A security vulnerability (CVE-2026-32597) exists in the PyJWT library used in Python, where it accepts unknown 'crit' header extensions, violating RFC 7515 section 4.1.11 requirements. This issue has been addressed by Red Hat in an update for python-jwt packages on Red Hat Enterprise Linux 8.8 variants.
Two critical PHP vulnerabilities affect older deployments of Festo Didactic MES4 products using XAMPP with PHP versions up to 7.3, which are out-of-support and unpatched. Mitigations recommended by the PHP foundation include setting memory_limit=-1 and disabling session upload progress in php.ini, with an optional Apache configuration change that impacts performance. Additional firewall restrictions on the Windows host are suggested to limit communication to trusted sources.
The Apache Thrift Rust crate versions prior to 0.23.0 contain a vulnerability in the TBinaryInputProtocol's read_bytes function, where an attacker-controlled 4-byte length value is used directly to allocate a buffer without bounds checking. This can lead to excessive memory allocation or immediate process abort, causing a denial of service. The issue affects any peer sending binary protocol data and is unauthenticated and network-reachable. The vulnerability is fixed in version 0.23.0 by adding checks against negative sizes and enforcing a maximum string size limit.
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.
This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
Malicious versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were distributed via the Cursor VS Code Extension Marketplace in a supply chain attack. These versions contained JavaScript code that performed host reconnaissance and attempted to establish a reverse SSH tunnel for persistence and remote access. The malicious extension was live for approximately 11 hours and potentially downloaded by around 5,000 developer systems on macOS and Windows. Cursor removed the malicious versions promptly, suspended the marketplace for investigation, rotated keys, and worked with the cloud provider to take down the attacker's server. The attack failed to establish the SSH tunnel on most systems due to lack of administrative privileges. Users are advised to remove the malicious extension versions and follow Cursor's remediation guidance to detect and eliminate persistence mechanisms.
fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.
The Slaiclind campaign uses blockchain smart contracts as covert communication channels to deliver malicious payloads. Attackers embed scripts in compromised websites that query a Polygon blockchain smart contract to retrieve URLs hosting malicious JavaScript. This technique, called EtherHiding, replaces traditional command-and-control infrastructure with blockchain storage, making detection and takedown more difficult. The campaign also employs a kill-switch mechanism controlled via the smart contract. The malicious JavaScript then uses the ClickFix technique to trick users into executing commands, advancing the infection.
Multiple denial of service vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include issues with uninitialized progressive tile handling, a heap-based buffer overflow during MP3 audio decoding, and a heap out-of-bounds write in NTLM authentication. Red Hat has issued an important security update for FreeRDP in Red Hat Enterprise Linux 9 to address these vulnerabilities.
The persona-ai-sdk package version 1.0.0 on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Removing the package does not guarantee full remediation, as the attacker may have established persistent control over the system.
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Multiple denial of service vulnerabilities and a man-in-the-middle vulnerability have been identified in the Red Hat build of OpenTelemetry Collector. These issues stem from flaws in Go language components such as net/http, crypto/tls, net/textproto, and crypto/x509. The vulnerabilities allow denial of service via crafted HTTP Range headers, excessive HTTP/2 SETTINGS frames, memory limit bypass in multipart form parsing, and multiple ECH outer extension references. Additionally, a man-in-the-middle attack is possible due to untrusted intermediate certificates in crypto/x509. Red Hat has released security updates addressing these issues for Red Hat Enterprise Linux 10.2 Extended Update Support and related variants.
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.
Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.
Chainalysis, a blockchain analytics company, disclosed a data breach resulting from an AI-driven cyberattack using offensive agentic techniques to gain unauthorized access to its systems and internal tools. The breach did not compromise investigation content, transaction or query results, clear-text passwords, or other credentials. However, some non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels, was accessed. The company is investigating the full scope and has not disclosed the number of affected individuals. Chainalysis is actively patching vulnerabilities and strengthening security, recommending users enable MFA and be vigilant for suspicious authentication prompts.
@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.
The RubyGems package 'intercom-react-native-example-e2e-tests' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No further technical details or exploit information are provided.