Search: 10.4-5

A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.

These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update includes the following RPMs: mariadb10.11: * mariadb10.11-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-backup-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-client-utils-3:10.11.18-4.1.2.hum1 (noarch) * mariadb10.11-common-3:10.11.18-4.1.2.hum1 (noarch) * mariadb10.11-connect-engine-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-cracklib-password-check-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-devel-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-embedded-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-embedded-devel-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-errmsg-3:10.11.18-4.1.2.hum1 (noarch) * mariadb10.11-gssapi-server-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-oqgraph-engine-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-pam-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-rocksdb-engine-3:10.11.18-4.1.2.hum1 (x86_64) * mariadb10.11-s3-engine-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-server-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-server-galera-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-server-utils-3:10.11.18-4.1.2.hum1 (noarch) * mariadb10.11-sphinx-engine-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-test-3:10.11.18-4.1.2.hum1 (aarch64, s390x, x86_64) * mariadb10.11-3:10.11.18-4.1.2.hum1.src (src) Security Fix(es): mariadb10.11: * CVE-2026-85746

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8d53280e50e3f0ad06e3ab6e3685856cd774465fd6d4461d64e22caad4ee94fc) @sxm-web/client-sdk-core@1.0.1 is a stub package whose only functional code is a beacon. The declared postinstall script runs `node beacon.cjs`, and the same beacon is also invoked at require time from index.js. The beacon collects installer-side identifiers (hostname, install path, current working directory, Node.js version, package name) and POSTs them in cleartext over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc, which is unrelated to any legitimate registry or publisher infrastructure. The package's `main` returns a Proxy that produces no-op functions for every accessed property, so the package provides no advertised functionality — the install itself is the payload. The scoped name `@sxm-web/client-sdk-core` combined with a `Compatibility shim` description is consistent with a dependency-confusion probe aimed at an internal/private SDK namespace, where the beacon's purpose is to confirm successful resolution against private names and to disclose the resolving host's identity and filesystem layout to the operator at the bare IP. ## Source: ghsa-malware (8a5670fe68642a259935664dbac1c7c569c1af0b09253570a72909b92c7ac1c5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

A critical vulnerability exists in the Cranelift compiler backend of Wasmtime on aarch64 architectures prior to versions 36.0.19, 48.0.7, and 49.0.4. The flaw allows a Wasm br_table instruction with more than approximately 256,000 targets to compile incorrectly, resulting in a conditional branch that can jump to arbitrary code. This enables a user-controlled WebAssembly module to escape the sandbox, potentially leading to full compromise on affected systems. The issue is fixed in the specified versions.

A vulnerability in Wasmtime, a WebAssembly runtime, allows a malicious guest to cause the host to panic by bypassing a required payload-type check when lowering host-created component-model streams or futures into a guest. This affects versions from 46.0.0 until 48.0.7 and 49.0.4. The issue is fixed in versions 48.0.7 and 49.0.4.

CVE-2026-115889 affects the Wasmtime runtime for WebAssembly, specifically its Cranelift compiler backend. Versions prior to 36.0.19 and 43.0.0 have a vulnerability where SSA value indices are bit-packed in a way that can overflow silently in release builds when compiling large or specially crafted Wasm functions. This overflow can cause incorrect intermediate representation references, leading to arbitrary miscompilation, type confusion, and potentially allowing attacker-controlled effects to escape the Wasm sandbox. The issue is fixed in versions 36.0.19 and 43.0.0.

@greenlake/session is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (3.0.0, 99.0.1, 1.0.0, 2.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (57df84a0164eda463123b80b9c0b871e6aeedaf39bfb0f585641495fd9b7c25c) The package is a near-empty shim whose only functional behavior is a beacon. beacon.cjs defines a hardcoded bare-IP HTTP endpoint (http://185.158.107.175:8787/_ah/dc) and a fire() routine that POSTs installer-side host identifiers to it: package name, os.hostname(), __dirname (install path), process.cwd(), and process.version. fire() is invoked from the postinstall lifecycle script, so it runs automatically on `npm install`, and also from the main entry, so it runs again on `require('@greenlake/session')`. The main export is a Proxy that returns a no-op for every property access, so the package provides no legitimate functionality. The README self-labels this as an authorized dependency-confusion test against an internal `@greenlake` scope, but that is author-controlled text and does not constitute consent from any other installer whose resolver pulls this public package in place of the intended internal one. The data path is unencrypted (plain HTTP) and the destination is a bare IP unrelated to any declared publisher infrastructure. ## Source: ghsa-malware (5eeafa0dd33f6f4b4aeb951ef41be36e1236bda04b8aea218e0a46b49fa14ac8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@greenlake/mfe-login-url is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (2.0.0, 1.0.0, 3.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8669a0a99995d7a57a13210e4b7e8fe8449f746ab808271370776d072491b3db) @greenlake/mfe-login-url 2.0.0 presents itself as an empty compatibility shim but ships a beacon.cjs that POSTs installer hostname, install path, cwd, and Node version to the hardcoded plain-HTTP bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires in two places: package.json declares a postinstall script running `node beacon.cjs`, and index.js (a Proxy-based no-op stub designed not to break bundlers) invokes `require('./beacon.cjs').fire()` on import. The scope `@greenlake` and the stub-plus-beacon shape are consistent with a dependency-confusion reconnaissance package that silently confirms successful installs inside internal build systems and discloses host identifiers to an unknown operator. There is no legitimate functional code; the entire package exists to exfiltrate installer host metadata. ## Source: ghsa-malware (9faa9e9c53efcfe969b4aaa5d2f8df7a5ab2879ab08cc2639f1c385dc1883094) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (3.0.0, 1.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b7f6299b80d36c1d11d7a258c9bffdeb2e1281348e599487c011dd9e959d7120) The package declares a postinstall script (beacon.cjs) and a main entry (index.js) that both invoke a beacon POSTing the installer's hostname, install path, cwd, and node version to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over cleartext HTTP. The destination is a bare IPv4 on a non-standard port, unrelated to any publisher infrastructure. The package has no advertised functionality: main exports a Proxy of no-op functions so that bundlers and consumers do not crash on property access, while the require-time path and the postinstall hook both exist solely to trigger the callback. The package self-describes as a 'Compatibility shim' with no legitimate reason to phone home, and the generic @greenlake/context-pane name combined with the no-op export surface is consistent with a dependency-confusion lure whose only effect on installers is the install-time and import-time beacon. ## Source: ghsa-malware (193d0e8c4b04c5227f73248853240c294e6799cc482fbbd7fa57c27257a21248) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@greenlake/common-context is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (99.0.1, 3.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8ee1e5c23e641cce920808500ad850f4965adeb982b4c14233901c80c2cfb039) The package self-describes as a 'Compatibility shim' and exports an inert Proxy that returns no-op functions for every property, providing no functional API. Its only runtime behavior is a beacon in beacon.cjs that fires both from the npm postinstall lifecycle hook and on require() via index.js. The beacon collects the installer's OS hostname, __dirname install path, and process.cwd() (which commonly embed the Unix username and internal project/repo names) along with Node version, and POSTs them as JSON to the hardcoded plaintext bare-IP endpoint http://185.158.107.175:8787/_ah/dc with an x-beacon-package header identifying the resolving package. The scoped name @greenlake/* mimicking an internal namespace, the inert public API, and the automatic callback to a hardcoded bare-IP operator on install and import together match the shape of a dependency-confusion probe: resolving this package on an installer's machine silently discloses internal host, user, path, and namespace information to an external operator the installer did not opt into. ## Source: ghsa-malware (09b757ef91607a1bfe1b7e02eb0fc5e2d2647503898e30d04769ac1a5fc5385b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

@greenlake/auth is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (3.0.0) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d51386d7bf7b3357a9ea920b99fa08f3c2d37532e877f33a5d8d0a78c12702b5) The package declares `postinstall: node beacon.cjs` and additionally fires the same beacon from `index.js` on require(). The beacon POSTs a JSON payload containing `os.hostname()`, `__dirname` (install path), `process.cwd()`, and the Node version to the hardcoded plain-HTTP bare-IP endpoint `http://185.158.107.175:8787/_ah/dc`, which is unrelated to any `@greenlake` publisher infrastructure. The package otherwise ships no functional code: `index.js` self-describes as a 'Compatibility shim' and exports a Proxy whose `get` trap returns a no-op for every property access. The shape — a `@scope/<name>` no-op shim whose only behavior is identifying the installing host to an attacker-controlled IP on `npm install` — matches the dependency-confusion probe pattern, where a public package is published under an internal scope name to map which corporate installers resolve to the public registry. ## Source: ghsa-malware (e39ad6eeb6fd18f5aeff7b616ce8bfeb8f75d50f2ac28bca24a594dfa83b1510) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

A vulnerability in the twisted.words.xish.domish ExpatElementStream parser prior to version 26.10.0rc1 allows an unauthenticated remote peer to exhaust server memory by keeping a container element open and continuously adding child elements. This occurs during XMPP pre-authentication stream parsing before credentials are accepted. The issue is fixed in version 26.10.0rc1.

A vulnerability in Twisted's IMAP4Server prior to version 26.10.0rc1 allows an authenticated client to send a SEARCH command with a negative literal size. This causes the parser cursor to move below zero, triggering a synchronous scanning loop that freezes the single-threaded reactor. As a result, all IMAP connections and any SMTP or POP3 services hosted in the same process become unresponsive until the service is restarted. The issue is fixed in version 26.10.0rc1.

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

CVE-2026-115778 is a high-severity vulnerability in the Twisted event-based framework for Python. Prior to version 26.10.0rc1, the Telnet dataReceived method in twisted.conch.telnet improperly accumulates data in a subnegotiation buffer without a maximum length limit. Because Telnet option negotiation occurs before authentication, an unauthenticated attacker can send data without the expected terminator, causing uncontrolled memory growth. This can lead to memory exhaustion and process termination, affecting all services hosted by the process. The issue is fixed in version 26.10.0rc1.

A resource consumption vulnerability exists in the Twisted framework prior to version 26.10.0rc1. The IRC protocol implementation buffers all received bytes without a line feed in a per-connection buffer without enforcing a maximum line length. This allows an unauthenticated connection to cause unbounded memory growth, potentially exhausting server memory and causing denial of service. The issue is fixed in version 26.10.0rc1.