The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
The Prime Mover – Backup and Migration WordPress plugin (versions up to 2.2.1) is vulnerable to PHP Object Injection via unsafe deserialization of untrusted input stored in comment content. An unauthenticated attacker can submit a crafted base64-encoded serialized object through the comment submission endpoint, which is later unserialized without restrictions during plugin export or restore operations. This leads to a critical remote code execution risk without requiring additional plugins or themes.
The User Profile Builder plugin for WordPress up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with Author-level access or higher can assign themselves or others privileged roles such as Editor via the Gutenberg Register block due to improper server-side authorization. The vulnerability arises because the plugin does not adequately restrict role assignment for roles lacking certain high-level capabilities, allowing unauthorized role elevation.
A malicious file identified by the SHA-256 hash b5149190ab5cdfcee95c4aa201bdd0229f426d3bbf6d2cd45d0e983f120b94b7 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was seen 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash d5d4249912afc83472420ec77c8a97081800436df1e31d14bb814649e084e061 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The threat is an indicator of compromise (IOC) rather than a vulnerability or exploit itself. No known exploits or threat actors are associated with this hash, and no affected software versions or countries are specified.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc. This file was observed 10 times on October 24, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The threat is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash 31087290fc269af7921f9591418ac5d0baff3304bc3a18bc7b614546766586e9 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information on affected software versions or known exploits in the wild. The file hash serves as an indicator of compromise (IOC) to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 792a633371540ee9695ed6923f566de4a41cdaec6883e5b537d8ef848ee8636e was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or geographic targeting are indicated. No known exploits in the wild or threat actors are associated with this indicator at this time.
A malicious file identified by the SHA-256 hash 0616c20dea0ff2bd59fff5b60b3e907231d8c99296d0a0c719ba553f83dbd056 was observed 10 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is provided.
A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
In October 2026, critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP affecting multiple supported versions. These vulnerabilities allow unauthenticated attackers to execute code remotely due to out-of-memory corruption and stale global state issues. Emergency security updates were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Mitigations exist but are incomplete; updating to the fixed versions is strongly recommended. Additional incidents involving LiteLLM, eMudhra, GitLab, Railway, and Zeabur were also reported in the same timeframe. The PHP project continues to address these issues with further advisories and release candidates.
A vulnerability in the Linux kernel's pivot_root() function involves improper checks of mount points before reading their parent mounts. The issue arises when new_root or the caller's root is a file descriptor to a mount that has been unmounted but still kept alive by the file descriptor, potentially leading to a use-after-free condition. The vulnerability causes a read operation on freed memory, resulting in a kernel bug detected by KASAN. The fix involves verifying that both mounts are in the caller's mount namespace before accessing their parents, preventing the unsafe read. All error paths return EINVAL, so no other side effects occur.
A vulnerability in the Linux kernel's dcache handling has been resolved. The issue involves improper handling of mountpoints on dentries that are being removed, allowing a bind mount of a directory being removed to be moved beneath an existing mount. This causes the mount to remain on the removed directory indefinitely, preventing its detachment. The flaw arises due to a race condition between detach_mounts() and d_delete(), where the victim dentry is still hashed and not properly locked during mount operations.
A vulnerability in the Linux kernel namespace handling was resolved involving the order of unhashing a dentry before detaching mounts on it. The issue allowed a race condition during unlink(), rmdir(), and rename() operations where the dentry remained hashed and visible between detach_mounts() and d_delete(), potentially exposing mount points that should have been hidden. This race window could be exploited by concurrent lookups to observe mounts that were supposed to be detached. The fix changes the order to unhash the dentry before detaching mounts, preventing lookups from seeing stale mount information.
A vulnerability in the Linux kernel's namei component allowed refwalk operations to reveal overmounted entries due to a race condition when a mountpoint was unlinked. This could cause a refwalk to expose underlying filesystem entries that should have been hidden. The issue was addressed by adding checks to detect dentries marked as unlinked during refwalk traversal, preventing exposure of detached mounts.
A vulnerability in the Linux kernel's namespace handling allowed automounts to be added below a mount that is not in the caller's mount namespace. This could lead to a kernel crash (general protection fault) due to a null pointer dereference when accessing certain filesystem layers via fanotify. The issue arises because an internal mount flag (MNT_NS_INTERNAL) was incorrectly treated as a valid mount namespace, causing unsafe operations. The flaw has been resolved by using a safer check that rejects unmounted and internal mounts, preventing the crash and restoring expected behavior.
A vulnerability in the Linux kernel related to namespace handling and locked mounts has been resolved. Locked mounts are designed to protect underlying files and directories from being revealed. The flaw allowed an unlocked ancestor mount to expire a locked mount beneath it, potentially exposing protected directories. The fix ensures that locked mounts are not expired independently but only as part of their parent mount, preventing the exposure of hidden files. Lazy unmounts still remove the entire mount tree including locked mounts. This vulnerability is addressed by changes to the expiry logic and mount locking behavior.
A vulnerability in the Linux kernel related to mount locking for automounts across user namespaces has been resolved. The issue involved improper locking of mounts when mounts are propagated across user namespaces, causing the host's mount to be locked instead of the child's copy. This could prevent the host from changing mount flags correctly. The fix ensures that the lock is applied to the mount in the namespace where the mount actually occurs, preserving correct mount flag management.
A vulnerability in the Linux kernel's XFS filesystem handling was resolved that involved improper management of reflink flags during file extent exchanges. The flaw caused reflink flags to be incorrectly transferred between files during certain extent exchange operations, potentially leading to data corruption due to writes occurring in place instead of copy-on-write. The fix stops exchanging reflink flags during these operations and ensures both inodes retain the flag as appropriate. The vulnerability affects the XFS_IOC_SWAPEXT operation as well, which was corrected by setting reflink flags on both inodes and ensuring copy-on-write forks exist. The reflink flags remain set until explicitly removed by specific operations.
A use-after-free (UaF) vulnerability in the Linux kernel's cgroup cpuset subsystem was resolved by avoiding direct access to a potentially stale pointer in the is_in_v2_mode() function. The fix introduces a new flag to safely indicate cpuset v2 mode, preventing unsafe memory access during cgroup filesystem rebind operations.