ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a stack-based buffer overflow vulnerability in the handling of bzip2 compressed images. This flaw allows attackers to supply crafted bzip2 compressed images that can overwrite stack memory during decoding, potentially causing crashes or memory corruption. The vulnerability has a high severity rating with a CVSS score of 8.1.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have an injection vulnerability in the MVG encoder. This flaw allows attackers who can supply drawing options to inject arbitrary MVG drawing commands into generated MVG files. The vulnerability has a low severity with a CVSS score of 3.6 and requires local access with user interaction for exploitation.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a null pointer dereference vulnerability in the DJVU image decoder. This occurs because the software does not check the result of a memory allocation before use. An attacker can supply a specially crafted DJVU image that triggers a process crash under memory allocation failure conditions, resulting in denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak vulnerability in the MSL decoder. This flaw causes allocated memory to not be released when processing crafted MSL images, potentially leading to resource exhaustion and denial of service.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-32 contain a security policy bypass vulnerability due to an incomplete fix of a previous bypass issue. This flaw allows an attacker who can supply input to ImageMagick to circumvent configured security policy restrictions, enabling operations that should have been blocked by the policy. The vulnerability has a low severity rating with a CVSS score of 3.9.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain an uncontrolled recursion vulnerability in the MVG decoder. This flaw can cause a stack overflow when processing specially crafted MVG files, leading to a denial of service by crashing the process. The vulnerability has a low severity rating and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a policy bypass vulnerability in the PS, PDF, and XPS decoders. This flaw allows attackers to circumvent the security policy's list length limit on scene selection by supplying a specific argument, causing ImageMagick to process more scenes than permitted. The vulnerability can potentially lead to resource exhaustion. The CVSS score is 3.3, indicating a low severity impact primarily affecting availability.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 have a vulnerability in delegate invocation parsing that allows execution of programs blocked by policy.xml. An attacker can exploit this by crafting input that triggers a delegate invocation, bypassing administrator-defined execution restrictions.
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.
phpMyFAQ versions before 4.1.10 have a server-side request forgery (SSRF) vulnerability in the PDF export feature. This flaw allows attackers who can control FAQ content to embed external image URLs that cause the server to make unintended requests, including to internal or loopback services. The server then includes the responses from these requests in generated PDFs.
Parse Server versions before 8.6.101 and versions from 9.0.0 up to but excluding 9.10.4-alpha.4 contain a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to send REST API delete requests to the internal _SCHEMA collection, enabling deletion of stored schema elements such as field definitions, class-level permissions, and protected fields. This unauthorized deletion can expose data to unauthorized reads and modifications.
CVE-2026-116164 is a vulnerability in parse-community's parse-server that affects versions before 8.6.100 and 9.0.0 before 9.10.4-alpha.3. It allows clients to write or clear reserved internal fields in objects due to improper input validation. This can cause read failures on MongoDB queries for all users or enable attackers to bypass account lockout and password policies by clearing their own lockout state and password history.
Parse Server versions before 8.6.104 and versions from 9.0.0 up to but not including 9.10.5-alpha.5 have an improper privilege management vulnerability. When issuing an SMS multi-factor authentication verification code, the server saves the entire login request with master privileges. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 have an information disclosure vulnerability in the LiveQuery feature. The vulnerability arises because the subscription hash does not include constraints adjacent to a $or operator, such as the _Session owner filter and beforeSubscribe constraints. This causes distinct subscriptions to be grouped together, allowing authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
A malicious file identified by the SHA-256 hash a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125 was observed by OffSeq Mirage honeypot sensors on 2026-10-25. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The activity was seen originating from attacker infrastructure in KP. No known exploits in the wild or specific affected software versions are reported.
@drone-js-ext/core is a dependency-confusion package: it squats the `@drone-js-ext` scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 (up to 99.0.1) so that builds resolving the internal name from the public registry install it instead. Its `postinstall` script runs `node beacon.cjs`, which sends an HTTP POST over cleartext HTTP to the hardcoded IP endpoint `http://185.158.107.175:8787/_ah/dc` with the package name, the machine's hostname, the install directory, the current working directory and the Node.js version, tagged with an `x-beacon-package` header. The entry point `index.js` sends the same request again whenever the package is loaded and otherwise exports a Proxy whose every property is a no-op function, so it has no legitimate functionality and hides the missing API from bundlers. The README calls it an "authorized dependency-confusion test"; that does not change what it does to an installer. The same beacon code and endpoint appear in other dependency-confusion packages from the same publisher. The inert `0.0.0-stage` and `0.1.0` placeholder versions carry no install script and are not affected. Any machine that installed an affected version has disclosed its hostname and filesystem layout to a third party; remove the package, pin or scope internal package names to the internal registry, and block 185.158.107.175 on build hosts.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43)
The package ships a `beacon.cjs` that collects host identifiers (hostname, install path, current working directory, Node version) and POSTs them in cleartext to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. This beacon is wired to run automatically in two places: `package.json` declares `scripts.postinstall = "node beacon.cjs"`, so it executes on `npm install`, and `index.js` also invokes the same `fire()` function at module load, so it executes again on `require()`. The remainder of the package is a no-op Proxy shim with no functional code matching the stated `Compatibility shim` description. The scope-and-version shape (`@drone-js-ext/core` at version 99.0.1 against a plausibly internal `@drone-js-ext/*` namespace) matches a dependency-confusion lure designed to be resolved in place of a private internal package. A README self-label of `dependency-confusion test` does not change the behavior: any installer that resolves this package has host-identifying data sent to a non-vendor, non-registry, bare-IP, plaintext-HTTP collector controlled by a third party.
## Source: ghsa-malware (338c919fc73c66cb9bd18fa251359467039387724d1f8f41e6d3bb88f52ddc6f)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
@drone-js-ext/vip-badge is a dependency-confusion package: it squats the `@drone-js-ext` scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 (up to 99.0.1) so that builds resolving the internal name from the public registry install it instead. Its `postinstall` script runs `node beacon.cjs`, which sends an HTTP POST over cleartext HTTP to the hardcoded IP endpoint `http://185.158.107.175:8787/_ah/dc` with the package name, the machine's hostname, the install directory, the current working directory and the Node.js version, tagged with an `x-beacon-package` header. The entry point `index.js` sends the same request again whenever the package is loaded and otherwise exports a Proxy whose every property is a no-op function, so it has no legitimate functionality and hides the missing API from bundlers. The README calls it an "authorized dependency-confusion test"; that does not change what it does to an installer. The same beacon code and endpoint appear in other dependency-confusion packages from the same publisher. The inert `0.0.0-stage` and `0.1.0` placeholder versions carry no install script and are not affected. Any machine that installed an affected version has disclosed its hostname and filesystem layout to a third party; remove the package, pin or scope internal package names to the internal registry, and block 185.158.107.175 on build hosts.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (914f57c3481f23f4682ff7bdd7b9849865531023c6d547ed76d42e9da6bbd8dc)
@drone-js-ext/vip-badge is a functionless stub whose only behavior is a phone-home beacon. The package.json postinstall script runs `node beacon.cjs`, and `index.js` fires the same beacon on `require()` while exporting a Proxy that returns no-ops for every property access. beacon.cjs collects the installer's hostname (`os.hostname()`), install path (`__dirname`), current working directory (`process.cwd()`), Node.js version, and package coordinate, then POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. The destination is not the npm registry, not a publisher-owned domain, and is reached automatically at install time and on module load without any caller invocation. The scope name mimics a plausible internal/vendor namespace, and the shipped contents match the dependency-confusion beacon pattern — a stub published to prove install on target networks and disclose host identity to an uncontrolled third party.
## Source: ghsa-malware (db67ee02c834274d865c0db6b49793d2c7785a0cab810bbb7a4256757712c75b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A malicious file identified by the SHA-256 hash 1c0688bb8702fd6c977efffa5e9d1a5c2da77431d41bd6c31f86cbc3ce368700 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file was detected four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Poland. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No known exploits or threat actors have been associated with this indicator yet. There is no information about affected software versions or patches.
A malicious file identified by the SHA-256 hash d53eda7a637c99cc7fb566d96e9fa109bf15c478410a3f5eb4d4c4e26cd081f6 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Poland. There is no information about active exploitation or affected software versions. This indicator should be matched against files in environments and security tools for detection purposes.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)
* kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)
* kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)
* kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)
* kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)
* kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
* kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138)
* kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
* kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
* kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
* kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
* kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
* kernel: ipv4: validate checksum_start before completing checksum
(CVE-2026-99999)
Bug Fix(es) and Enhancement(s):
* Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [rhel-8.10.z] (JIRA:RHEL-280584)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.