A URL associated with attacker activity linked to CVE-2021-42013 was observed multiple times in the wild on 2026-10-31. This URL was used in attacker payloads involving tool downloads or callbacks, indicating its role in ingress tool transfer (technique T1105). The attacker infrastructure was identified in India. Security teams are advised to block and monitor this URL and review proxy, web, and WAF logs for any access attempts.
The npm package @mamans2973/maman versions 1.0.0 through 1.0.3 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, necessitating immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by it.
A heap-based buffer overflow vulnerability exists in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2. This flaw allows an unauthenticated remote attacker to crash the index.cgi process by sending a specially crafted multipart/form-data POST request with an excessively long Content-Disposition name field.
CVE-2026-78192 is a vulnerability in WebDyne versions from 2.022 up to but not including 3.022 that allows unauthenticated remote attackers to read application source code via the default index page's source viewer. This exposure includes Perl source files and embedded credentials within __PERL__ blocks of .psp pages. The issue arises because WebDyne's wrapper scripts enable the built-in index page by default, which returns files specified by the source parameter in HTMX requests.
WebDyne versions from 2.031 up to but not including 3.022 contain a vulnerability where files with .psp anywhere in their name are executed as Perl pages due to a regular expression lacking an end anchor. This allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl scripts by requesting the file, bypassing simple extension checks.
WebDyne versions from 2.014 up to but not including 3.022 contain a cross-site scripting (XSS) vulnerability. This occurs because certain form tags (textfield, password_field, filefield) reflect request parameters into their value attributes without proper escaping. The default escaping control (WEBDYNE_CGI_AUTOESCAPE) is off, and from version 2.022 the entity encoding method was replaced with a no-op, rendering escaping ineffective. An attacker can inject malicious scripts via crafted links using these tags.
CVE-2026-78189 is a path traversal vulnerability in WebDyne Perl versions from 3.007 up to but not including 3.022. It allows remote attackers to execute .psp files outside the document root by exploiting the PSGI API route fallback mechanism. The vulnerability arises because the PSGI handler does not properly sanitize path segments containing '..', enabling access to files outside the intended directory.
WebDyne versions from 2.014 up to but not including 3.022 for Perl set session cookies without the Secure, HttpOnly, and SameSite attributes. This allows browsers to send session IDs over plain HTTP and with cross-site requests, exposing them to theft by network attackers or malicious scripts. The vulnerability is fixed in version 3.022.
The doctreelstm package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The multi-convert package on PyPI contains malicious code in specific versions of its dependency 'is-it-ai'. Version 0.1.4 of the dependency includes a trigger that fingerprints the environment and contacts a remote server to download and execute a remote executable. Other versions serve as cover to hide the malicious activity. This campaign is identified as having clear malicious intent, including downloading and executing remote code.
The md-to-slides package on PyPI contains malicious code hidden in a specific dependency (is-it-ai) in version 0.1.1. This malicious code fingerprints the environment and contacts a remote server to download and execute a remote executable if instructed. Other versions appear to be decoys to conceal the malicious version. This campaign is clearly malicious and targets users by embedding harmful actions within a library dependency.
The skills-analyzer package on PyPI contains malicious code in its dependency is-it-ai version 0.1.1. This malicious code fingerprints the environment and contacts a remote server, which may respond with a URL to download and execute further malicious payloads. Other versions of the package exist to obscure the presence of the malicious version. The campaign is identified as a targeted attack with clear malicious intent, including downloading and executing remote executables.
The is-it-ai package on PyPI contains malicious code in specific versions (0.1.0, 0.1.1, 0.1.3) that, when triggered, fingerprints the environment and contacts a remote server. If the server responds with a URL, the package downloads and executes a remote executable. This behavior is part of a targeted attack campaign involving intentional inclusion of malicious code in a dependency, designed to hide malicious actions behind legitimate package versions.
The Web 2.0 Directory plugin for WordPress up to version 2.10.12 is vulnerable to a time-based SQL Injection via the 'w2dc_level_filter' parameter. This vulnerability arises from insufficient escaping and improper handling of user input in an integer context, allowing unauthenticated attackers to inject SQL queries that can extract sensitive database information. The vulnerability exploits the lack of protection against time-based payloads such as SLEEP-based conditionals.
The BuddyBoss Platform plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.6.0. This flaw arises from insufficient input sanitization and output escaping of the Group Name field. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the "Enable social group creation by all members" setting to be enabled, which is the default configuration. If group creation is restricted to administrators, exploitation is not possible.