A malicious file identified by the SHA-256 hash ba1f9d2e31f7d4aa9b56d39c6e2d5090fff1645b31b8a26dc5e50da22aa244bf was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool delivered or staged during the attack. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious file in environments through matching with endpoint detection and response (EDR), antivirus (AV), or threat intelligence feeds.
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.
To remediate this issue, users should upgrade to version 3.17.1 or later.
A malicious file identified by the SHA-256 hash 2807c004092b2c84f1d3e9cefc5277d54a42fadce97788e02e8098fd7ff8ba86 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-11-02. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.
A malicious file identified by the SHA-256 hash 1aa17abe3be18c408e72a38290f3ffb8a6d96bf4862fed9d9e4209822f5039f5 was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was involved in attacker activity using technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b6833206a0c545d501275e8fd91955befd900adfdf1a4bfb0c0759bf3606e9bb was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this file hash to detect potential compromise.
The npm package @bigdevin55/calculator-install-demo contains malicious code that can fully compromise any computer on which it is installed or executed. The compromise may allow an attacker to gain full control over the affected system, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised device is strongly advised.
The npm package '@bigdevin55/calculator-install-hook' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
A race condition in the Linux kernel's NTFS fallocate implementation could allow concurrent mmap reads to access uninitialized disk data, leading to information leakage and data integrity issues. The flaw arises because the invalidate_lock is not held during standard allocation modes, allowing mmap page faults to read old disk contents before zeroing completes. The issue is fixed by extending the invalidate_lock to all fallocate operations.
A race condition vulnerability in the Linux kernel's NTFS driver was fixed by ensuring the invalidate_lock is taken during the ntfs_filemap_page_mkwrite() function. Without this lock, concurrent truncate or fallocate operations could interfere with pagecache invalidation and runlist rewriting, potentially causing data corruption or instability. The fix involves taking the invalidate_lock shared around iomap_page_mkwrite() to prevent these races.
A vulnerability in the Linux kernel's memory management subsystem (DAMON) could cause a division-by-zero error when the DAMON quota target value is zero. This issue arises because zero target values are not properly handled in the quota goal calculation, potentially leading to runtime errors. The problem has been addressed by moving the zero-value validation to the core layer, ensuring consistent handling and preventing division by zero.
CVE-2026-99239 is a high-severity vulnerability in the Linux kernel's Bluetooth L2CAP implementation. It involves a time-of-check to time-of-use (TOCTOU) race condition where a channel (l2cap_chan) may be linked to a connection (l2cap_conn) more than once, violating an invariant assumed by the kernel. This can lead to inconsistent state and potential security issues. The flaw arises because state changes to the channel are not properly synchronized, allowing a second channel addition during concurrent operations. The issue has been fixed in multiple Linux kernel versions starting from 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, and 7.2.
CVE-2026-99238 is a high-severity vulnerability in the Linux kernel affecting version 6.15. It involves improper locking in the tracing subsystem where trace_types_lock was not held when updating modules in persistent instances. This can lead to use-after-free conditions during module load or unload operations, potentially causing system crashes or allowing an attacker to compromise system integrity.
CVE-2026-99237 is a high-severity vulnerability in the Linux kernel tracing subsystem. It involves improper locking when resetting last boot data from readers, which can lead to double freeing of memory and concurrent modification issues. The flaw arises because trace_types_lock was not held in certain code paths, allowing race conditions between readers and module notifiers. This vulnerability has been fixed by ensuring trace_types_lock is held appropriately during these operations.
CVE-2026-99236 is a vulnerability in the Linux kernel's tracing subsystem where incomplete event filter expressions are not properly rejected. This flaw allows malformed filter expressions ending with logical operators to cause out-of-bounds memory reads during predicate parsing. The issue has been fixed by ensuring that only fully parsed expressions reach finalization, preventing unresolved operator states.
CVE-2026-99235 is a high-severity use-after-free vulnerability in the Linux kernel's tracing subsystem. The flaw arises because the kernel saves a pointer to a compatible histogram instead of the event file, which can be freed prematurely, leading to a kernel slab-use-after-free error. This issue was fixed by changing the code to save the event file pointer instead, preventing invalid memory access when triggers are removed.
CVE-2026-99234 is a vulnerability in the Linux kernel tracing subsystem where field variable histograms are not properly unregistered when a command fails. This can leave histogram triggers active and counting even though their associated data structures have been freed, potentially causing resource leaks or inconsistent tracing behavior. The issue occurs due to incomplete cleanup in error paths during command parsing and histogram trigger creation.
CVE-2026-99233 is a high-severity vulnerability in the Linux kernel's tracing/histograms subsystem. It involves improper verification of event identity when updating synthetic event reference counts, which can lead to use-after-free conditions. The flaw occurs because the system only compares event basenames, allowing a non-synthetic event with a matching basename to incorrectly modify a synthetic event's reference count. This can cause the synthetic event to be freed while still in use by an active histogram action. The issue affects Linux kernel version 4.17 and has been fixed in subsequent commits.
A vulnerability in the Linux kernel's syscall tracing mechanism was addressed by changing the copying method for faultable syscall buffers to use copy_from_user() instead of __copy_from_user(). This ensures that non-user addresses are rejected and recorded as faults, preventing potential security concerns related to trusting perf too much.
CVE-2026-99231 is a high-severity use-after-free vulnerability in the Linux kernel's io_uring subsystem related to improper ownership handling of requests before clearing the ->head pointer. The flaw allows a race condition where a request can be completed and freed while still being accessed by another thread, potentially leading to memory corruption and kernel crashes. This issue affects specific Linux kernel versions prior to 6.12.115, 6.18.60, and version 6.19. The vulnerability has been fixed in these versions.