FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.
CVE-2026-87114 is a high-severity vulnerability in the kube-compare tool used by Red Hat OpenShift Container Platform 4.20. The flaw causes the tool to execute the entrypoint of an untrusted container image when processing a 'container://' reference path, rather than only extracting data from a stopped container. This behavior can lead to arbitrary code execution on the operator's workstation. If the Docker daemon is running with elevated privileges, an attacker could gain root-level access via the daemon. Red Hat has issued a security advisory and released updates in OpenShift Container Platform 4.20.41 to address this issue.
The npm package img-to-native contains malicious code that decrypts and writes a Windows executable to the local filesystem with execute permissions. This executable is hidden as an encrypted payload appended to an image file in a dependency, and the package installs attacker-controlled code without verification. Installing or loading this package can lead to full system compromise. The package versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3 are affected.
The npm package 'native-runner' contains malicious code that, upon import, silently waits for and executes a hidden binary named node_runtime_helper.exe from a Windows system-like directory. This behavior occurs as a side effect of requiring the package, without any explicit API call. The package depends on 'img-to-native', which places the malicious binary on the system. This drop-and-execute chain can lead to full system compromise, and removal of the package does not guarantee eradication of the malware.
The npm package nebula-sdk versions 1.0.0 and 1.0.1 contains malicious code embedded in its preinstall lifecycle script. This script decodes and decompresses a hidden Windows executable, which is then written to the local app data directory masquerading as a legitimate system binary and executed without user interaction. The payload is linked to a remote access trojan (RAT) tool, enabling attacker-controlled native code execution on the affected Windows machine. Installation of this package results in a full compromise of the host system.
The nebulajs-api npm package version 1.0.0 contains a malicious preinstall script that executes obfuscated code at install time. This code uses a custom PRNG-based decoder to reconstruct and run a hidden payload, resulting in remote code execution on the installer's machine before any legitimate package code runs. The main module is a minimal AI-client wrapper unrelated to the malicious payload, serving as a cover. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.
The npm package vite-plugin-crypto versions 1.0.2, 1.0.5, and 1.0.6 contains malicious code that enables arbitrary JavaScript execution on the host running Vite build or dev processes. This occurs because the plugin concatenates user-controllable option fields and passes them to SystemJS's dynamic module loader, allowing an attacker to execute arbitrary code during plugin construction. The package disguises this behavior as a benign cryptographic operation, but it effectively compromises any system where it is installed.
The npm package my-skibidi (versions 1.0.0 through 1.1.6) contains malicious code that unconditionally sends users' browser cookies to a hardcoded external server. This exfiltration occurs immediately upon loading the module without user consent or configuration options. The package's declared functionality does not require cookie access or transmission. Any application bundling this package risks leaking session data to an unauthorized third party. Removal of the package is recommended, but full system compromise is possible, necessitating secret and key rotation from a clean environment.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple glibc packages. The advisory addresses vulnerabilities identified by CWE-367 and CWE-120. The update includes numerous language pack RPMs and core glibc components for aarch64 and x86_64 architectures. No specific exploitation details or active exploits in the wild have been reported. The advisory provides updated RPM versions to mitigate the vulnerabilities.
A denial of service vulnerability exists in Ricoh SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF devices up to version 20260813. The flaw is in the HTTP Multipart Form-Data Parser component and can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and a public exploit is available.
CVE-2026-101037 is a critical stack-based buffer overflow vulnerability in the parse_advertisement_frame function of the devdiscover Service component in FAST FAC1200R version 5.0_20201119_1.0.2. This vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The exploit code has been publicly disclosed, but no vendor response or patch is currently available.
The npm package 'kalasnik-npm-simple-test' version 1.0.0 contains malicious code that executes during installation. Its postinstall script reads a local file and sends its contents over unencrypted HTTP to a remote server, indicating data exfiltration. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.
The npm package 'tanksync' version 1.0.7 contains malicious code that downloads and executes arbitrary JavaScript from a hardcoded remote URL. The package uses a flawed integrity check with a symmetric key embedded in the source, allowing attackers to produce valid signatures for any payload. Execution occurs in a detached Node.js process that continues running after the client closes, potentially compromising the host system. Removal of the package may not fully restore system integrity due to persistent malicious activity.
The aseity package on PyPI version 0.1.0 contains malicious code that executes automatically during installation and import. It uses obfuscated and encoded payloads to deploy a multi-stage malware dropper that downloads additional components from a suspicious domain. The malware performs VM and debugger checks, extracts and runs a hidden Python executable, and includes an infostealer that exfiltrates data to a command-and-control server referenced via blockchain transactions. The package employs steganography and native extensions to evade detection and persist on the infected host.
The coinscan package on PyPI (version 0.1.0) contains malicious code that executes encrypted payloads during installation. It fetches an encrypted payload from a suspicious external domain and decrypts it with a hardcoded key, executing the code via exec(). If the network fetch fails, it falls back to a local encrypted payload, ensuring execution even offline. The payload includes sandbox evasion techniques to avoid detection in CI/build environments and targets developer workstations. Additionally, the package uses obfuscation and steganography to hide an infostealer that exfiltrates sensitive data to a command-and-control server referenced via the Polygon blockchain.
The claudedashbord package on PyPI contains malicious code that executes automatically on every Python interpreter startup via a .pth file. It fetches and executes remote code from a hardcoded non-publisher endpoint, enabling arbitrary code execution on the victim's machine. The malware includes anti-analysis features to evade sandbox detection and delays execution to avoid dynamic analysis. Additionally, obfuscated code and a native extension module act as an infostealer, exfiltrating sensitive data to a command-and-control server whose address is derived from blockchain transaction history. The package versions 0.1.0 through 0.1.3 are affected.
The PyPI package 'donutpromotion' version 0.1.0 contains malicious code that executes arbitrary payloads during installation. It fetches a remote JSON manifest or falls back to an embedded encrypted payload, decrypts it, and executes it, enabling arbitrary code execution. The malicious behavior is triggered only on developer workstations by checking for user directories and environment variables to evade sandbox detection. The package also includes an obfuscated native extension infostealer that exfiltrates sensitive data to a command-and-control server via blockchain transactions. The README falsely advertises offline Minecraft helper functionality, inconsistent with the malicious network activity.
The metrio package on PyPI, specifically versions 999.0.0, 1000.0.0, and 1001.0.0, contains malicious code that exfiltrates the local machine's hostname during installation and import. This exfiltration occurs by encoding the hostname and sending DNS and HTTP requests to an attacker-controlled domain. The package is designed as a dependency confusion proof-of-concept, aiming to be resolved instead of an internal package with the same name, thereby leaking information about the resolving host.
The sherpy package on PyPI is a malicious tool disguised as an OSINT command-line utility. It contains a large precompiled native module that performs stealthy exfiltration of sensitive user data, including wallet keystores and Telegram files, to an attacker-controlled Telegram bot. The malicious behavior is hidden inside a compiled binary with no source code, preventing easy detection through source review. The package versions 0.1.0 and 0.1.1 are affected.