The attacker sends malformed heartbeat requests and reads back chunks of process memory, potentially harvesting private keys and credentials over many requests.

Alert on malformed TLS heartbeat records and abnormal heartbeat request volume; IDS signatures exist for the over-read.

Upgrade OpenSSL, then reissue/rotate certificates and revoke old keys, and force credential resets.

The attacker sends a crafted HTTP header (e.g. User-Agent) to a CGI script; the value becomes an env var Bash parses, and the appended commands execute on the server.

Hunt for '() {' sequences in HTTP headers/logs, and web servers spawning bash/sh with odd commands; IDS signatures exist for the payload.

Patch Bash, retire/limit CGI, and validate/sanitize inputs that reach shells.

The attacker triggers the server to process an oversized DNS response (SIG record), overflowing a buffer to gain SYSTEM-level RCE, with worm potential across DNS servers.

Alert on abnormally large DNS responses/TCP DNS to your servers, DNS service crashes, and post-exploitation from DNS/DC hosts.

Patch immediately; as a stopgap set the max TCP DNS response length registry value, then reboot.