Threat database

The larchworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain the payload, it facilitates downloading and executing remote malicious scripts, indicating coordinated malicious intent.

The thornqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as a mechanism to load malicious code from external URLs. This coordinated campaign aims to provide multiple deceptive methods to execute malicious code remotely.

The thistlerun package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is to facilitate execution of harmful code from external sources.

The juniperrun package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the packages themselves do not contain the payload, their purpose is to facilitate the execution of malicious code from external sources. This campaign is identified as malicious with intent similar to infostealers.

The flintqueue package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders for malicious code.

A new remote code execution (RCE) vulnerability (CVE-2026-115560) in PHP affects systems with a rare combination of configuration settings involving session serialization handlers and upload progress. No patch is currently available. The PHP security team recommends disabling session upload progress as a mitigation. This vulnerability is distinct from recently patched critical PHP2Shell RCE flaws. Exploitation requires unusual runtime changes to session serialization handlers, making it unlikely in typical deployments.

A vulnerability in the Linux kernel's readdir implementation related to inode locking on immutable directories has been resolved. The issue involved iterate_dir() holding a shared lock on the directory's i_rwsem semaphore even when the directory was immutable and never changed, causing unnecessary blocking. This could lead to stalls in mount namespaces sharing the same nullfs directory inode, impacting multiple users. The fix adds a FOP_IMMUTABLE flag to skip locking for directories that never change or are never removed, preventing the described contention.

A vulnerability in the Linux kernel's dm-integrity module was resolved involving improper validation of the superblock on resume. The dm_integrity_resume() function re-reads the superblock without validating it, allowing discrepancies if the superblock is modified while the device is suspended. This can lead to out-of-bounds memory writes during journal access. The fix involves snapshotting the validated superblock during construction and refusing to resume if critical fields have changed.

A vulnerability in the Linux kernel's CAN network subsystem was resolved by restoring skb header initialization in the init_can_skb() function. The issue was introduced when certain skb header reset calls were removed, causing RX skbs to carry an invalid mac_header value. This leads to an overflow in push length calculation in packet_rcv_spkt(), triggering a kernel panic and full machine crash. The problem was originally reported in 2014 and fixed then, but the recent commit reintroduced it. The vulnerability affects kernel stability and can cause denial of service via system crash.

A use-after-free vulnerability in the Linux kernel's gpio mpsse driver was resolved by fixing a race condition when arming the IRQ poll worker. The issue occurred because the poll worker could be scheduled before being properly published, leading to potential access of freed memory after device disconnect. The fix ensures atomic publication and arming of the worker under a spinlock and introduces a dying flag to safely handle teardown and memory freeing.

A use-after-free vulnerability in the Linux kernel's fsverity subsystem was resolved by introducing an RCU-delay in freeing the struct fsverity_info. The issue arose because __fsverity_get_info() used rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential concurrent access to freed memory for different inodes.

A memory leak vulnerability in the Linux kernel's power sequencing component for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that the caller must free, but pwrseq-pcie-m2.c did not free this array, causing a memory leak. The fix adds an explicit kfree() call to release the allocated memory.

A vulnerability in the Linux kernel's io_uring/net subsystem was resolved that involved incorrect handling of IPv6 sockaddr length in connection filtering. The issue caused connect filters to see zeroed port and address fields when the sockaddr_in6 length was 24 bytes (SIN6_LEN_RFC2133), allowing filters that deny connections based on port or address to be bypassed. The fix aligns the length threshold to SIN6_LEN_RFC2133, ensuring filters correctly see the real destination address and port.

A vulnerability in the Linux kernel's statmount functionality allowed reading the parent of an unmounted mount under mount_lock, potentially leading to dereferencing a mount that has already been freed. This issue arises because statmount_mnt_basic() reads the parent mount's IDs without proper synchronization when the mount has been unmounted but kept alive by a file descriptor. The flaw has been resolved in the Linux kernel.

A vulnerability in the Linux kernel's mount notification system allows a mount to be queued multiple times for notifications, leading to use-after-free memory access. This occurs because mnt_notify_add() does not check if a mount is already on the notification list, causing corrupted list state and potential kernel memory errors. The issue affects mounts with the MNT_SHRINKABLE flag, such as submounts of NFS, AFS, CIFS, and tracefs. The flaw has been resolved by initializing the notification list properly and preventing duplicate queueing of mounts.

A use-after-free vulnerability in the Linux kernel's drm/xe component was resolved by fixing stale pinned_link list entries when framebuffer pins perform the final unpin. The issue arises when buffer objects (bo) are pinned both externally and as framebuffers, leading to stale list entries after the final unpin and potential memory corruption.

A vulnerability in the Linux kernel's AMDGPU driver was resolved by restricting doorbell buffer objects (BOs) to only those created in the doorbell domain. The flaw allowed any BO passed as a doorbell handle to be pinned into the doorbell domain, which could cause loss of buffer contents when moved improperly. This could be exploited by a client sharing a buffer with another client on the same device. The fix rejects BOs not created in the doorbell domain.

A vulnerability in the Linux kernel's drm/panthor driver was resolved that involved improper validation of the userspace queue count against the number of initialized firmware slots. Unprivileged userspace could request more queues than the firmware had initialized, leading to potential crashes due to dereferencing uninitialized stream interfaces.

A use-after-free vulnerability in the Linux kernel's drm/xe/i2c driver was resolved. The issue occurs because a work item related to the i2c client device can remain queued or running after the adapter is unregistered and its memory freed, leading to dereferencing freed memory. The fix involves reordering the teardown process to unregister the bus notifier before client device teardown and canceling the work to prevent new scheduling and drain queued work items.

A vulnerability in the Linux kernel's drm/bridge th1520-dw-hdmi driver was fixed by correcting the remove() callback. The driver incorrectly handled a pointer type during teardown, which could cause improper cleanup.