A vulnerability in the Linux kernel related to namespace handling and unmounting submounts has been resolved. The issue involves the unmounting process where busy mounts may be incorrectly unmounted due to improper reference checks, potentially leading to mounts being marked as synchronously unmounted while still in use. This affects mounts with the MNT_SHRINKABLE flag, such as automounted submounts of NFS, AFS, CIFS, and certain debugfs mounts. The fix ensures that each mount is checked for references right before unmounting under appropriate locks to maintain correctness.
A vulnerability in the Linux kernel's mount namespace handling allows recursive bind mounts of mount namespace files, which can cause cycles and unlimited resource leaks. The issue arises because the kernel does not fully check for mount namespace loops when performing recursive bind mounts with MS_REC, allowing a process to create a bind-mount stack of mount namespace file descriptors that leaks kernel memory.
An integer overflow or wraparound vulnerability has been identified in GitLab version 3.0. This type of vulnerability can lead to unexpected behavior in software when integer calculations exceed their maximum value and wrap around, potentially causing security issues.
An integer overflow or wraparound vulnerability has been identified in GitLab version 3.0. This type of vulnerability involves improper handling of integer values, which can lead to unexpected behavior in software. No CVSS score or detailed technical impact information is provided. There is no indication of known exploits in the wild or available patches at this time.
A vulnerability identified as CVE-2026-112085 affects webpack-dev-server version 3.0, allowing cross-origin WebSocket access via proxied upgrades. This issue relates to improper handling of WebSocket upgrade requests that could enable unauthorized cross-origin access. No CVSS score is provided, and there is no indication of known exploits in the wild. No patch or remediation details are currently available.
A vulnerability identified as CVE-2026-111181 affects the body-parser component version 3.0, allowing a Denial of Service (DoS) attack via trailing bytes after a compressed request body. The issue relates to improper handling of compressed request bodies that contain extra trailing bytes, which can be exploited to disrupt service availability.
HAProxy versions before 3.4.6, including version 3.0, contain a vulnerability that allows a remote unauthenticated attacker to cause a denial of service by triggering a persistent worker-thread issue. The vulnerability is identified as CWE-835. No CVSS score or detailed technical exploitation information is provided. No known exploits are reported in the wild. There is no explicit vendor advisory or patch link available in the provided data.
The npm package 'tailwind-base-buttons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the computer may have been given to an attacker.
The noelc-css-blender npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by this package.
The npm package tailwindcss-theme-kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
CVE-2026-115981 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. It involves manipulation of the REQUEST_URI argument in the upgrade/index.php file, allowing remote attackers to execute script code. The vulnerability has a medium severity rating with a CVSS score of 4.8. Public exploit code has been disclosed, but no known active exploitation in the wild is reported. The vendor was notified early about this issue.
This report discusses difficulties in getting phishing sites hosted on Vercel's platform taken down despite abuse reports. The phishing site impersonates a legitimate brand to harvest credit card data via fake checkout and 3DS OTP prompts. The reporter seeks community advice on effective takedown strategies, including reporting methods and escalation tactics. No direct technical details or exploit code are provided.
A malicious file identified by the SHA-256 hash d3e15a3cb34e3615b12e148369ac3bcebd5566760ebbf569ec59d02505420a74 was observed three times on October 24, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland. This indicator should be matched against files in security environments and threat intelligence feeds for detection purposes.
This content discusses the cybersecurity strategy of reducing the attack surface by minimizing unnecessary technology complexity within enterprise environments. It highlights recent high-severity PHP vulnerabilities that prompted urgent advisories and temporary website shutdowns, illustrating challenges in identifying and patching embedded vulnerable components. The article emphasizes that many enterprises accumulate redundant applications and dependencies over time, increasing security obligations without proportional business value. Reducing unnecessary software and infrastructure can lower risk and improve security sustainability.
This content describes a free, read-only bash script designed to triage WordPress sites for signs of compromise related to the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a third CVE-2026-115560. The script checks PHP versions, WordPress core and plugin integrity, suspicious PHP files in uploads, recent file modifications, common web-shell patterns, user accounts, cron jobs, logs, Docker containers, and configuration settings relevant to the vulnerabilities. It generates detailed Markdown reports without modifying the target systems. The PHP2Shell vulnerabilities are critical remote code execution bugs patched in PHP releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but the third CVE has no fixed build yet, with a recommended mitigation of setting session.upload_progress.enabled=0. The script helps detect potential backdoors planted before patching, as updating PHP alone does not remove them.
A malicious file identified by the SHA-256 hash 1c0688bb8702fd6c977efffa5e9d1a5c2da77431d41bd6c31f86cbc3ce368700 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file was detected four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Poland. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No known exploits or threat actors have been associated with this indicator yet. There is no information about affected software versions or patches.