pslist(pid=Ppid).Name as ParentName,
       pslist(pid=Ppid).CommandLine as ParentCommandLine
FROM pslist()
WHERE Name =~ 'python'
  AND (pslist(pid=Ppid).Name =~ 'httpd' 
       OR pslist(pid=Ppid).Name =~ 'apache' 
       OR pslist(pid=Ppid).Name =~ 'nginx'
       OR pslist(pid=Ppid).Name =~ 'gunicorn'
       OR pslist(pid=Ppid).Name =~ 'uwsgi')

#!/bin/bash
# CVE-2026-19553 Python 3.12.16 Remediation Script for Fedora 44
# Run as root or with sudo

set -euo pipefail

echo "=== CVE-2026-19553 Python 3.12.16 Remediation Script ==="
echo "Date: $(date)"
echo "Hostname: $(hostname)"
echo ""

# Check if running on Fedora 44
if [[ ! -f /etc/fedora-release ]] || ! grep -q "Fedora release 44" /etc/fedora-release; then
    echo "ERROR: This script is designed for Fedora 44 only."
    echo "Detected OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d'=' -f2 | tr -d '"')"
    exit 1
fi

echo "[+] Confirmed Fedora 44 system"

# Check if Python 3.12 is installed
if ! rpm -q python3.12 &>/dev/null; then
    echo "[+] Python 3.12 is not installed on this system. No action required."
    exit 0
fi

# Get current Python 3.12 version
CURRENT_VERSION=$(python3.12 --version 2>&1 | awk '{print $2}')
echo "[+] Current Python 3.12 version: $CURRENT_VERSION"

# Check if already patched
if [[ "$CURRENT_VERSION" == "3.12.16" ]]; then
    echo "[+] Python 3.12.16 is already installed. System is patched."
    exit 0
fi

echo "[!] Vulnerable Python version detected. Update required."

# Backup current package list
echo "[+] Creating package backup list..."
rpm -qa | grep python3.12 > /tmp/python3.12-packages-backup-$(date +%Y%m%d-%H%M%S).txt
echo "[+] Backup saved to /tmp/python3.12-packages-backup-$(date +%Y%m%d-%H%M%S).txt"

# Update Python 3.12 and related packages
echo "[+] Updating Python 3.12 packages..."
dnf update -y python3.12 python3.12-libs python3.12-devel 2>&1 | tee /tmp/python-update.log

if [[ ${PIPESTATUS[0]} -ne 0 ]]; then
    echo "ERROR: Package update failed. Check /tmp/python-update.log for details."
    exit 1
fi

# Verify new version
NEW_VERSION=$(python3.12 --version 2>&1 | awk '{print $2}')
echo "[+] New Python 3.12 version: $NEW_VERSION"

if [[ "$NEW_VERSION" == "3.12.16" ]]; then
    echo "[+] SUCCESS: Python 3.12.16 installed successfully."
else
    echo "ERROR: Update completed but version verification failed."
    echo "Expected: 3.12.16, Found: $NEW_VERSION"
    exit 1
fi

# Check for processes using Python 3.12
echo ""
echo "[+] Checking for running Python 3.12 processes..."
if pgrep -f python3.12 > /dev/null; then
    echo "[!] WARNING: Python 3.12 processes are currently running:"
    ps aux | grep python3.12 | grep -v grep
    echo ""
    echo "[!] Consider restarting these services to load the patched library:"
    echo "    systemctl restart <service-name>"
else
    echo "[+] No Python 3.12 processes currently running."
fi

# Check for virtual environments
echo ""
echo "[+] Checking for Python virtual environments..."
VENV_COUNT=$(find /home /opt /srv -name "pyvenv.cfg" -type f 2>/dev/null | wc -l)
if [[ $VENV_COUNT -gt 0 ]]; then
    echo "[!] Found $VENV_COUNT virtual environment(s):"
    find /home /opt /srv -name "pyvenv.cfg" -type f 2>/dev/null | while read venv; do
        VENV_DIR=$(dirname "$venv")
        echo "    - $VENV_DIR"
    done
    echo ""
    echo "[!] Virtual environments may need to be recreated or updated separately."
    echo "    Consider: python3.12 -m venv --upgrade <venv-path>"
else
    echo "[+] No virtual environments found."
fi

# Summary
echo ""
echo "=== Remediation Summary ==="
echo "Status: PATCHED"
echo "Previous Version: $CURRENT_VERSION"
echo "Current Version: $NEW_VERSION"
echo "CVE Addressed: CVE-2026-19553"
echo ""
echo "[+] Remediation complete. Review the output above for any required service restarts."

2. **Verify the Update**: Confirm the patched version is installed:

   ```bash
python3.12 --version
# Expected output: Python 3.12.16

4. **Update Container Images**: If you use Fedora 44 base images in Docker/Podman containers, rebuild and redeploy:

   ```bash
# Pull latest Fedora 44 image
podman pull fedora:44

# Rebuild your containers
podman build --no-cache -t your-app:latest .

### Configuration Hardening

While patching is the primary remediation, consider these defense-in-depth measures:

- **Restrict Network Access**: Use firewalls to limit Python applications' ability to make outbound connections, especially from production servers.
- **Application Sandboxing**: Run Python applications in containers or with restricted user privileges to limit post-exploitation impact.
- **Code Review**: If CVE-2026-19553 affects a specific Python module (e.g., `ssl`, `pickle`, `ctypes`), review code using those modules for unsafe patterns.
- **Dependency Scanning**: Implement automated scanning of Python dependencies using tools like `safety`, `bandit`, or commercial SCA solutions.

### Vendor Advisory and References

- **Fedora Update Advisory**: [FEDORA-2026-XXXXX](https://linuxsecurity.com/advisories/fedora/fedora-44-python3-12-2026)
- **Python Security Response Team**: Monitor [python.org/security](https://www.python.org/security/) for upstream details
- **CVE Record**: Check [cve.org](https://www.cve.org/) for CVE-2026-19553 details when published

### Monitoring and Validation

After patching, validate that:

1. All systems report Python 3.12.16 or later
2. No critical services are running outdated Python versions
3. Application functionality is unaffected (test critical workflows)
4. Detection rules are firing on test data but not generating false positives

Establish ongoing monitoring to alert when new Python vulnerabilities are disclosed, ensuring rapid response to future threats.

## Related Resources

[Security Arsenal Penetration Testing Services](https://securityarsenal.com/services/penetration-testing)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[vulnerability-management Intel Hub](https://securityarsenal.com/intel/incident-response)