PolinRider operators compromised a GitHub account to insert malicious code into development versions of visanduma/nova-two-factor, a Packagist package with over 700,000 downloads. The campaign spreads through compromised developer accounts and Git repositories across multiple ecosystems including npm, PyPI, Go modules, Packagist, and Chrome extensions. The operators use Git history rewriting, payload concealment in configuration files and font files, automatic execution through IDE tasks, and staged payload delivery via dead-drop mechanisms like EtherHiding and NullReceiver. Primary infection occurs through Git-based collaboration rather than direct package registry compromise, with PHP projects targeted using obfuscated JavaScript executed through shell_exec. The campaign appears linked to North Korean operators focused on cryptocurrency theft.

AlienVault OTX General

Detailed information about PolinRider Spreads Through Compromised GitHub Accounts and Packagist. Get real-time updates, technical details, and mitigation strate

PolinRider Spreads Through Compromised GitHub Accounts and Packagist - Live Threat Intelligence - Threat Radar | OffSeq.com

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Fraudulent organizations in Korea are exploiting private Home Trading System (HTS) software to distribute ransomware to victims. The unauthorized HTS program called 'UBP Asset' impersonates the legitimate Swiss financial institution Union Bancaire Privee (UBP) and has been used in investment scams since at least September 2025. Attackers lure victims through social media platforms like Telegram and KakaoTalk, convincing them to install the fraudulent HTS and deposit funds. The latest campaign involves distributing KRSID ransomware through the HTS update mechanism, which encrypts files using AES-256 and RSA-2048 algorithms. Previous campaigns used similar private HTS programs to distribute Quasar RAT. Victims not only lose their investment funds but also have their systems compromised and files encrypted for ransom demands.

Detailed information about Private HTS programs that spread ransomware. Get real-time updates, technical details, and mitigation strategies.

Private HTS programs that spread ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

Private HTS programs that spread ransomware

CVE-2026-93560 is a denial-of-service vulnerability in the Red Hat build of Apache Camel for Spring Boot 4. It arises from a content-length long-to-int truncation issue in the STOMP codec, which causes an infinite decode loop. This flaw allows an unauthenticated attacker to cause a denial of service by exhausting resources. The vulnerability has a high severity with a CVSS score of 7.5. No patch or remediation details are currently provided by the vendor advisory.

This vulnerability (CVE-2026-93560) involves a content-length long-to-int truncation in the STOMP codec implementation within the Red Hat build of Apache Camel for Spring Boot 4. The truncation leads to an infinite decode loop, resulting in a denial-of-service condition. The issue does not impact confidentiality or integrity but causes high impact on availability. The vulnerability is remotely exploitable without privileges or user interaction. The vendor advisory is available but does not specify patch or mitigation status.

CVE Database V5

Detailed information about CVE-2026-93560: CWE-1035 in Red Hat Red Hat build of Apache Camel for Spring Boot 4 affecting Red Hat Red Hat build of Apache Camel f

CVE-2026-93560: CWE-1035 in Red Hat Red Hat build of Apache Camel for Spring Boot 4 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-93560: CWE-1035 in Red Hat Red Hat build of Apache Camel for Spring Boot 4

A Cross Site Scripting (XSS) vulnerability exists in Moonshot AI Kimi as of 2026-07-18. This flaw allows a remote attacker to execute arbitrary code through the HTML artifact Preview rendering in the public Share view component.

CVE-2026-79294 describes a Cross Site Scripting vulnerability in Moonshot AI Kimi versions current as of 2026-07-18. The vulnerability arises from improper handling of HTML artifact Preview rendering within the public Share view component, enabling remote attackers to inject and execute arbitrary code in the context of the affected application.

Detailed information about CVE-2026-79294: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-79294: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-79294: n/a

Imager

CVE-2026-93019 affects Imager for Perl versions before 1.036. The vulnerability arises from an unsigned to signed conversion error when reading TGA image files with a color map length of 32768 or more. This causes the process to exit unexpectedly and uncatchably when processing attacker-supplied files.

Imager versions prior to 1.036 for Perl contain a vulnerability in the TGA image reader where the two-byte color map length is unpacked into a signed short. If the color map length is 32768 or greater, the value becomes negative due to signed conversion. This negative value is then cast to size_t, resulting in a very large allocation request near SIZE_MAX. The allocation fails, triggering Imager's allocator to call exit(3), causing the process to terminate immediately. This exit is uncatchable when reading files via Imager->read(), allowing an attacker to cause a denial of service by supplying a crafted TGA file.

Detailed information about CVE-2026-93019: CWE-196 Unsigned to Signed Conversion Error. Get real-time updates, technical details, and mitigation strategies.

CVE-2026-93019: CWE-196 Unsigned to Signed Conversion Error - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-93019: CWE-196 Unsigned to Signed Conversion Error

CVE-2026-39323 is a vulnerability in ChurchCRM CRM software characterized by a CVSS 3.1 base score vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating it can be exploited remotely over the network with low complexity and requires low privileges. It results in high impact on confidentiality, integrity, and availability. No affected versions or detailed technical information are provided, and no patch or remediation guidance is currently available.

Detailed information about CVE-2026-39323: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ChurchCRM CRM affecti

CVE-2026-39323: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ChurchCRM CRM - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-39323 has been rejected

Official rejection reason

Replacement CVE