Curated security, hosting and development news with vulnerability warnings from fixed trusted sources.
CISA KEVGHSACERT.atHosting
Updated
About these news
Articles are collected periodically from a fixed source list. D4rC Tools stores the headline, source summary and source link only; linked articles are not fetched on page view.
NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read
·GitHub Advisories
## Summary BllipParser in nltk/parse/bllip.py hands caller-supplied filesystem paths to the native bllipparser C extension without routing them through NLTK's pathsec validation. The constructor parameters parser_model, reranker_features, and reranker_weights, and the alternative from_unified_model_dir() entry point, flow directly to the C extension's load_parser_model() and load_reranker_model() calls, which open and read the given path at the OS level. Any application that passes an attacker-influenced path to this API reads a file of the attacker's choosing from anywhere on the filesystem, outside the NLTK data roots that every other NLTK tool wrapper confines access to. ## Root Cause As of NLTK 3.10.0, SECURITY.md documents a centralized I/O security module (`nlt…
ag-psd can exhaust memory when parsing crafted PSD dimensions
·GitHub Advisories
### Summary readPsd() commits the image/layer buffers from the declared header geometry (width x height x channels x depth, and per-layer rectangles) before validating those values against the actual data. A tiny crafted PSD declaring huge geometry forces a multi-gigabyte allocation. ### Impact On ag-psd 30.2.0, Node 24, a 52-byte PSD makes readPsd(buf) commit ~3.17 GB (measured peak RSS) in ~0.45 s before throwing a catchable RangeError ("Offset is outside the bounds of the DataView") — about 61,000,000x amplification. Because the buffer is committed before validation, the allocation OOM-kills the process before the error on essentially any host (uncatchable), and concurrent requests exhaust memory. Any service reading untrusted PSDs with ag-psd is exposed to a remote DoS. This is distin…
File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths
·GitHub Advisories
## Summary File Browser v2.63.15 can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash. The share cleanup path calls DeleteWithPathPrefix(file.Path, userID), but the Bolt backend performs the database prefix query with the unnormalized argument before trimming the slash for boundary checks. For a stored share at /a, deleting /a/ queries for paths prefixed by /a/, so the exact /a share is never loaded and never deleted. If a directory with the same path is later recreated, the stale public share becomes active again and exposes the new directory contents through the old public URL. ## Impact An authenticated user with share, download, and delete permissions can create a valid public share, delete the shared path with a…
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
·GitHub Advisories
## Summary LegalitySyllableTokenizer.tokenize in the NLTK tokenizer package contains an unguarded O(n^2) processing loop. When the method is called on a single token that consists of a long run of vowels (for example "a" * n), it consumes CPU time proportional to the square of the token length. An attacker who can supply an untrusted token to this public tokenizer API can force a single request to saturate one CPU core for a prolonged period, degrading availability of any service that syllabifies attacker-controlled text. No authentication, special configuration, or user interaction is required. ## Root Cause The method walks the token in reverse and, on every iteration after the first vowel is seen, evaluates the membership test char_lower + current_onset[::-1] in self.legal_onsets…
NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop
·GitHub Advisories
## Summary TreebankWordTokenizer.span_tokenize in the NLTK tokenizer package contains an unguarded O(n^2) processing loop in its quote-restoration step. When the method is invoked on text containing a long run of double-quote characters (for example '"' * n), it performs a list.pop(0) operation once per quote token, and because list.pop(0) is O(length), the total cost grows with the square of the input length. An attacker who can supply untrusted text to this public span-tokenization API can force a single request to saturate one CPU core for a prolonged period, degrading availability. No authentication, special configuration, or user interaction is required. ## Root Cause Inside span_tokenize, when the input contains double or repeated quotes, the code builds matched, a list…
NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars
·GitHub Advisories
## Summary nltk.parse.recursivedescent.SteppingRecursiveDescentParser.parse() performs an unbounded top-down search over ambiguous or self-embedding context-free grammars with no wall-clock or step limit. An actor who can influence the grammar and supply a short input to a caller that uses this parser can force a single parse() call to pin a CPU core indefinitely, producing a denial of service. The related base class RecursiveDescentParser gained a max_time wall-clock deadline, but the stepping subclass drives its own step loop and never arms or consults that deadline, and its constructor does not accept a max_time parameter, so the guard cannot be enabled on this path. ## Root Cause RecursiveDescentParser bounds its recursive search inside _parse: it arms a wall-clock deadl…
NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
·GitHub Advisories
## Summary YCOECorpusReader builds two nested corpus sub-readers whose roots are derived from self.root.join("psd") and self.root.join("pos") (nltk/corpus/reader/ycoe.py). Because FileSystemPathPointer.join() (nltk/data.py) performs a purely lexical containment check and never resolves symlinks, and because CorpusReader.__init__ (nltk/corpus/reader/api.py) validates a sub-reader root only against the global NLTK data sandbox and not against the enclosing corpus root, a directory symlink named psd or pos planted inside a YCOE corpus lets the reader anchor its nested sub-readers outside the YCOE corpus root. An attacker who controls the contents of a YCOE corpus loaded under pathsec.ENFORCE=True can make parsed_sents(), tagged_words(), and related methods return file con…
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
·GitHub Advisories
If an attacker could influence a link that was crawled during the prerender phase, that link could later be interpreted as a regex in the Vercel routing configuration.
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
·GitHub Advisories
If an attacker can influence the links crawled during prerendering, they can influence the redirects entries that are added to the Cloudflare platform redirects generated during the adapt phase of the build.
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
·GitHub Advisories
In affected versions, @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the server to crash, denying service to any other requests routed to that server.
Tornado: Open redirect via triple-slash redirect paths
·GitHub Advisories
### Summary Due to differences in the way browsers and Python's urllib parse urls, browsers treat a string starting with three or more slashes as a protocol-level redirect, while urllib does not. This means that the 6.6.0 fix for the RedirectHandler open redirect (CVE-2026-116578, commit cc75ab0e) is incomplete. Tornado 6.6.1 improves the open-redirect detection to handle this case correctly, as well as fixing a regression in the 6.6.0 implementation.
Kitesurf, our experimental browser engine for AI agents, is now open source. Inspect the code, run it locally, or deploy your own instance on Cloudflare Workers.
### Summary A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion. ### Details The from_text() parser does not check that a WKS record service number is between 0 and 65535 inclusive. It then uses this number to resize the bitmap to accommodate a bit with that offset. This can cause extremely large memory allocations, and also extends the array very inefficiently, wasting CPU. ### Proof of concept This demonstrates the failure to limit the service number, though with a value that does not cause excessive memory or CPU consumption. `` rd = dns.rdata.from_text("IN", "WKS", "10.0.0.1 udp 65536") `` ### Impact If dnspython is used to read zonefile format where the attacker can control the t…
Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes
·GitHub Advisories
### Summary Since 4.6.0, Nuxt parses a request path that starts with // as a URL with a host before rendering a page, so //x/admin renders the page at /admin. Nitro's routing, Nitro's route rules and server/middleware see the path as //x/admin, so server-side checks keyed on /admin do not apply. The fix for [GHSA-9v7c-q64q-vv33](https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33) in 4.6.3 covered dot segments but not this form. ### Impact An unauthenticated attacker can bypass server-side controls that match on the request path of a page route. A route-scoped server handler is skipped: ``ts // nuxt.config.ts export default defineNuxtConfig({ serverHandlers: [{ route: '/admin', middleware: true, handler: '~~/server/admin-guard.ts' }], }) `` ```ts // serv…
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
·GitHub Advisories
### Summary @opentelemetry/instrumentation-http redacts sensitive URL query parameters on **outgoing (client) spans** but not on **incoming (server) spans**. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL signatures, Azure SAS tokens (sig), GCS signed-URL signatures — are exported in plaintext to the configured tracing backend. Configuring the redactedQueryParams option **does not change this**, as this applies only to outgoing (client) spans. ### Impact **Information disclosure / credential leakage** (CWE-200; CWE-532, insertion of sensitive information into telemetry data). **Who is impacted:** any Node.js service instrumented with @opentelemetry/instrumentation-http —…
Adapting to AI penetration testing orchestrators: The Modern Security Model
·Cloudflare
AI-orchestrated penetration testing platforms like ARTEX have become increasingly powerful tools enabling effective attacks on exposed infrastructure. Here we share Cloudflare’s observations and recommended countermeasures.
AutoMapper: Uncontrolled Recursion with Constructor Parameters
·GitHub Advisories
### Summary MaxDepth, whether set explicitly or applied by default (64) to self-referential type maps, was not enforced when the recursion goes through constructor parameters. Mapping a deeply nested source to a destination built through its constructor, such as a positional record, recurses without bound and throws a StackOverflowException. That exception can't be caught and terminates the process. This bypasses the mitigation for CVE-2026-32933. ### Details The type depth used by MaxDepth was incremented only after the destination object was created. Constructor parameters, including child objects of the same type, are mapped while the destination is created, so each level recursed before its parent was counted, and the depth check never tripped. Affected: - destination types ma…
russh kex_done: Shared-secret callback runs before server host-key verification
·GitHub Advisories
### Summary A malicious SSH server whose host key is rejected can still cause russh's client::Handler::kex_done() callback to execute with the raw key-exchange shared secret. Applications using the callback for its documented protocol-bridging purpose may derive keys, initialize a secondary data channel, or perform another externally visible action before russh calls check_server_key() and rejects the server. ### Details During the initial key exchange, russh calls kex_done() immediately after the server proves possession of the presented host key, but before the application decides whether that key belongs to the intended server: ```rust let shared_secret = newkeys.kex.shared_secret_bytes(); handler .kex_done(shared_secret, &newkeys.names, session) .await?; // Initial KEX only chec…
russh try_sign: asynchronous confirmation can sign after agent lock
·GitHub Advisories
### Summary In russh 0.65.0, a sign request for a confirmation-constrained key can retain and use the private key after another connection locks the agent. try_sign() snapshots an Arc before awaiting Agent::confirm() and does not revalidate the shared lock state after the await. An agent-forwarding peer can therefore obtain a signature while the agent is locked and every new request is being rejected. ### Details The agent's lock and key stores are shared by all connections. respond() reads the lock state once, then dispatches a sign request: ```rust let is_locked = { // ... read the shared lock ... }; // ... Some((&13, mut r)) if !is_locked && agentref.confirm_request(MessageType::Sign).await => { let agent = self.agent.take().ok_or(Error::AgentFailure)?; let (agent, signed) =…
## Summary OpenTelemetry Go eagerly materializes W3C baggage metadata into property objects during parsing. Slice growth, serialization, and copying into the internal representation cause **bounded but disproportionate memory-allocation amplification** for a valid, densely populated header. In v1.46.0 and v1.47.0-rc.1, the 8,192-byte raw-input limit is checked before member parsing; this is not unlimited allocation or a bypass of that limit. A valid 8,191-byte value containing one member and 4,094 properties causes approximately 778 KB of cumulative allocation per parse. A corrected measurement with forced garbage collection before and after parsing retains approximately 164 KB per result while it remains live. These are different metrics: approximately 95 times the input in allocation tr…
opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes
·GitHub Advisories
## Summary The AttributeValueLengthLimit span/log-record limit can be bypassed entirely with attribute values that consist of valid U+FFFD (REPLACEMENT CHARACTER) runes. The counting-based truncation introduced by the fix for GHSA-p9f8-wvj8-2fg8 (commit e016a78c9, first released in v1.33.0) has an "optimistic" fast path that skips every U+FFFD without counting it and without falling back to the correct slow path. A value of 1000 U+FFFD runes (3000 bytes) is stored verbatim even with a limit of 5 characters (15 bytes). The same defect affects the attribute truncation paths in go.opentelemetry.io/otel/sdk/trace (sdk/internal/attrnorm), go.opentelemetry.io/otel/sdk/log (sdk/log/internal/attrnorm), and the auto-instrumentation tracer in go.opentelemetry.io/otel/trace (`trace/aut…
sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger
·GitHub Advisories
### Summary sqlite3-ruby cast Ruby string lengths (long) to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing WHERE clause. The affected paths are: - the SQL passed to Database#prepare, #execute, and related methods - String and Blob values passed to Statement#bind_param and related methods - String and Blob values returned from SQL functions and aggregates defined in Ruby (Database#create_function, #create_aggregate, and related methods) sqlite3 v2.10.2 raises RangeError when any of these strings is longer than INT_MAX bytes. ### Severity T…
Laravel: Task Output Injection - Concurrency Process
·GitHub Advisories
### Summary If a concurrency task prints user-controlled text, an attacker can forge the framework's internal result message and achieve remote code execution in certain conditions ### Pre-reqs Insecure code and insecure handling of user provided input (devs trust user-provided input) : 1. App has a route that reaches Concurrency::run() (Not by default, it requires app code) 2. The task writes user-controlled data to stdout (echo/print/dd of input, hand-built JSON via string concat, passthrough of tool output), and the user-controlled bytes can be made to start the child's stdout and form a complete JSON document followed by \x1f\x8b (Not by default, requires the specific coding pattern in the app code) ### Patches * 13.40.0 * 12.71.0
AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth
·GitHub Advisories
### Summary The default and explicit MaxDepth limits added for CVE-2026-32933 don't apply to several mapping paths. Mapping a deeply nested source through any of them recurses without bound and throws a StackOverflowException, which can't be caught and terminates the process. ### Affected paths - **Polymorphic maps:** derived type maps (Include / IncludeBase) didn't inherit the base map's MaxDepth, and the default limit for self-referential maps was only applied to the base map. A chain of derived objects was mapped without a limit, even with MaxDepth set on the base map. - **Runtime-typed members:** members typed as object or an interface aren't seen by self-reference detection, so the default limit isn't applied. - **Dictionary and dynamic sources:** mapping a nested `Dict…
Astro: XSS via attribute injection in dynamic tag names
·GitHub Advisories
## Summary When a dynamic tag (const Tag = ...; ) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name such as img/src/onerror=alert(1) was rendered as an `` element with an onerror attribute. The JSX renderer used for MDX did not filter string tag names at all. For example: ``astro --- const Tag = Astro.url.searchParams.get('as') ?? 'div'; --- hello `` rendered ?as=img/src/onerror=alert(1) as live HTML. ## Impact Reflected or stored cross-site scripting, but only in applications that use untrusted input (such as a request parameter or an uncontrolled CMS field) as all or part o…
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
·GitHub Advisories
## Summary The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check. For example, with the client output directory at /srv/app/dist/client/, a request such as: ``text /_image?href=/../../DIST/client/secret.png&w=32&f=png `` resolved to /srv/app/DIST/client/secret.png and was served, even though that file is outside the output directory. ## Impact An unauthenticated attacker can read image files from outside the output directory, but only when all of the following a…
Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file
·GitHub Advisories
### Summary Nuxt can pick a parent directory that does not declare a workspace as its default workspaceDir: the farthest directory with a lockfile when the project is not inside a git repository, or the farthest directory with a pnpm-workspace.yaml or deno.json file, even one that only holds settings. The Vite dev server allows /_nuxt/@fs/ requests for any file under workspaceDir. A stray lockfile or settings file in a parent directory, such as the home directory, therefore lets anyone who can reach the dev server read files in that directory and everything below it. ### Impact This affects the development server only; production builds are not affected. All of the following have to hold: - A parent directory contains either: - a lockfile (package-lock.json, pnpm-lock.yaml,…
rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls
·GitHub Advisories
## Summary Rails::HTML::SafeListSanitizer (both the HTML4 and HTML5 variants) shares one Rails::HTML::PermitScrubber across every sanitize call on the same instance, assigning its tags and attributes on each call without synchronization. Two concurrent sanitize calls with different tags: or attributes: options can interleave, so one call is scrubbed with the other call's allowlist. - Versions affected: < 1.7.2 - Not affected: none - Fixed versions: 1.7.2 ## Impact Action View memoizes a single SafeListSanitizer per helper module and uses it for every sanitize call in the process, so in a multi-threaded server (for example Puma) all requests share the same PermitScrubber. If any code path calls sanitize with a more permissive allowlist, an attacker who can trigg…
envd: Host file disclosure through requirements path traversal and TOCTOU
·GitHub Advisories
### Summary envd’s install.python_packages(requirements=...) could read files outside the build context on the host. Content interpreted as dependency entries could appear in build logs and build-step metadata. Commit f576c92, released in v1.3.5, added path containment validation but left a time-of-check/time-of-use (TOCTOU) race between symlink resolution and opening the requirements file. Commit 9d575b3 addresses this race by opening requirements files through a directory-rooted filesystem handle. ### Details envd reads requirements files on the host to determine whether their contents can be embedded directly into a pip installation build step. The vulnerable host-side requirements read was introduced in v0.3.38. Version v1.3.5 added containment checks for static path escapes but rem…
rails-html-sanitizer: Possible regular expression denial of service with certain configurations
·GitHub Advisories
## Summary Rails::HTML::PermitScrubber restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length. - Versions affected: >= 1.0.3, < 1.7.2 - Not affected: < 1.0.3 - Fixed versions: 1.7.2 Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear. ## Impact An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of wh…
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
·The Hacker News
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the server. The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8. Any code run this way has the rights of the operating
OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing
·GitHub Advisories
## Summary TraceContextTextMapPropagator.extract() in opentelemetry-api is vulnerable to regular expression denial of service (ReDoS) when processing a specially crafted traceparent value. A malformed value containing a trace-context prefix followed by a long whitespace sequence and an embedded newline triggers quadratic-time regex backtracking. Applications that extract trace context from untrusted carriers accepting such strings can experience excessive CPU consumption and request-processing delays. When extraction runs on an asynchronous server’s event-loop thread, a single malicious message can delay unrelated requests handled by that event loop. ## Exposure conditions Exploitation requires attacker-controlled input to reach the affected propagator through a carrier that preserv…
Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER
·GitHub Advisories
### Summary The IDENTIFIER/CSS_ESCAPES regex (css_parser.py:119-124) exhibits exponential backtracking on a run of ambiguous digit-escapes (\9) in an attribute-name or tag position of an otherwise well-formed selector. It fires at compile time (before the SELECTOR_LIMIT guard) via the public soupsieve.compile() and BeautifulSoup .select(). ### PoC (verified on soupsieve 2.9.2) import soupsieve as sv sv.compile('[a' + '\\9'*26 + '=x]') # ~57 bytes -> ~10s; ~16x time per +4 chars ### Novelty Distinct from the patched GHSA-836r-... (VALUE regex) and GHSA-2wc2-... (comma-list) advisories, which are fixed in 2.9.2; this is a different regex/vector. ### Reachability CSS selectors are usually developer-controlled, so exposure requires an application that compiles UNTRUSTED selector strings…
Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack
·GitHub Advisories
## Summary The Soup Sieve CSS selector parser recurses once per level of nested pseudo-class selector (:is(), :not(), :where(), :has()) without any limit on nesting depth. An unauthenticated attacker who can supply a CSS selector string to soupsieve.compile(), soupsieve.select(), or Beautiful Soup's soup.select() / soup.select_one() can force the parser to exceed Python's recursion limit with a small crafted input (about 1.6 KB, roughly 330 nesting levels), raising an uncontrolled RecursionError. Because this exception is not part of the parser's documented error contract, applications that catch only ValueError or SelectorSyntaxError see an unexpected failure of the request or task that parsed the selector. ## Root Cause The parser dispatches each opening pseudo-cla…
New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
·The Hacker News
Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server's operator out. One of them, Mior, can also modify a VM's memory and fake the signed report confirming which software it runs. Both need control of the server's hypervisor, and Mior also needs control of the server's BIOS. Researchers
FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
·The Hacker News
The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering scheme codenamed FaceStealer in the last 18 months. As part of a coordinated set of actions announced by the U.S. government, the cloud-based
Introducing Spend Management: Spending limits and alerts for Cloudflare
·Cloudflare
Spend Management adds opt-in spending caps for Cloudflare Workers and Durable Objects, and more products soon. Here is how we built the metering pipeline that turns usage into runtime decisions.
Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases
·The Hacker News
Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday. The implant reads the phrase from the wallet's screen and sends it over the mobile network to a server controlled by the attackers. The company examined one of the wallets in its lab, identified the other
Duplicate Advisory: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qg35-44qx-7vrr. This link is maintained to preserve external references. ## Original Description NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.
Duplicate Advisory: Unbounded CPU consumption in NLTK SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8fx7-8jr8-84rv. This link is maintained to preserve external references. ## Original Description NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.
Duplicate Advisory: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ffr9-mgrr-wcvr. This link is maintained to preserve external references. ## Original Description NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.
Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-89p3-fcch-88ph. This link is maintained to preserve external references. ## Original Description NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.
Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read
·GitHub Advisories
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fg9w-wfp5-j933. This link is maintained to preserve external references. ## Original Description NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59f9-gqg8-mqpj. This link is maintained to preserve external references. ## Original Description NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.
Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has access to the records and its connected tools allow the action. That kind of scenario raises a response question: what does “stop the agent” actually mean? A
SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
·The Hacker News
A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week. It assessed with high confidence that SilentAir is a state-level actor,
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins
·The Hacker News
An international police operation took down servers behind Gootloader, CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks. Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office (BKA). Gootloader is a loader:
Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files
·The Hacker News
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave
Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
·The Hacker News
N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell. "We are restricting certain N-central features and integrations," the company said in a Thursday update. "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens
·GitHub Advisories
## Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints. ## Proof of Concept The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and `v…
Soup Sieve: Polynomial-time denial of service in the descendant combinator
·GitHub Advisories
## Summary Matching a selector that uses the descendant combinator (a b) takes time that grows polynomially with how deeply the document is nested, and each extra descendant combinator in the selector raises the degree by one. A selector with k descendant combinators takes O(n^(k+1)) time on a chain of n nested elements. An attacker who controls the HTML or XML that an application passes to Soup Sieve (directly, or through Beautiful Soup's select(), select_one(), css.select(), etc.) can send a very small, deeply nested document that keeps a CPU busy for seconds to minutes against an ordinary selector such as section div div. ## Details To match a b, Soup Sieve checks each element against b and then walks up through its ancestors looking for one that matches a. When t…
Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
·GitHub Advisories
## Summary Matching a selector that puts a general-sibling combinator inside :has(), such as div:has(a ~ b), against untrusted HTML runs in O(n²) time in the number of sibling elements. A single small document with a few thousand siblings ties the process up for a minute of CPU, so an application that runs a fixed selector of this shape over HTML it doesn't control can be stalled by one request. :has is powerful, but much in the same way poor regular expressions can be crafted to cause catastrophic backtracking with greedy capturing, has can be used to create non-ideal scenarios that can cause large portions of the tree to be evaluated for one or many elements if not used thoughtfully. This behavior is not exclusive to Soup Sieve, but browsers make note of these potential performanc…
Active Storage: Possible arbitrary file write and read in image analysis
·GitHub Advisories
### Impact A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secret_key_base and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. ### Details ImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to inv…
Action Pack: Possible DoS vulnerability in Action Controller Live streaming
·GitHub Advisories
### Impact ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion. Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. ### Releases The fixed releases are available at the normal l…
Action Pack: Possible sensitive session information leak in Active Storage proxy mode
·GitHub Advisories
### Impact When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's…
Action View: Possible XSS vulnerability in highlight helper
·GitHub Advisories
### Impact ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the `` form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default \1 highlighter and the block form are not affected. ### Details The fixed releases HTML-escape each group substituted into the :highlighter string, so quotes in a…
Action View: Possible XSS vulnerability in strip_tags
·GitHub Advisories
### Impact strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, ``, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a `` tag, are affected. Output rendered as element content is not affected. ### Details strip_tags now encodes " and ' in its output, as well as &, ``, without double-encoding existing entities. Applications that use strip_tags output outside HTML, such as in a t…
Action View: Possible XSS vulnerability in text helpers
·GitHub Advisories
### Impact With the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes `` unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with `ht…
Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control
·GitHub Advisories
### Impact When a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the response-content-type that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on storage.googleapis.com. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bu…
Action Pack: Possible Strong Parameters Bypass in Parameters#each_key
·GitHub Advisories
### Impact ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of [CVE-2020-8164](https://github.com/advisories/GHSA-8727-m6gj-mc37), which made each, each_pair and each_value return the `Paramet…
Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
·GitHub Advisories
`` ============================================================================ ANT-2026-D7STJUWL [medium] CWE-770 dos Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data Location: src/PIL/TiffImagePlugin.py:927 in ImageFileDirectory_v2.load() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ `` A small, crafted image file can make Pillow use thousands of times its own size in memory while the file is only being opened, which lets anyone who can submit an image crash or stall the process handling it. A 144 KB TIFF makes Image.open() return normally while holding 1.6 GiB of memory. The largest such standard TIFF, about 786 KB, asks for roughly 48 GiB, which in practice gets the worker killed by the…
Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
·GitHub Advisories
`` ============================================================================ ANT-2026-CS7N494P [high] CWE-787 memory-safety Heap buffer overflow saving TIFF with libtiff when tags override image size Location: src/libImaging/TiffDecode.c:1035 in ImagingLibTiffEncode() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ `` When Pillow saves an image as a compressed TIFF, size information taken from the image's metadata can make the encoder read past the end of a heap buffer. Someone who uploads an image can use this to get the server process's memory, including pointers, copied into the saved file, or to crash the process. When the metadata also enables TIFF "Predictor=2" compression, the encoder writes past the…
Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)
·GitHub Advisories
### Summary csrf() validates a request only when its Content-Type is one of the three types an HTML form can send. Chromium's hyperlink auditing (``) sends a cross-origin POST with the user's cookies and the content type text/ping, which is not in that list. The middleware does not look at Origin or Sec-Fetch-Site for such a request, so it is passed to the handler. ### Details The middleware skips the origin check when the content type is not one that a form submission produces. The assumption was that any other content type requires a CORS preflight and therefore cannot be sent cross-origin with credentials. Hyperlink auditing is an exception: Chrome and Edge send the ping as a credentialed POST without a preflight, with a fixed body and Content-Type: text/ping. A page on ano…
Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
·GitHub Advisories
### Summary validator('form') only recognizes a multipart/form-dataContent-Type that carries nothing but a single boundary parameter. A request with another legal parameter, such as charset, or with extra whitespace after the ; is not recognized as a form. The validation callback then receives an empty object, while c.req.parseBody() still parses the body as a form. ### Details The check that decides whether a request body is a form was written as a strict pattern over the whole Content-Type value. Any parameter list that does not look exactly like ; boundary=... fails the check. When it fails, the middleware does not read the body and passes an empty object to the validation callback. If the callback accepts an empty object, the request proceeds to the handler, which c…
Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix
·GitHub Advisories
### Summary mount() and app.mount() remove the mount prefix from the request path and forward the rest to the mounted application. Two mistakes in that step let a crafted request reach a route of the mounted application that the outer application protects with path-scoped middleware, such as an authentication check on /app/admin/*. The outer application routes on the original path, so the middleware does not run. ### Details 1. **Dynamic prefix** (all affected versions): for a mount such as /api/:tenant/*, the prefix was removed by the length of the route pattern, not of the matched prefix. A request with a longer or shorter first segment is cut in the middle, so /api/a/xxxxx/admin/secret reaches the mounted application as /admin/secret. 2. **Re-normalization** (since 4.12.21)…
Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
·GitHub Advisories
### Summary RegExpRouter, which the default SmartRouter selects for most applications, skipped wildcard middleware in three cases, so a route handler ran without the middleware registered for it: 1. Middleware whose parameter is written with the explicit default pattern, such as /api/:tenant{[^/]+}/admin/*, was not applied to a route written as /api/:tenant/admin/:id. (since 4.13.0) 2. Middleware on /admin/* was not applied to a route registered on /admin* for paths under /admin/. (since 4.1.4) 3. For a path with an encoded line terminator (%0A, %0D, %E2%80%A8, %E2%80%A9), no wildcard pattern matched, so the request reached the not-found handler without any wildcard middleware. (since 4.4.0) TrieRouter, LinearRouter and PatternRouter apply the middleware in all three c…
@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
·GitHub Advisories
### Summary The StringMatcher/PathMatcher for safe_regex builds its RE2 as ^${regex}$ with no surrounding group. Because alternation has the lowest precedence, a pattern "a|b|c" compiles to /^a|b|c$/ -- "starts with a" OR "contains b" OR "ends with c" instead of a full match of the whole value. Configurations with safe_regex matchers that use a regex alternation (a natural way to list methods or service identities) therefore apply partial string matches. This impacts route selection, xDS credentials, and RBAC. ### Details src/matcher.ts: SafeRegexValueMatcher and PathSafeRegexValueMatcher both do ``ts this.targetRegexImpl = new RE2(^${targetRegex}$, 'u'); `` and apply() returns targetRegexImpl.test(value). With a top-level alternation the anchors bind only to the f…
UnrealIRCd UnrealIRCd: UnrealIRCd Improper Neutralization of Delimiters Vulnerability
·CISA KEV
UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Check Point Multiple Products: Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
·CISA KEV
Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
·GitHub Advisories
### Summary XdsServer in @grpc/grpc-js-xds does not apply RBACPerRoute overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, XdsServer ACKs the resources but evaluates the RPC under the top-level policy. ### Details ### Override parser lookup uses the override message type parseOverrideFilterConfig() in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type: type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257 setup() in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:16…
msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM
·GitHub Advisories
### Summary The **JRuby** implementation of msgpack (msgpack gem, java platform — pure Java decoder under ext/java/) sizes containers directly from the element count written in the message header, with **no cap at all**: no equivalent of the C unpacker's SHRT_MAX clamp (since 1.7.3) and none of the buffered-bytes cap that commit c8d42d8 added for CRuby in 1.8.6. A single 5-byte message decides how much memory a JVM process tries to allocate: * array32 header declaring 0x7FFFFFFF elements → new IRubyObject[0x7FFFFFFF] (~8 GiB of reference slots) attempted immediately → java.lang.OutOfMemoryError: Requested array size exceeds VM limit. * Counts *below* the VM's max-array-size but above available heap (e.g. 5×10⁸ with a 512 MiB heap) produce a **real allocation attempt** — `O…
Addressable display_uri can show misleading hosts with invalid Punycode A-labels
·GitHub Advisories
### Impact Addressable::IDNA.to_unicode, in the pure-Ruby IDNA implementation, decodes Punycode labels (labels beginning with xn--) that are not valid A-labels. Those labels are returned in decoded form, when they should be returned unchanged. That includes: - labels that decode to only ASCII characters, e.g. xn--google- decodes to google; - labels that decode to text that doesn't convert back to the same label (RFC 3490 §4.2), e.g. text that isn't in normalized form. Addressable::URI#display_uri uses to_unicode, so for https://xn--google-.example.org/ it displays the host google.example.org, while #host, #normalized_host and any connection made from the URI use xn--google-.example.org. An attacker who controls a domain can therefore have a URI displayed as a host th…
Addressable display_uri can show misleading hosts containing bidi and invisible characters
·GitHub Advisories
### Impact Addressable::IDNA.to_unicode decodes Punycode labels (labels beginning with xn--) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. Addressable::URI#display_uri uses to_unicode, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of http://xn--abcmoc-dm0c.com/ is displayed as abc, U+202E, moc.com, and the override makes everything after abc render right to left. Parsing, host, normalized_host and any connection made from the URI are not affected. Only the displayed form is. Applications th…
Addressable: Denial of service in URI path normalization
·GitHub Advisories
### Impact Addressable::URI.normalize_path takes time quadratic in the number of nested dot segments in a path (e.g., "/" + "a/" * n + "../" * n, which for n = 3 is /a/a/a/../../../), because it removes one dot segment per pass over the whole path. URI#normalize, URI#normalized_path, URI#==, URI#=== and URI#join all call it. Normalizing, comparing or joining a URI taken from user input can result in uncontrolled resource consumption, leading to denial of service. On 2.9.0, normalizing a 34 KB path takes about 3.5 seconds on MRI Ruby 4.0, and the cost grows with the square of the path length. This affects every Ruby implementation, including MRI Ruby 3.2 and later. URI.parse by itself is unaffected, as is code that never normalizes, compares, or joins URIs from untrusted…
Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
·GitHub Advisories
## Summary The @astrojs/solid-js renderer wraps named slot content passed to Solid components in an `` element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: ``astro --- import Tabs from '../components/Tabs.jsx'; const tab = Astro.url.searchParams.get('tab'); --- … `` rendered with a Solid component that renders a slot by name: ``jsx export default function Tabs(props) { return {props[props.active]}; } `` would output a tab value such as x"> as live HTML. ## Impact Reflected cross-site scripting. An attacker who gets a user to open a crafted link can run JavaScript on the site's origin, but only in ap…
Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
·GitHub Advisories
## Summary The @astrojs/svelte renderer wraps slotted content passed to Svelte components in an `` element, and writes the slot name into its name attribute without HTML escaping. A slot name containing " could end the attribute and inject arbitrary HTML into the page. For example, a page that takes a slot name from the request: ``astro --- import Tabs from '../components/Tabs.svelte'; const tab = Astro.url.searchParams.get('tab'); --- … `` rendered with a Svelte 5 component that renders its snippets by name: ``svelte let { active, ...snippets } = $props(); {@render snippets[active]?.()} `` would output a tab value such as x"> as live HTML. ## Impact Reflected cross-site scripting. An attacker who gets a user to open a crafted link can run JavaScript on the site's origin, bu…
Addressable: Regular Expression Denial of Service in templates with certain exploded expressions
·GitHub Advisories
### Impact Within the URI template implementation in Addressable, templates using the * (explode) modifier with the /, ., ;, ? or & operators (e.g., {/segments*}, {.ext*}, {;params*}, {?query*}) generate regular expressions vulnerable to catastrophic backtracking. When Template#match or Template#extract is called with a maliciously crafted URI that starts with the operator's leading character, matching takes exponential time, leading to uncontrolled resource consumption and denial of service. An input under 60 bytes is enough to occupy a thread for minutes. GHSA-h27x-rffw-24p4 (CVE-2026-35611) reported this pattern as fully remediated in 2.9.0. The 2.9.0 fix only made the joiner between exploded members mandatory for templates without an operator, and its regressio…
Addressable: Regular Expression Denial of Service in templates with multiple variables
·GitHub Advisories
### Impact Within the URI template implementation in Addressable, templates that put several variables in one expression generate regular expressions vulnerable to excessive backtracking: 1. Expressions with any operator other than + and # (e.g., {/owner,repo,ref}, {.a,b}, {a,b,c}, {;a,b,c}). The values are joined by an optional separator, so a run of characters can be divided among the variables in O(n^k) ways for k variables. 2. Expressions with the + or # operators and many variables (e.g., {+v1,v2,v3,v4,v5,v6,v7,v8,v9,v10}). A failing match is exponential in the number of variables. 3. Several single-variable expressions next to each other (e.g., {+a}{+b}{+c} or {a}{b}{c}), which are polynomial in the input length. When Template#match or Template#extract is c…
Addressable URI normalization resolves some dotted path segments to the wrong path
·GitHub Advisories
### Summary Addressable::URI.normalize_path resolves some paths containing .. segments to a different path than RFC 3986 does. When a path climbs above the root before any other .. is resolved, the segments that later .. segments should remove are instead kept: /../../public/x/../../secret normalizes to /public/x/secret instead of /secret. URI#normalize, URI#join, URI#== and URI#=== all use this normalization. An application that checks a normalized Addressable path against an allowlist, but sends the original URI to something that resolves it according to RFC 3986, can be made to allow a request for a path outside the allowlist. ### Details normalize_path in 2.9.0 (lib/addressable/uri.rb) removes dot segments by repeating a set of rewrites until nothing changes.…
basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF
·GitHub Advisories
### Summary Client.login() calls FTPContext.send() from inside the control-socket data event handler. send() throws on CR, LF or NUL, and nothing catches the throw. A password containing \r\n therefore raises an uncaught exception and terminates the whole Node.js process. It does not reject the returned promise. Any application that passes untrusted input as the FTP password can be crashed remotely with one request. The same pattern exists in the REST/RETR path of downloadTo() when the remote path contains control characters. ### Details The CRLF guard (FTPContext.send, src/FtpContext.ts ~L233) correctly refuses to send commands containing \r, \n or \0: ``ts send(command: string) { if (/[\r\n\0]/.test(command)) { throw new Error(Invalid command: Contains control characters. (${command})…
Action View: Possible XSS vulnerability in tag helpers
·GitHub Advisories
### Impact The fix for [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq) skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as image_tag, video_tag and audio_tag, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML at…
Active Storage: Possible local file disclosure in video previews and analysis
·GitHub Advisories
### Impact Active Storage's VideoPreviewer, VideoAnalyzer and AudioAnalyzer run ffmpeg and ffprobe on a blob's contents without restricting the input format, so FFmpeg selects a demuxer by probing the file. A blob created through a direct upload keeps the content type the client declared, so a client can store an HLS playlist under a video/* or audio/* type. When that blob is previewed or analyzed, the hls demuxer opens the file:// segments that the playlist names, and the preview image or the stored metadata could disclose a local media file that the application process can read and whose path the attacker knows. Applications that accept uploads from untrusted users and generate video previews, or analyze video or audio attachments with FFmpeg, are affected. ### Details…
basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
·GitHub Advisories
### Summary basic-ftp's MLSD directory-listing parser (src/parseListMLSD.ts) looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's response, with no validation. A directory-listing line containing the fact name "__proto__" resolves this lookup to Object.prototype (inherited, non-own, non-function) instead of undefined, so the "not a function" guard is bypassed and the code throws TypeError: factHandler is not a function. This TypeError is not an FTPError, so it is not caught by Client.list()'s retry logic and propagates as a rejected promise out of list() and every API built on top of it (list, downloadToDir, uploadFromDir, clearWorkingDir, removeDir). Any FTP server the client connects to — or any on-path attacker on a plaint…
@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
·GitHub Advisories
### Summary While @hono/node-server waits for the Hono application to handle a WebSocket upgrade request, the socket has no error listener. If the client resets the TCP connection during that time, the resulting ECONNRESET is emitted as an unhandled 'error' event and the process terminates. ### Details The upgrade handler awaits the application before attaching any listener to the socket. When middleware on the upgrade path does asynchronous work, such as an authentication lookup, a connection reset in that window has no handler. If a global uncaughtException handler swallows the error, the pending upgrade is never released and its entry is retained for the lifetime of the process. The fix attaches error and close listeners to the socket before calling the application, releases th…
@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
·GitHub Advisories
### Summary @hono/node-server passes the raw request-target to the WHATWG URL parser, which treats a backslash in the path as / and then resolves .. segments. A request for /admin\secret or /public\..\admin/secret reaches the application as /admin/secret. A reverse proxy that follows RFC 3986 forwards the backslash unchanged and applies its path-based rules to the original path, so the request reaches a route the proxy is meant to block. ### Details A raw backslash is not allowed in a request-target (RFC 3986, RFC 9112 Section 3.2.1), and RFC 9112 Section 3.2 says a recipient should reject such a request rather than correct it. Proxies such as nginx on Linux, HAProxy and Envoy keep the backslash as an ordinary character, so they and the application see different paths. The fix…
Loofah: SVG `` and `` bypass local-reference restriction
·GitHub Advisories
## Summary Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction: - ``: SVG_ALLOW_LOCAL_HREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside ``, so the check never matched on the HTML5 path. - ``: absent from SVG_ALLOW_LOCAL_HREF, so its references were never restricted on either path. rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too. ## Impact An external href or xlink:href on `` or `` survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch exter…
Loofah allowed_uri? treats javascript: alert(1) as safe
·GitHub Advisories
## Summary Loofah::HTML5::Scrub.allowed_uri? returns true for a javascript: or vbscript: URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that allowed_uri? strips, such as a space or tab. A browser ends the reference at that character and reads javascript: alert(1) as javascript: alert(1). ## Details allowed_uri? strips control characters and whitespace before it decodes numeric character references. Removing the character that ends a semicolon-less reference lets the reference run on into the following text, so : alert decodes as Ϊ (U+03AA) instead of a colon, and no scheme is detected. The same applies to decimal references and to references that encode a scheme letter, as in `j\tavascri…
Loofah: CSS url() sanitization bypass via escaped parentheses
·GitHub Advisories
## Summary Loofah::HTML5::Scrub.scrub_css rejected any property whose top-level Crass tokens included a :url or :bad_url, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrub_css rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place. ## Impact A sanitized style attribute could make a viewer's browser issue a request to an attacker-chosen URL. list-style fetches on render with no interaction, cursor o…
Loofah: Regular expression denial of service in the SVG local-reference check
·GitHub Advisories
## Summary Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length. Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear. ## Impact An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace. The default safelist allows the elements in SVG_ALLOW_LOCAL_HREF, so no configuration…
Loofah allowed_uri? treats data:text/html as safe text/plain
·GitHub Advisories
## Summary Loofah::HTML5::Scrub.allowed_uri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference / in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the same URI as text/html. ## Details allowed_uri? decodes HTML entities with CGI.unescapeHTML, which handles numeric character references but not HTML5 named character references. / therefore survives normalization, so the mediatype carries no /, fails the MIME grammar, and falls back to the allowed text/plain under the WHATWG rule for a malformed mediatype. :, /, and are the only named character references in the HTML5 table that decode to characters that cha…
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
·GitHub Advisories
## Summary Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape `` in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari. Nokogiri 1.19.5 escapes `` in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5. ## Impact Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist. No…
pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections
·GitHub Advisories
### Summary Every pg_hba.conf generated by the pgEdge Control Plane begins with a hard-coded block of trust entries covering Unix-socket and loopback connections. Any operating-system account that can reach the Postgres socket or the loopback interface on a database host can authenticate as any Postgres role, including the superuser, without presenting a credential. ### Details The generated file opens with the following six entries: `` local all all trust host all all 127.0.0.1/32 trust host all all ::1/128 trust local replication all trust host replication all 127.0.0.1/32 trust host replication all ::1/128 trust `` Postgres evaluates pg_hba.conf top-down and stops at the first matching rule. Because these entries are emitted at the top of the file, they also pre-empt every rule…
pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests
·GitHub Advisories
### Impact An unauthenticated caller able to reach the query endpoint could exhaust database and server resources with ordinary, inexpensive requests. The keyword-search arm read the entire corpus on every request and rebuilt an in-memory BM25 index from it, so the cost of serving a query scaled with the size of the source table rather than with the size of the result set. Each request cost the server and the tenant's database far more than it cost the caller to make, which makes this a materially more effective denial-of-service lever than flooding the endpoint with ordinary requests. The amplification factor grows with corpus size, so the largest deployments are the most exposed. Hybrid search was enabled by default and configured per pipeline rather than per request, so a caller could…
pgEdge RAG Server discloses part of the configured provider credential through API error messages
·GitHub Advisories
### Impact An unauthenticated remote caller could read part of the operator's configured LLM provider API key. The query API relayed the text of a provider error straight to the caller. That text carried the upstream provider's own message, and providers characteristically quote a partially masked form of the credential they rejected when authentication fails — so a failing provider call published a fragment of the operator's key. A caller who can reach the endpoint can cause such a failure and read the result. **Who is affected:** any deployment of pgEdge RAG Server at 1.0.0 or earlier, including all alpha and beta pre-releases, whose query endpoint was reachable by an untrusted party. The endpoint carries no authentication in the affected versions. The disclosed material authenticates…
pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests
·GitHub Advisories
### Impact Documents belonging to one caller could be returned to another. Where an application passes a customer or tenant identifier as a search filter, that scoping could be defeated by ordinary concurrent traffic. **No injection and no malformed input are required** — normal load is enough. The BM25 keyword index was a single per-pipeline object shared by every request. A request cleared it, refilled it from its own filtered corpus and then searched it, taking a separate lock for each step rather than holding the sequence as a unit. Concurrent requests therefore interleaved, and a search could run against a corpus that a different request's filter had populated. **Who is affected:** any deployment of pgEdge RAG Server at 1.0.0 or earlier, including all alpha and beta pre-releases, t…
pgEdge Go LLM Library discloses provider API key fragments in error messages
·GitHub Advisories
### Impact An unauthenticated caller could read part of the operator's configured LLM provider API key. The library's own health handler pings every configured provider using the operator's real credential and returns the resulting error text verbatim. Providers characteristically quote a partially masked form of the credential they rejected, so a failing ping published a fragment of the key. **The endpoint is unauthenticated by default.** authorize() returns true immediately when the consuming application sets no Authorize hook, so GET /v1/health is reachable by anyone who can reach the listening port unless the consumer opted in to authentication. **Who is affected:** any application embedding pgedge-go-llm-lib at 0.1.0 or 0.1.1 that exposes the bundled HTTP proxy without sett…
Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients
·GitHub Advisories
### Summary An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs. WebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscription path does not enforce an authorization check. processSubscribe handles subscriptions to the log path separately, without applying access control: ``ts if ( Array.isArray(msg.subscribe) && msg.subscribe.length > 0 && msg.subscribe[0].path === 'log' ) { if (!spark.logUnsubscribe) { spark.logUnsubscribe = startServerLog(app, spark) } } else { // normal subscriptions go through subscriptionmanager, which applies // securityStrategy.filterReadDelta } `` startServerLog then replays the whole buffer to that socket: ```ts app.log…
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
·GitHub Advisories
### Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection. ### Workarounds Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
code16/sharp: Arbitrary class instantiation through the embed_key API parameter
·GitHub Advisories
### Impact An authenticated attacker can instantiate any class in the PHP application by using the embed_key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the __construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embed_key is a class extending SharpFormEditorEmbed before any instantiation. ### Workarounds No known workarounds.
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories
·The Hacker News
A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there. Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn't be. AI is helping them build attacks faster, while
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
·The Hacker News
Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop, targets a log-authentication feature added to the driver last year. It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of
Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability
·GitHub Advisories
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components. Aspire Dashboard's unauthenticated NotFound route can permit telemetry deletion in both standalone and AppHost-hosted deployments. In standalone deployments using browser-token authentication, it can also expose the browser token. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/526 ## CVSS Details - **Version:** 3.1 - **Severity:** Critical - **Score:** 9.1 - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - **Weakness:** CWE-862 ## Affected Platforms - **Platforms:** Any supported OS - **Architectures:** x64, Arm64 ##…
Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
·The Hacker News
A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account. When it is off, anyone with a valid account can still exploit the flaw, Red Hat said yesterday. The company has released fixed builds for eight Quay
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
·The Hacker News
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below - CVE-2026-120868 (CVSS score: 9.3) - A memory overflow vulnerability in Packet
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
·The Hacker News
Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern has been codenamed TypoPrompting by Island. "AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify,
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
·The Hacker News
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
·The Hacker News
Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between VMs and the host. Inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel. The affected
Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them
·The Hacker News
Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what can they access? A suspicious login might belong to an employee. An unusual API call could come from a machine account. Or an AI agent might be accessing sensitive systems using permissions nobody
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
·The Hacker News
N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory. "Legacy API is
Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign
·The Hacker News
Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire.
PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution
·The Hacker News
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325, carries a CVSS v4 score of 9.2 out of a maximum of 10.0. It has been described as a case of improper input validation and deserialization of untrusted data that could result in
Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover
·The Hacker News
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the database, released fixed versions earlier this week. The affected servers are members of a replica
Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data
·The Hacker News
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1. The crash
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
·The Hacker News
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
·The Hacker News
A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
·The Hacker News
ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
·The Hacker News
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via
AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
·The Hacker News
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against
Cloudflare is building an experimental consensus service using a never-before-deployed consensus algorithm, QuePaxa. In this post we explain how QuePaxa works and why we chose it.
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
·The Hacker News
Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some
Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
·The Hacker News
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or
We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
·The Hacker News
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
·The Hacker News
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes
·The Hacker News
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges
·The Hacker News
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons
·The Hacker News
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
·The Hacker News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity