A malicious file identified by the SHA-256 hash 8287d65844b6b116dbd3ec838c362577aa33257c192eb8c1107bb190b1668d36 was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was detected seven times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the Netherlands. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ad4ec186ede7f4e22525b1f0d7657a96aa5397f5cb9ea2510ba55677437e8b64 was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was seen three times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the Netherlands. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this hash in their environments and security tools.
A malicious file identified by the SHA-256 hash 7905c4ad4267729450a64aee8807b347ba1eb09d35d70afa3b0488ecab2de831 was observed by OffSeq Mirage honeypot sensors on 2026-11-14. The file was detected seven times during attacker activity involving the T1105 technique (Ingress Tool Transfer) from infrastructure located in the Netherlands. This hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 08bad1503658a73333a903e2aa8dc28a4f7cddc8eaa6779d2f16ac40128ec8b7 was observed three times on November 14, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool delivered or staged during the attack. The attacker infrastructure was located in the Netherlands. This indicator can be used to detect and block the malicious file in affected environments.
A malicious file identified by the SHA-256 hash 6b06d98a817f5f25009af8fdef6a077a750259519fbac9b02176dcf497be0a8e was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was detected seven times during attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the Netherlands. The file hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A malicious file identified by the SHA-256 hash e1e275cf672d481750730a3b46b1d1683ae030573533d3feed87f4e63196a9ac was observed by OffSeq Mirage honeypot sensors on 2026-11-14. The file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the Netherlands. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to identify potential compromise.
NLTK's CCG lexicon parser function fromstring suffers from a quadratic-time CPU denial of service vulnerability when parsing specially crafted wide bracket bodies or long operator chains. This flaw allows an attacker to cause sustained single-threaded CPU exhaustion by providing a few-megabyte lexicon string, leading to significant availability loss. The vulnerability arises from inefficient string slicing operations in pure-Python loops that scale quadratically with input size. No authentication or user interaction is required, and the vulnerability affects versions prior to 3.10.4. A fix is available in version 3.10.4.
NLTK versions up to 3.10.3 contain a quadratic-time CPU denial of service vulnerability in the Tree.chomsky_normal_form method when using the default right-factor binarization. This occurs because the method repeatedly removes the first element of a list using list.pop(0), which is an O(N) operation, causing the overall process to scale quadratically with the number of children in a node. An attacker supplying a wide flat tree can cause significant CPU consumption, leading to denial of service without requiring authentication or user interaction. The issue is fixed in version 3.10.4.
A malicious file identified by the SHA-256 hash 6fbdd13040b4716599a1dca4797b1fbe9b1d1df002ed4ef67147462dd288a39e was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was detected seven times during attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in the Netherlands. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to identify potential compromise.
A malicious file identified by the SHA-256 hash af3e4ef0c18704fc45dc2276cae6d0010449778066c67c93c1891f62fcd3a54d was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in the Netherlands. The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
NLTK's ConllCorpusReader.srl_instances() method has a quadratic-time CPU denial of service vulnerability when processing semantic-role-labeling (SRL) data from a CoNLL corpus. An attacker can craft a corpus with many predicates and span columns, placing the sole head span in the last column, causing the instance builder to perform excessive nested rescans. This leads to sustained single-threaded CPU exhaustion, resulting in availability loss. The vulnerability affects NLTK versions prior to 3.10.4 and is fixed in version 3.10.4. Exploitation requires the application to process untrusted CoNLL SRL data using the vulnerable API. Confidentiality and integrity are not impacted.
The npm package @zread/cli-win32-arm64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential exposure of all secrets and keys stored on the affected system. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package @zread/cli-win32-x64 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package '@zread/cli-linux-x64' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @zread/cli-linux-arm64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised device due to the risk of persistent malicious software.
The npm package @zread/cli-darwin-x64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential exposure of all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a separate, uncompromised machine is strongly advised.
The npm package @zread/cli-darwin-arm64 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The zread_cli npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
NLTK's BllipParser component in versions 3.10.0 through before 3.10.4 allows an attacker to supply arbitrary filesystem paths to its native C extension without validation. This bypasses NLTK's usual path security checks, enabling reading of arbitrary files outside the intended data directories. The flaw can lead to disclosure of sensitive local files or denial of service by causing the parser to read oversized or special files. A fix is available in version 3.10.4.
A vulnerability in ag-psd versions prior to 31.0.0 allows a crafted PSD file with maliciously declared large dimensions to cause excessive memory allocation. This leads to an out-of-memory condition that can crash the process or exhaust system memory, resulting in a denial-of-service (DoS) condition. The flaw arises because the library allocates memory based on header-declared geometry before validating these values against actual data size. A fix is available in version 31.0.0.