The runpier package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external sources. This campaign is identified as malicious with intent similar to infostealers.
The sedgehaul package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to facilitate malicious code execution. The campaign is identified as having clear malicious intent, including potential infostealing activities.
The taskquay package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their coordinated use facilitates executing harmful code from external sources. This campaign is identified as having clear malicious intent, such as infostealing.
The marshrunner package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they facilitate downloading and executing remote malicious scripts. This campaign is identified as having clear malicious intent, including potential infostealing activities.
The 'workslip' package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they serve as a mechanism to download and run malicious scripts. This coordinated campaign aims to provide multiple deceptive methods to load malicious code remotely.
The brookworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to execute code from external URLs. The campaign is identified as having clear malicious intent, such as infostealing.
The cobbleload package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external URLs. This campaign is identified as malicious with intent similar to infostealers.
The brambletask package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they facilitate downloading and executing remote malicious scripts. This campaign is identified as having clear malicious intent, such as infostealing.
The ferretqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but serve as a mechanism to download and run malicious scripts. The campaign is coordinated and aims to provide multiple deceptive methods to load malicious code remotely.
The otterload package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the packages do not contain the payload themselves, their intent is clearly malicious, facilitating the execution of potentially harmful code from external sources.
The badgertask package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is clearly malicious, facilitating the execution of potentially harmful code from external sources.
The larchworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain the payload, it facilitates downloading and executing remote malicious scripts, indicating coordinated malicious intent.
The thornqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as a mechanism to load malicious code from external URLs. This coordinated campaign aims to provide multiple deceptive methods to execute malicious code remotely.
The thistlerun package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is to facilitate execution of harmful code from external sources.
The juniperrun package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the packages themselves do not contain the payload, their purpose is to facilitate the execution of malicious code from external sources. This campaign is identified as malicious with intent similar to infostealers.
The flintqueue package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders for malicious code.
A new remote code execution (RCE) vulnerability (CVE-2026-115560) in PHP affects systems with a rare combination of configuration settings involving session serialization handlers and upload progress. No patch is currently available. The PHP security team recommends disabling session upload progress as a mitigation. This vulnerability is distinct from recently patched critical PHP2Shell RCE flaws. Exploitation requires unusual runtime changes to session serialization handlers, making it unlikely in typical deployments.
A vulnerability in the Linux kernel's readdir implementation related to inode locking on immutable directories has been resolved. The issue involved iterate_dir() holding a shared lock on the directory's i_rwsem semaphore even when the directory was immutable and never changed, causing unnecessary blocking. This could lead to stalls in mount namespaces sharing the same nullfs directory inode, impacting multiple users. The fix adds a FOP_IMMUTABLE flag to skip locking for directories that never change or are never removed, preventing the described contention.
A vulnerability in the Linux kernel's dm-integrity module was resolved involving improper validation of the superblock on resume. The dm_integrity_resume() function re-reads the superblock without validating it, allowing discrepancies if the superblock is modified while the device is suspended. This can lead to out-of-bounds memory writes during journal access. The fix involves snapshotting the validated superblock during construction and refusing to resume if critical fields have changed.
A vulnerability in the Linux kernel's CAN network subsystem was resolved by restoring skb header initialization in the init_can_skb() function. The issue was introduced when certain skb header reset calls were removed, causing RX skbs to carry an invalid mac_header value. This leads to an overflow in push length calculation in packet_rcv_spkt(), triggering a kernel panic and full machine crash. The problem was originally reported in 2014 and fixed then, but the recent commit reintroduced it. The vulnerability affects kernel stability and can cause denial of service via system crash.