Multiple security vulnerabilities affecting the Linux kernel have been addressed in an important update for Red Hat Enterprise Linux 10.2 Extended Update Support. The update includes fixes for several use-after-free issues, privilege restrictions, and other kernel-level bugs. The specific CVE-2026-53236 restricts the SO_ATTACH_FILTER socket option to privileged users. The update also includes various bug fixes and enhancements related to kernel stability and security.
A denial of service vulnerability exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This flaw, tracked as CVE-2026-94286, affects libXtst versions prior to 1.2.4-8.el10_2.1. The issue has been addressed in the fixed version 1.2.4-8.el10_2.1, and an update is available from Red Hat for multiple Red Hat Enterprise Linux 10 variants.
CVE-2026-106972 is a vulnerability in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack version 0.11.0. It involves uncontrolled recursion that can be triggered by crafted input, leading to a Denial of Service (DoS).
An integer overflow vulnerability exists in the MessagePack\BufferUnpacker component of rybakit/msgpack version 0.11.0. This flaw allows attackers to cause a Denial of Service (DoS) by providing crafted input to the vulnerable component.
CVE-2026-104016 is an integer overflow vulnerability in FasterXML jackson-dataformat-protobuf affecting multiple version ranges before fixed releases. The flaw occurs during parsing of length-prefixed protobuf string and bytes fields, where 32-bit signed integer arithmetic overflow allows bypassing bounds checks. This leads to an attempt to allocate an excessively large array, causing an OutOfMemoryError. The issue cannot be mitigated by JVM heap size tuning or existing string/document length limits. No special privileges or user interaction are required beyond submitting data for parsing. Fixed versions are available.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271)
When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-trajmetrics
Reasons (based on the campaign):
- native-extension
- files-exfiltration
CVE-2026-118129 is an improper authentication vulnerability in jeremyckahn Chitchatter affecting the isConfigMessageEvent function in src/Bootstrap.tsx. Manipulating the parentDomain argument can bypass authentication checks. Remote exploitation is possible. A patch has been released promptly by the vendor.
A new Kerberos abuse technique has been discovered that allows constrained delegation without protocol transition to be exploited against SPN-less accounts. This method combines previous research techniques to expand the attack surface of Kerberos delegation abuse. The researcher updated Impacket to support this new abuse path, facilitating practical exploitation. No specific affected software versions or patches are identified. The threat is considered medium severity based on the described impact.
The npm package 'csec-form-validatorr' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The ccsseecc-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
The ccsseecc-crypto-toolkit npm package contains malicious code that fully compromises any computer on which it is installed or running. It can lead to complete control by an outside entity, risking all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
The npm package ccsec-form-validator contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of the malicious software or attacker control.
The ccsec-crypto-toolkit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The csec-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The csec-crypto-toolkit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have gained full control of the system.
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
A memory corruption vulnerability exists in the Paint component of Google Chrome prior to version 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by crafting a malicious HTML page. The issue has been fixed in version 156.0.8078.73.
A memory corruption vulnerability in the Skia component of Google Chrome prior to version 156.0.8078.73 allows a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. This issue has been fixed in Chrome version 156.0.8078.73.
An improper input validation vulnerability in the UI of Google Chrome on Android versions prior to 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability has been assigned high severity by Chromium security. A fix is available in version 156.0.8078.73.
Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)