The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc. This file was observed 10 times on October 24, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The threat is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash 31087290fc269af7921f9591418ac5d0baff3304bc3a18bc7b614546766586e9 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information on affected software versions or known exploits in the wild. The file hash serves as an indicator of compromise (IOC) to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 792a633371540ee9695ed6923f566de4a41cdaec6883e5b537d8ef848ee8636e was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or geographic targeting are indicated. No known exploits in the wild or threat actors are associated with this indicator at this time.
A malicious file identified by the SHA-256 hash 0616c20dea0ff2bd59fff5b60b3e907231d8c99296d0a0c719ba553f83dbd056 was observed 10 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is provided.
A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
In October 2026, critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP affecting multiple supported versions. These vulnerabilities allow unauthenticated attackers to execute code remotely due to out-of-memory corruption and stale global state issues. Emergency security updates were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Mitigations exist but are incomplete; updating to the fixed versions is strongly recommended. Additional incidents involving LiteLLM, eMudhra, GitLab, Railway, and Zeabur were also reported in the same timeframe. The PHP project continues to address these issues with further advisories and release candidates.
A vulnerability in the Linux kernel's pivot_root() function involves improper checks of mount points before reading their parent mounts. The issue arises when new_root or the caller's root is a file descriptor to a mount that has been unmounted but still kept alive by the file descriptor, potentially leading to a use-after-free condition. The vulnerability causes a read operation on freed memory, resulting in a kernel bug detected by KASAN. The fix involves verifying that both mounts are in the caller's mount namespace before accessing their parents, preventing the unsafe read. All error paths return EINVAL, so no other side effects occur.
A vulnerability in the Linux kernel's dcache handling has been resolved. The issue involves improper handling of mountpoints on dentries that are being removed, allowing a bind mount of a directory being removed to be moved beneath an existing mount. This causes the mount to remain on the removed directory indefinitely, preventing its detachment. The flaw arises due to a race condition between detach_mounts() and d_delete(), where the victim dentry is still hashed and not properly locked during mount operations.
A vulnerability in the Linux kernel namespace handling was resolved involving the order of unhashing a dentry before detaching mounts on it. The issue allowed a race condition during unlink(), rmdir(), and rename() operations where the dentry remained hashed and visible between detach_mounts() and d_delete(), potentially exposing mount points that should have been hidden. This race window could be exploited by concurrent lookups to observe mounts that were supposed to be detached. The fix changes the order to unhash the dentry before detaching mounts, preventing lookups from seeing stale mount information.
A vulnerability in the Linux kernel's namei component allowed refwalk operations to reveal overmounted entries due to a race condition when a mountpoint was unlinked. This could cause a refwalk to expose underlying filesystem entries that should have been hidden. The issue was addressed by adding checks to detect dentries marked as unlinked during refwalk traversal, preventing exposure of detached mounts.
A vulnerability in the Linux kernel's namespace handling allowed automounts to be added below a mount that is not in the caller's mount namespace. This could lead to a kernel crash (general protection fault) due to a null pointer dereference when accessing certain filesystem layers via fanotify. The issue arises because an internal mount flag (MNT_NS_INTERNAL) was incorrectly treated as a valid mount namespace, causing unsafe operations. The flaw has been resolved by using a safer check that rejects unmounted and internal mounts, preventing the crash and restoring expected behavior.
A vulnerability in the Linux kernel related to namespace handling and locked mounts has been resolved. Locked mounts are designed to protect underlying files and directories from being revealed. The flaw allowed an unlocked ancestor mount to expire a locked mount beneath it, potentially exposing protected directories. The fix ensures that locked mounts are not expired independently but only as part of their parent mount, preventing the exposure of hidden files. Lazy unmounts still remove the entire mount tree including locked mounts. This vulnerability is addressed by changes to the expiry logic and mount locking behavior.
A vulnerability in the Linux kernel related to mount locking for automounts across user namespaces has been resolved. The issue involved improper locking of mounts when mounts are propagated across user namespaces, causing the host's mount to be locked instead of the child's copy. This could prevent the host from changing mount flags correctly. The fix ensures that the lock is applied to the mount in the namespace where the mount actually occurs, preserving correct mount flag management.
A vulnerability in the Linux kernel's XFS filesystem handling was resolved that involved improper management of reflink flags during file extent exchanges. The flaw caused reflink flags to be incorrectly transferred between files during certain extent exchange operations, potentially leading to data corruption due to writes occurring in place instead of copy-on-write. The fix stops exchanging reflink flags during these operations and ensures both inodes retain the flag as appropriate. The vulnerability affects the XFS_IOC_SWAPEXT operation as well, which was corrected by setting reflink flags on both inodes and ensuring copy-on-write forks exist. The reflink flags remain set until explicitly removed by specific operations.
A use-after-free (UaF) vulnerability in the Linux kernel's cgroup cpuset subsystem was resolved by avoiding direct access to a potentially stale pointer in the is_in_v2_mode() function. The fix introduces a new flag to safely indicate cpuset v2 mode, preventing unsafe memory access during cgroup filesystem rebind operations.
A vulnerability in the Linux kernel's gpio: exar driver was resolved by correcting the initialization order of an ID before registering its cleanup action. The issue involved improper handling of allocated IDs during failure in registering cleanup actions, potentially causing ID leaks and incorrect freeing of device IDs.
A vulnerability in the Linux kernel's drm/vc4 component involved a memory leak where the BO cache size list was not freed during teardown, leading to resource leakage on every unbind operation. This issue has been resolved by ensuring the size list is freed properly in vc4_bo_cache_destroy().
A vulnerability in the Linux kernel's net/sched subsystem was resolved that involved improper handling of unterminated algorithm names in the em_text module. The flaw allowed an out-of-bounds read and potential kernel memory disclosure when a 16-byte algorithm name without a NUL terminator was passed, causing the kernel to read adjacent memory and invoke a usermode helper with unintended data. The issue was fixed by rejecting attributes lacking a NUL terminator within the expected byte size.
A use-after-free vulnerability in the Linux kernel's AMT relay component was resolved. The issue involved queuing a packet buffer (skb) referencing a tunnel that could be freed before the packet was processed, leading to a use-after-free in amt_dev_xmit(). The fix changes the relay's General Query sending method to avoid queuing and referencing freed tunnels, removing unsafe skb control block usage. This eliminates the use-after-free condition and related kernel warnings.
A vulnerability in the Linux kernel's cxgb4 driver related to ch_ktls handling has been resolved. The issue involves improper locking when erasing entries from a shared tid_list array, which can lead to a spinlock deadlock due to softirqs not being disabled during xa_erase operations. The fix involves using xa_erase_bh() to properly disable softirqs and prevent lock contention.