---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a09908a36abda4fcde37ed9dd87c26112044394f1775f742cd56ca16ec6e6cea)
The package wraps Instagram login/API operations and performs two installer-harming behaviors against a hardcoded author endpoint at reelsaver.appit-online.de. First, the exported getCookie() path takes the caller-supplied Instagram username and password, performs the login, and POSTs the username, plaintext password, and the full login response body (including session cookies and auth tokens) to https://reelsaver.appit-online.de/v2/insta/check. Second, LoginService.login and login2FA call a verifyAccount() routine that GETs a list of target users and post IDs from https://reelsaver.appit-online.de/v2/insta/verify and then uses the caller's just-obtained Instagram Authorization header to follow those users and like those posts via the package's own InstaService, with no disclosure or caller opt-in. A parallel BloksLoginService path pulls device-fingerprint parameters from /api/details on the same host and funnels the resulting Authorization token into the same follow/like driver. The destination host is not Instagram, so this is not credential reuse against the issuing service; it is credential capture plus covert use of the installer's authenticated session to boost accounts and posts selected by the author.
## Source: ghsa-malware (6451b5d95d51aa4063e15551a18c1305088f92597bf3a7e47bd18472a81d9855)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A criminal group has compromised 953 online stores, mainly Magento shops, by injecting malicious JavaScript loaders into CMS blocks since July 2025. The latest domain used, deepveindrilling.com, employs advanced bot detection via browser fingerprinting to evade scanners. The malicious loader persists by storing code in visitors' localStorage. Attackers exploited known Magento vulnerabilities, including PolyShell and SessionReaper file upload flaws, to gain access. The campaign targets cryptocurrency users with fake Ledger wallet pages. Many stores were reinfected through persistent database access and backdoors, indicating long-term attacker presence despite cleanup efforts.
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Non security issue fixed:
- SELinux CIL files are not shipped in Docker (bsc#1278193).
Changes for docker:
- Update to Docker 29.7.2. See upstream changelog online at
<https://docs.docker.com/engine/release-notes/29/#2972>
fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
- Update to buildx 0.36.1. See upstream changelog online at
<https://github.com/docker/buildx/releases/tag/v0.36.1>
Microsoft is retiring the Exchange Web Services (EWS) API in Exchange Online, which causes EWS-dependent applications to stop working when the API is disabled. IT administrators can temporarily re-enable EWS to restore functionality until the final shutdown on April 1, 2027. Microsoft recommends updating or replacing applications to use the Microsoft Graph API, which offers similar features. The retirement affects only Exchange Online and Microsoft 365 environments; on-premises Exchange Server installations remain unaffected.
CVE-2026-115249 is a medium severity vulnerability in the subhajitkhan online-clinic-management-system affecting the Appointment Booking component. It involves improper input validation of the day/time/appdate arguments in the patappointtime.php file. The flaw can be exploited remotely and exploit code has been published. The project has been informed but has not yet responded or issued a fix.
CVE-2026-115248 is a medium severity vulnerability in the subhajitkhan online-clinic-management-system affecting the Booking Handler component, specifically the patappointtime.php file. The flaw allows remote attackers to manipulate processing, resulting in enforcement of behavioral workflow. A patch identified by commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is available but has not yet been officially released or responded to by the project. Exploit code is publicly available.
A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell, allow remote code execution on vulnerable systems. Attackers began exploiting these flaws four days before official patches were released on October 21, 2026. The PHP security team accelerated the patch release after some exploit details leaked online. Multiple unsuccessful exploitation attempts were detected before public disclosure, but since patch release, the vulnerabilities are broadly exploited in the wild. The PHP team and UK NCSC strongly urge immediate patching or taking servers offline until patched. The vulnerabilities affect PHP installations widely used across the internet, including popular CMS platforms. The vendor advisory states that applying official patches is the only permanent mitigation.
CVE-2026-115246 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the file patdocmsg.php. The vulnerability arises from improper handling of the 'Query' argument, allowing remote attackers to execute script code. The issue has been publicly disclosed and exploit code is available. The project has been notified but has not issued a response or fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
Operation Serengeti III was a coordinated law enforcement effort across 21 African countries that disrupted nearly 11,000 cybercriminal networks and arrested over 1,400 suspects involved in business email compromise, ransomware, online scams, and other cybercrimes. The operation recovered more than $105 million in illegal funds and identified over 65,000 victims with estimated losses exceeding $385 million. Notable actions included dismantling fraud rings in Uganda, seizing illegal cryptocurrency mining equipment in Angola, and arresting a suspect in Nigeria linked to a large-scale phishing and business email compromise campaign. Private cybersecurity firms provided critical intelligence to support the operation. This large-scale crackdown highlights ongoing efforts to combat cybercrime in Africa but does not describe a specific vulnerability or exploit.
A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-114380 is a medium severity SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in the /inserttrans.php file where manipulation of the 'prcd' argument allows remote attackers to perform SQL injection. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No patch or remediation information is currently available.
A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
The URL aws.oast.online was observed in attacker activity as a callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors on 2026-10-21, with four occurrences noted. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as being located in Germany. This URL is associated with malicious out-of-band communications and should be blocked and monitored in network defenses.
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:
* Certificate Authority (CA)
* Key Recovery Authority (KRA)
* Online Certificate Status Protocol (OCSP) Manager
* Token Key Service (TKS)
* Token Processing Service (TPS)
* Automatic Certificate Management Environment (ACME) Responder
* Enrollment over Secure Transport (EST) Responder
Security Fix(es):
* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)
* pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.