Search: rx.the

The npm package @bellaxchuu/xtrxbails (version 0.0.8) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, preventing easy detection. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - ARM32 architecture; - MIPS architecture; - PowerPC architecture; - x86 architecture; - Intel NPU Driver; - Compute Acceleration Framework; - Auxiliary display drivers; - Drivers core; - Compressed RAM block device driver; - Bluetooth drivers; - Arm Firmware Framework for ARMv8-A(FFA); - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Mouse) drivers; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Texas Instruments network drivers; - NVMEM (Non Volatile Memory) drivers; - Parport drivers; - SCSI subsystem; - SLIMbus drivers; - NVIDIA Tegra SoC drivers; - SPI subsystem; - TCM subsystem; - Trusted Execution Environment drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - USB Device Class drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - Framebuffer layer; - Ext4 file system; - FUSE (File system in Userspace); - File systems infrastructure; - Network file systems library; - NTFS3 file system; - SMB network file system; - Software nodes and device properties; - Mellanox drivers; - Network traffic control; - Bluetooth subsystem; - IPv4 networking; - Netfilter; - IPv6 networking; - Network sockets; - XFRM subsystem; - Tracing infrastructure; - io_uring subsystem; - IPC subsystem; - IRQ subsystem; - Signal handling mechanism; - KProbes tracing; - Memory management; - 6LoWPAN network protocol; - IEEE 802 network protocols; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Networking core; - Devlink API; - Ethtool driver; - Handshake API; - HSR network protocol; - IEEE802154.4 network protocol; - IUCV driver; - L2TP protocol; - MAC80211 subsystem; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NetLabel subsystem; - NFC subsystem; - Open vSwitch; - Phonet protocol; - Qualcomm IPC Router (QRTR); - RDS protocol; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - TLS protocol; - Unix domain sockets; - VMware vSockets driver; - Wireless networking; - Key management; - Linux Security Modules (LSM) Framework; - ALSA framework; - AudioScience HPI driver; - Simple audio multiplexer codec driver; - Wolfson Microelectronics audio codecs; - KVM subsystem; (CVE-2025-68296, CVE-2025-68768, CVE-2025-71289, CVE-2026-23346, CVE-2026-23469, CVE-2026-31420, CVE-2026-31486, CVE-2026-31560, CVE-2026-31663, CVE-2026-43116, CVE-2026-43219, CVE-2026-43240, CVE-2026-43303, CVE-2026-43311, CVE-2026-43331, CVE-2026-45850, CVE-2026-45930, CVE-2026-46158, CVE-2026-46170, CVE-2026-46203, CVE-2026-46275, CVE-2026-46315, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52908, CVE-2026-52910, CVE-2026-52912, CVE-2026-52913, CVE-2026-52915, CVE-2026-52916, CVE-2026-52917, CVE-2026-52918, CVE-2026-52919, CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52926, CVE-2026-52927, CVE-2026-52929, CVE-2026-52930, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52941, CVE-2026-52942, CVE-2026-52943, CVE-2026-52944, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53131, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53140, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53154, CVE-2026-53156, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53186, CVE-2026-53190, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53202, CVE-2026-53205, CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53213, CVE-2026-53214, CVE-2026-53216, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary display drivers; - Compressed RAM block device driver; - GPIO subsystem; - GPU drivers; - HID subsystem; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Mouse) drivers; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Texas Instruments network drivers; - NVMEM (Non Volatile Memory) drivers; - Parport drivers; - SCSI subsystem; - SLIMbus drivers; - NVIDIA Tegra SoC drivers; - SPI subsystem; - Trusted Execution Environment drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - USB Device Class drivers; - DesignWare USB2 driver; - USB Gadget drivers; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - Framebuffer layer; - Ext4 file system; - FUSE (File system in Userspace); - File systems infrastructure; - SMB network file system; - Mellanox drivers; - Network traffic control; - Bluetooth subsystem; - IPv4 networking; - Netfilter; - IPv6 networking; - Network sockets; - XFRM subsystem; - IPC subsystem; - Signal handling mechanism; - Memory management; - 6LoWPAN network protocol; - IEEE 802 network protocols; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Networking core; - Devlink API; - Ethtool driver; - Handshake API; - HSR network protocol; - IEEE802154.4 network protocol; - IUCV driver; - L2TP protocol; - MAC80211 subsystem; - Management Component Transport Protocol (MCTP); - Multipath TCP; - NetLabel subsystem; - NFC subsystem; - Open vSwitch; - Qualcomm IPC Router (QRTR); - RDS protocol; - RxRPC session sockets; - SCTP protocol; - SMC sockets; - VMware vSockets driver; - Wireless networking; - ALSA framework; - Simple audio multiplexer codec driver; - Wolfson Microelectronics audio codecs; - KVM subsystem; (CVE-2025-68296, CVE-2025-68768, CVE-2026-23346, CVE-2026-31663, CVE-2026-43116, CVE-2026-43219, CVE-2026-43240, CVE-2026-43303, CVE-2026-43311, CVE-2026-43331, CVE-2026-45850, CVE-2026-45930, CVE-2026-46203, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52908, CVE-2026-52910, CVE-2026-52913, CVE-2026-52917, CVE-2026-52923, CVE-2026-52927, CVE-2026-52929, CVE-2026-52930, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52943, CVE-2026-52944, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53140, CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53154, CVE-2026-53156, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160, CVE-2026-53161, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53190, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196, CVE-2026-53198, CVE-2026-53199, CVE-2026-53202, CVE-2026-53205, CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53213, CVE-2026-53214, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53223, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53232, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53242, CVE-2026-53245, CVE-2026-53249, CVE-2026-53251, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347, CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53356, CVE-2026-53358, CVE-2026-63867, CVE-2026-63868, CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63875, CVE-2026-63876, CVE-2026-63877, CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884, CVE-2026-63889, CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63906, CVE-2026-63908, CVE-2026-63909, CVE-2026-63913, CVE-2026-63914, CVE-202

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) Bug Fix(es) and Enhancement(s): * gfs2: Remote delete issues [rhel-9.6.z] (JIRA:RHEL-172430) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An input validation vulnerability in the Brocade Fabric OS administrative management API's security certificate management component allows an authenticated attacker with certificate deletion privileges to execute arbitrary system commands. This occurs because user-supplied certificate identifiers are not properly sanitized before being passed to external system routines. The vulnerability affects Fabric OS versions before 9.2.2d and versions 10.0.0 through 10.0.0a1.

CVE-2026-107222 is a medium severity vulnerability in the qax-os excelize Go library versions 2.7.0 through 2.11.0. It involves improper validation of array indexes during conditional-format extraction, which can cause out-of-range indexing or nil dereferences when processing malformed worksheet rules. This can lead to a panic that terminates an unprotected process. No fixed version is currently available.

CVE-2026-106486 is a high-severity vulnerability in the Backstage plugin scaffolder backend modules for Bitbucket Cloud and Bitbucket Server. It allows an authenticated user with limited privileges to influence filesystem paths outside the intended working directory when executing certain templates. This can lead to compromise of backend confidentiality, integrity, or availability depending on deployment specifics. Fixed versions are 0.3.10 for the Bitbucket Cloud module and 0.2.25 for the Bitbucket Server module.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) Bug Fix(es) and Enhancement(s): * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) Bug Fix(es) and Enhancement(s): * NFS client hangs while returning delegations (JIRA:RHEL-112278) * scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers (JIRA:RHEL-256998) * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-106582 is a low-severity vulnerability in OpenSSH versions before 10.6 where the use of an LZ77 dictionary coder creates a covert channel risk. This issue relates to CWE-514, involving unintended information flow. The vulnerability is based on findings from the arXiv paper 2609.07709 "Crossing the Streams". No known exploits are reported in the wild. The vulnerability affects OpenSSH versions from initial releases up to but not including 10.6.

## Root Cause File: `internal/auditlog/formats.go` — multiple sites write attacker-influenced bytes into the Native audit-log stream without escaping `\r` or `\n`: ```go // Part B — request headers (lines 72–80) for k, vv := range al.Transaction().Request().Headers() { for _, v := range vv { res.WriteByte('\n') res.WriteString(k) res.WriteString(": ") res.WriteString(v) // ← raw } } // Part C — request body (lines 85–86) if body := al.Transaction().Request().Body(); body != "" { res.WriteString(body) // ← raw res.WriteByte('\n') } // Part E — response body (lines 93–94) raw // Part F — response headers (lines 111–118) raw // Part H — error messages (line 125) raw // Part K — matched-rule raw data (line 151) raw ``` The Native format's section structure is line-based: sections are delimited by lines of the form `--<10-char-random-prefix>-<Part>--`, and line-based log parsers / SIEM rules rely on that structure. Any attacker-controlled bytes containing `\n` break the structural invariant and allow the attacker to inject lines that look like genuine audit content. The other two Native-format implementations in Coraza are not affected: the JSON formatter (`formats_json.go`) and the OCSF formatter both round-trip values through `json.Marshal`, which escapes `\r` and `\n`. ## Impact An attacker who can land bytes into any of the listed audit-log fields can inject arbitrary lines — including lines that visually resemble new log entries — into the audit log file of a defender running the default `SecAuditLogFormat Native` configuration. Realistic consequences: - **Forging entries to shift attribution.** An injected line such as `[client "9.9.9.9"] Coraza: Warning. ...` sits alongside genuine matches in Part H, and a human operator (or simple SIEM rule) reading the log cannot tell them apart. - **Confusing SIEM correlation.** Any ingestion pipeline that splits on `--...-[A-Z]--` boundaries or on `[client "..."]` patterns without validating the session prefix will treat the forged lines as separate records. - **Breaking log-parsing tooling.** Grep/awk pipelines, log tailers, and log-rotation tools with line-based assumptions can be poisoned with crafted binary sequences. - **Hiding genuine incidents.** An attacker who can also trigger a rule match on the same transaction (trivial — send any request that matches *any* audit-logged rule) can bury the real match under noise they control. The forged lines cannot trivially impersonate an entire *separate* session: the 10-char random prefix in the real boundaries (`boundaryPrefix := "--" + utils.RandomString(10) + "-"`, line 42) is not predictable from outside, and each transaction uses a fresh prefix. But the integrity of a *single* record is fully compromised, which is enough for the SIEM-confusion and attribution-shifting attacks. ## Proof of Concept Server with `coraza.conf-recommended`-style defaults: ```conf SecRuleEngine On SecAuditEngine On SecAuditLogParts ABCFHZ SecAuditLogType Serial SecAuditLog /tmp/audit.log SecAuditLogFormat Native SecRequestBodyAccess On SecRule REQUEST_METHOD "@rx ." \ "id:1001,phase:1,pass,log,auditlog,msg:'trigger'" ``` ### Body vector — reachable via stock `coraza/v3/http` + `net/http` Send an ordinary urlencoded POST whose body contains raw CRLF sequences and forged boundaries: ``` POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded evil=benign\r\n--coraza-forged-X--\r\nForgedLine: yes\r\n--coraza-forged-H--\r\n[client "9.9.9.9"] FAKE ATTACK ENTRY ``` Resulting audit.log: ``` --heLNtylvjY-C-- evil=benign --coraza-forged-X-- ForgedLine: yes --coraza-forged-H-- [client "9.9.9.9"] FAKE ATTACK ENTRY --heLNtylvjY-F-- ``` The forged `--coraza-forged-X--` / `--coraza-forged-H--` boundaries and the spoofed `[client "9.9.9.9"]` line are structurally indistinguishable from the surrounding genuine log content. No rule fires, no error is raised, the attack is invisible to the WAF. ### Header vector — reachable via non-net/http integrations only The same effect applies to Part B (request headers) and Part F (response headers) when a header value contains raw `\r\n`. Go's `net/http` rejects such headers at parse time (`400 Bad Request`), so the stock HTTP wrapper is safe from this path; the vector is reachable when Coraza is called with header values that were not validated by `net/http`: - `coraza-spoa` (HAProxy SPOP agent) forwards headers from HAProxy, which has more permissive validation. - `coraza-proxy-wasm` / Envoy WASM hosts forward header values from the upstream proxy. - Custom FFI/WASM hosts and any embedder calling `tx.AddRequestHeader(k, v)` with unvalidated bytes. Other raw-write sites (Part E response body, Part H error messages, Part K matched-rule data) share the same class of issue and should be fixed together. ## Mitigation Escape `\r` and `\n` at every raw-write site in `internal/auditlog/formats.go`. A single package-level

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain an improper certificate validation vulnerability in the proxy-server component. This flaw could allow an unauthenticated attacker on an adjacent network to exploit the vulnerability, potentially exposing storage backend administrator credentials. The vulnerability has a high severity rating with a CVSS score of 8.2.

CVE-2026-106119 is a vulnerability in langchainjs's MongoDBChatMessageHistory component where session identifiers are not properly validated at runtime. This allows specially crafted session identifiers to be interpreted as MongoDB query conditions instead of literal strings. An attacker able to invoke chat-history operations could potentially read, modify, or delete other users' conversation histories if multiple users' data share the same collection. The issue is fixed in @langchain/mongodb version 1.3.1 and later.

An improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS command injection. This affects versions before 6.0.0.66394. The vulnerability could allow an attacker with limited privileges and user interaction to execute OS commands. The issue is classified with medium severity.

An off-by-one bounds check vulnerability in the Bluetooth btintel_pcie driver in the Linux kernel allows an out-of-bounds array access. The issue occurs because the check incorrectly permits an index equal to the array count, leading to a potential out-of-range access. This flaw has been fixed by changing the bounds check to reject all out-of-range indices.

A vulnerability in the Linux kernel's Cortina Ethernet driver related to incorrect acknowledgment of RX overrun interrupts has been resolved. The issue involved the RX overrun interrupt being reported in one interrupt status register but acknowledged incorrectly using a different status register bit, causing improper handling of the interrupt for GMAC0 and GMAC1 ports.

CVE-2026-98237 is a vulnerability in the Linux kernel's mhi_wwan_mbim driver where a cyclic Neighbor Discovery Protocol (NDP) chain can cause an infinite loop in the mhi_mbim_rx() function. This occurs because the NDP traversal only stops when the next NDP index is zero, but a modem can point an NDP at itself or an earlier NDP, causing the loop to spin indefinitely on one CPU. The fix adds a check to break the loop when the next NDP offset is not larger than the current one, preventing CPU exhaustion.

A vulnerability in the Linux kernel's net/packet subsystem was fixed where the RX owner bit was not cleared on a VNET header conversion error. This could cause a ring slot to remain claimed and unavailable, leading to dropped packets in certain configurations. The issue affects specific Linux Azure kernel versions and has been resolved by ensuring the ownership bit is cleared on error paths.

A vulnerability in the Linux kernel's wilc1000 WiFi driver allows an out-of-bounds write to the RX buffer due to improper size validation of device-reported RX transfer sizes. This can cause memory corruption by writing up to approximately 32KB beyond the allocated buffer. The issue is fixed by dropping any RX transfer whose size exceeds the buffer and properly re-arming the RX engine to discard bogus frames.