Cisco is investigating the impact of an emergency distrust of eMudhra root and intermediate certificate authorities on its product line. The advisory lists numerous Cisco products under active investigation to determine if they are affected. As of now, no specific affected versions or confirmed vulnerabilities have been identified. Cisco will update the advisory as the investigation progresses.
The runpier package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external sources. This campaign is identified as malicious with intent similar to infostealers.
The sedgehaul package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to facilitate malicious code execution. The campaign is identified as having clear malicious intent, including potential infostealing activities.
The taskquay package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their coordinated use facilitates executing harmful code from external sources. This campaign is identified as having clear malicious intent, such as infostealing.
The marshrunner package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they facilitate downloading and executing remote malicious scripts. This campaign is identified as having clear malicious intent, including potential infostealing activities.
The 'workslip' package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they serve as a mechanism to download and run malicious scripts. This coordinated campaign aims to provide multiple deceptive methods to load malicious code remotely.
The brookworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to execute code from external URLs. The campaign is identified as having clear malicious intent, such as infostealing.
The cobbleload package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external URLs. This campaign is identified as malicious with intent similar to infostealers.
The brambletask package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that execute code from remote URLs. Although the packages themselves do not contain the payload, they facilitate downloading and executing remote malicious scripts. This campaign is identified as having clear malicious intent, such as infostealing.
The ferretqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but serve as a mechanism to download and run malicious scripts. The campaign is coordinated and aims to provide multiple deceptive methods to load malicious code remotely.
The otterload package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the packages do not contain the payload themselves, their intent is clearly malicious, facilitating the execution of potentially harmful code from external sources.
The badgertask package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is clearly malicious, facilitating the execution of potentially harmful code from external sources.
The larchworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain the payload, it facilitates downloading and executing remote malicious scripts, indicating coordinated malicious intent.
The thornqueue package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as a mechanism to load malicious code from external URLs. This coordinated campaign aims to provide multiple deceptive methods to execute malicious code remotely.
The thistlerun package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their intent is to facilitate execution of harmful code from external sources.
The juniperrun package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the packages themselves do not contain the payload, their purpose is to facilitate the execution of malicious code from external sources. This campaign is identified as malicious with intent similar to infostealers.
The flintqueue package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders for malicious code.
A new remote code execution (RCE) vulnerability (CVE-2026-115560) in PHP affects systems with a rare combination of configuration settings involving session serialization handlers and upload progress. No patch is currently available. The PHP security team recommends disabling session upload progress as a mitigation. This vulnerability is distinct from recently patched critical PHP2Shell RCE flaws. Exploitation requires unusual runtime changes to session serialization handlers, making it unlikely in typical deployments.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until
an MPWQE is refilled. If XSK allocation then returns -ENOMEM,
actual_wq_head is not advanced and a later NAPI poll retries the same
WQE.
mlx5e_free_rx_mpwqe() leaves each released slot marked as releasable. On
retry it can therefore call xsk_buff_free() again through stale pointers
after the frames have returned to the XSK pool and been reallocated.
Set all skip_release_bitmap bits in the common error path of
mlx5e_xsk_alloc_rx_mpwqe(). This matches mlx5e_alloc_rx_mpwqe(). A
successful allocation already clears the bitmap after replacing every
buffer, so retries become idempotent without changing the success path.
Fault injection forced three consecutive failures for one selected MPWQE.
Both an early allocation failure and a partial 8-of-16-buffer unwind
released the original 16 XSK buffers only once. Each error left a full
bitmap, the following NAPI retry skipped the release, and a later
successful allocation cleared it. A 20-second AF_XDP zero-copy pressure
run exercised 1,575,262 buffer allocation failures without invalid
descriptors, WQE errors, or kernel warnings.