Threat database

Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.

CVE-2026-115730 is a low-severity vulnerability in i18next-http-backend versions 4.0.2 up to but not including 4.0.3. It involves an incomplete fix in the interpolateUrl() function that allows attackers controlling the namespace (ns) value to redirect translation requests by supplying a namespace starting with a slash. This can lead to loading attacker-hosted translations, enabling UI content injection and cross-site scripting (XSS).

CVE-2026-115729 is a server-side request forgery (SSRF) vulnerability in the pdfme common library versions from 5.5.10 up to but not including 6.2.6. The flaw allows attackers to bypass the isUrlSafeToFetch denylist in the getB64BasePdf function by using specially crafted basePdf URLs with IPv4-mapped IPv6, [::], NAT64, or localhost alias hostnames. This enables reading of loopback, internal, or cloud metadata responses through generated PDF documents.

@hapi/content versions 6.0.1 through before 6.0.3 contain a regular expression denial of service (ReDoS) vulnerability in the Content.disposition() function. This issue arises from an incomplete fix for a previous vulnerability (CVE-2026-35213). An unauthenticated remote attacker can exploit this by sending multipart uploads with a long Content-Disposition parameter that lacks an equals sign, causing quadratic backtracking that blocks the event loop.

Hewlett Packard Enterprise (HPE) released security updates addressing 72 vulnerabilities in ArubaOS, including eight maximum-severity flaws involving authentication bypass and remote code execution (RCE). These critical vulnerabilities affect multiple versions of AOS-8 and AOS-10 and can be exploited remotely without privileges or user interaction. HPE strongly urges customers to apply patches promptly and recommends restricting access to management interfaces to reduce exploitation risk. No public exploit code or active exploitation has been reported as of the advisory date.

PHP2Shell refers to two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. These flaws have been exploited in attempts to spread a Mirai-derived botnet variant named Potassium. Despite multiple exploitation attempts and the emergence of an ASLR bypass exploit, no confirmed successful compromises have been reported. The vulnerabilities were patched on October 21, 2026, with PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations have taken precautionary measures including taking systems offline during patching. Exploits require uncommon server configurations and detailed knowledge, limiting their effectiveness in typical production environments.

The PyPI package 'onsokets' version 0.1.0 contains malicious code designed for automated file exfiltration, targeting Android devices. This package is part of a campaign identified as 2026-10-proxyrubika, which has clear malicious intent related to information stealing.

Formbook malware has resurfaced using localized business-order themed lures targeting European users and manufacturing organizations. The attack chain involves JavaScript, hidden PowerShell scripts, an AES-encrypted .NET payload, and process hollowing of aspnet_compiler.exe to execute Formbook. Persistence is maintained via SystemUpdate_* shortcuts and related artifacts. Network detection includes Formbook command-and-control check-ins flagged by Suricata. Indicators of compromise (IOCs) include specific domain names and file hashes. No direct patch or remediation is indicated in the source information.

A path traversal vulnerability (CWE-22) exists in flatpak's xdg-desktop-portal prior to version 1.22.1. Malicious sandboxed applications can exploit the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host system, limited to files accessible by the user. The vulnerability arises because filenames passed to the method are not properly validated by the frontend or common backends, allowing path traversal. This issue has been patched in version 1.22.1.

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.

A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper use of dpaa2_switch_free_fd() on receive frame descriptors, which expects a valid socket buffer pointer but was incorrectly called on descriptors without one. The fix moves dma_unmap_page() handling directly into dpaa2_switch_rx(), ensuring proper memory freeing depending on whether an SKB was created.

A vulnerability in the Linux kernel's wifi nl80211 component was resolved by adding a check to ensure the link is beaconing before performing a color change. This prevents the driver from being called with an invalid link state.

A reference leak vulnerability was identified and fixed in the Linux kernel's ThunderX network driver. The flaw involved the cavium_ptp_get() function acquiring a reference to a PTP PCI device, which was not properly released if initialization failed, causing a resource leak.

A vulnerability in the Linux kernel ALSA sequencer OSS interface was resolved. The snd_seq_oss_read() function incorrectly checks buffer sizes when reading queued events, causing improper handling of undersized reads. This could lead to events being copied incorrectly or left queued, potentially causing unexpected behavior in applications reading sequencer events.

A vulnerability in the Linux kernel's media video-i2c driver was resolved by correcting the driver removal process. The fix involves using vb2_video_unregister_device() instead of video_unregister_device() to properly disconnect the vb2 queue before unregistering the video device.

A vulnerability in the Linux kernel's drm/amdgpu component related to the ATOM command table nesting depth has been resolved. The issue involved capping the nesting depth at 32 levels and returning an error (-ELOOP) when this limit was exceeded.

A vulnerability in the Linux kernel's iwlwifi driver related to scheduled scan IE sizing has been resolved. The issue involved building the probe request before validating its length, allowing oversized information elements (IEs) to be copied into a fixed buffer. The fix moves the probe building after the length check and advertises the maximum scheduled scan IE length to userspace to prevent oversizing.

A vulnerability in the Linux kernel's mlx5 network driver related to handling miss tables in hardware steering (HWS) has been resolved. The issue involved improper removal of tables from a miss table list when a table with a miss table created by the 'mlx5hws_table_set_default_miss' API was deleted, potentially leaving garbage nodes in the list.

A vulnerability in the Linux kernel's lan966x network driver was resolved involving improper restoration of RX state after a reload failure. Specifically, certain fields related to RX page geometry and page pool registration were not restored correctly if resource reallocation failed, causing inconsistencies in RX buffer handling. This could lead to the XDP path advertising incorrect frame sizes, potentially causing buffer mismanagement.

A vulnerability in the Linux kernel's Btrfs filesystem was resolved by adding a lock to protect the sb_write_pointer() function. This function reads the super block from the block device page cache, and previously had a race condition related to block size changes. The fix involves taking the mapping invalidate lock around the read operation to serialize it against block size changes.