This analysis discusses a growing trend where malware authors embed natural-language instructions in their code to evade AI-assisted malware analysis. Cisco Talos research identifies this technique as "A3: AI-Analysis Evasion," involving methods from simple comments to advanced template spraying targeting large language models. Although these prompt-injection techniques only influence AI verdicts about 35% of the time, they are increasingly adopted across malware sophistication levels. The research highlights that these evasion instructions must be in plaintext, providing defenders a stable detection surface. The advisory recommends flagging imperative language aimed at analysis systems within binaries as suspicious and treating extracted text as evidence rather than directives. The discussion also includes a real-world example of isolating legacy, vulnerable systems to reduce risk without patching. No specific software versions or exploits are detailed, and no patch status is provided.
A resource exhaustion vulnerability exists in Coraza v3 multipart body processor due to deferred file handle closures inside a loop. This causes file descriptors to accumulate until the request processing completes, potentially exhausting the file descriptor limit and causing denial of service. The issue affects all v3.x releases before 3.8.0. The vulnerability can trigger false positives in the Core Rule Set (CRS) and block legitimate multipart requests. A patch is available to fix the improper defer usage.
Coraza v3 has a vulnerability where it fails to inspect URL-encoded form bodies if the Content-Type header includes media-type parameters such as charset=UTF-8. This causes Coraza to skip parsing the request body, allowing attackers to bypass custom rules inspecting POST arguments. The issue affects versions from 3.0.4 up to but not including 3.8.1. The vulnerability is rated medium severity with a CVSS score of 5.8. A patch is available to address this issue.
Coraza v3 contains a vulnerability in its JSON response body processor where there is no recursion limit enforced when parsing JSON responses. This leads to unbounded recursion and CPU exhaustion when processing deeply nested JSON responses. The request path enforces a recursion limit, but the response path does not, causing quadratic CPU usage growth with nesting depth. This can result in significant CPU consumption and denial of service when ResponseBodyAccess is enabled and JSON responses contain deeply nested structures.
Coraza v3 prior to 3.8.1 improperly handles multipart file upload filenames when the RFC 5987 extended filename* parameter uses a charset other than us-ascii or utf-8, such as iso-8859-1. This causes Coraza to ignore the filename* value and instead use the plain filename parameter or no filename, allowing attackers to bypass file extension or name-based detection rules. The vulnerability affects the FILES and FILES_SIZES variables and the file-vs-field routing, potentially letting malicious uploads evade inspection. The issue is fixed in version 3.8.1 by independently decoding filename* without charset restrictions and exposing both filename and filename* values.
Coraza's cookie parser in versions prior to 3.8.1 does not fully strip ASCII control characters (CTLs) from cookie names and values, causing a mismatch between the WAF and backend application cookie parsing. This discrepancy can allow attackers to bypass WAF rules scoped to specific cookies by padding the Cookie header with CTLs adjacent to the '=' separator. The issue arises because Coraza trims only space and tab characters, whereas RFC 6265 requires trimming the full CTL range. A fix is available that aligns Coraza's parsing with RFC 6265 by trimming the full CTL range from cookie names and values.
CVE-2026-107376 is a high-severity vulnerability in webonyx graphql-php prior to version 15.32.3. It involves uncontrolled recursion in the parser component, allowing a remote attacker to submit deeply nested GraphQL queries that exhaust the PHP process stack. This can cause segmentation faults (SIGSEGV) that terminate PHP-FPM workers or long-running PHP processes such as Swoole, RoadRunner, ReactPHP, or CLI. The issue occurs before query validation and complexity controls, and cannot be caught by application-level exception handling. The vulnerability is fixed in version 15.32.3.
The npm package @kxafunc/xbails version 0.0.8 aliases its libsignal dependency to a non-standard package @bellaxchuu/libsignal-node using the mutable 'latest' dist-tag without version pinning or integrity checks. This allows whoever controls the upstream package @bellaxchuu/libsignal-node to push arbitrary code that executes within the Signal end-to-end encryption cryptographic path, potentially compromising identity keys, prekeys, and plaintext messages.
Coraza v3 before 3.8.0 has a vulnerability in its URI processing logic where malformed URIs containing raw control bytes cause the system to silently drop QUERY_STRING and ARGS_GET variables. This occurs because the URI parsing fails and the fallback logic to extract GET arguments is commented out, resulting in empty GET argument collections. The issue does not affect standard net/http integrations, which reject malformed URIs early, but affects integrations that call ProcessURI directly with unvalidated raw URIs, such as coraza-spoa and coraza-proxy-wasm. This can lead to bypass of OWASP CRS GET-side signature rules that rely on these variables. A fix is available.
A stack overflow vulnerability exists in the Coraza JSON body processor (github.com/corazawaf/coraza/v3) that can cause the entire host process to crash. This occurs due to an unbounded recursion in the gjson.Valid function when processing deeply nested JSON bodies that bypass argument and byte limits. An unauthenticated attacker can trigger this with a crafted JSON request body well within default and recommended size limits, causing a fatal stack overflow that terminates the process unconditionally.
Coraza v3's JSON body processor flattens nested JSON properties into dot-separated keys without escaping dots in property names, causing key collisions. This allows an unauthenticated attacker to bypass OWASP Core Rule Set (CRS) inspection by overwriting malicious nested JSON values with harmless dotted keys. The vulnerability affects Coraza versions from 3.0.0 up to but not including 3.8.1. The issue was confirmed against CRS v4.25 and can bypass SQL injection detection rules. A patch is available for this vulnerability.
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, and thus the owner can neither see nor delete it. The third project can accept this membership (that it had not actually been granted by the owner), and then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access.
JHipster generator-jhipster versions from 7.0.0 up to but not including 9.4.0 contain an SQL injection vulnerability in reactive applications using Spring WebFlux, Spring Data R2DBC, and SQL databases. The vulnerability arises because attacker-controlled sort parameters are passed into SQL ORDER BY clauses without validation or quoting, allowing execution of additional SQL statements. This can enable an authenticated user to read sensitive data, modify or delete data, or drop tables. The issue is fixed in version 9.4.0.
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.
To mitigate this issue, users should upgrade to version 4.10.0 or later.
CVE-2026-107334 is an incorrect authorization vulnerability in the role-based access control (RBAC) implementation of CISA Malcolm's nginx Lua layer. The vulnerability arises because the RBAC check uses the raw, percent-encoded request URI, while nginx routes requests based on the percent-decoded URI. This discrepancy allows an authenticated low-privilege user to access admin-only paths by using percent-encoded variants of restricted URLs, bypassing the RBAC restrictions.
CVE-2026-107335 is a vulnerability in CISA Malcolm affecting versions from 0 up to and including 26.07.1. The issue involves improper handling of highly compressed single-stream files (e.g., .gz, .bz2) that are not tar-style archives. Authenticated users with upload permissions can upload small, highly compressible files that decompress to very large sizes, causing resource exhaustion on the shared Docker volume and disrupting the platform. The vulnerability has a CVSS score of 6.5 and is classified as medium severity.
CVE-2026-107337 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in the Malcolm kiosk Flask application by CISA. The application exposes a POST endpoint /script_call/<script> without any authentication and uses wildcard CORS, allowing attackers to trick an operator's browser into executing arbitrary management commands. Exploitation can lead to destructive actions such as permanently deleting all captured network traffic and forensic logs or stopping security monitoring. This vulnerability affects Malcolm versions from 0 up to and including 26.07.1.
CVE-2026-107361 is an authentication bypass vulnerability in the Arkime live capture service (arkime-live) component of CISA Malcolm. The service runs in host network mode exposing port 8005 on all interfaces and trusts the X-Forwarded-User header from any IP address, automatically creating users with full access. The passwordSecret is hardcoded to a public value "Malcolm", allowing a network-adjacent attacker to bypass nginx and authenticate by connecting directly to port 8005 with a forged identity header. This vulnerability affects Malcolm versions up to and including 26.07.1.
CVE-2026-107362 is a server-side request forgery (SSRF) vulnerability in the Malcolm network traffic analysis tool. It arises from the inclusion of an upstream FilePond PHP server component that exposes a fetch API route allowing arbitrary URL downloads. This can lead to unauthorized reading of fetched content. The vulnerability affects Malcolm versions from 0 up to and including 26.07.1. The CVSS 3.1 score is 7.1, indicating high severity.