A malicious file identified by the SHA-256 hash c71d74ce79b23052d26619ccc3c967fa46d2fd97328369b22565ac84f9028882 was observed by OffSeq Mirage honeypot sensors on 2026-08-22. This file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was transferred from attacker infrastructure located in Great Britain. The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information about active exploitation in the wild or specific affected software versions. The indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40 was observed by OffSeq Mirage honeypot sensors four times between August 22 and August 23, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes. No known exploits or threat actors are currently associated with this file, and no affected software versions are specified.
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
The npm package sui-graphql-rpc version 1.0.1 contains malicious code that reads the installer's ~/.gitconfig to extract the developer's email and name. It uses a SHA-256 hash of this identity as an AES-256-GCM key to decrypt embedded ciphertext blobs. If decryption succeeds, the resulting JavaScript code is executed dynamically, allowing targeted arbitrary code execution on developer workstations. This behavior is intentionally designed to evade detection by restricting execution to a hardcoded victim allowlist and skipping execution in CI environments. The package's advertised functionality does not require reading ~/.gitconfig, indicating the read is solely for malicious gating of code execution.
The Ingenic T31 SoC boot ROM has a vulnerability in its flash-boot verification process where only a single 32-bit word of the RSA signature is compared against a single 32-bit word of the SHA-256 payload digest. This incomplete verification allows an attacker with physical write access to the boot media to forge modified Secondary Program Loader (SPL) images that pass secure boot checks without the OEM signing key. The forgery attempt has a high success probability of about 2/3. This vulnerability has been validated through reverse engineering, software emulation, and hardware testing on a Wyze Video Doorbell v2 (T31X).
CVE-2026-75625 is a critical vulnerability in Uber Kraken where agents improperly validate integrity check values. Instead of verifying downloaded blobs against their requested SHA-256 digest, the system relies solely on CRC32 checksums for piece validation. This flaw allows attackers on the agent-to-agent communication path or malicious peers to supply substituted content with forged CRC32 corrections, poisoning the cache with attacker-chosen container image layers or manifests. These malicious contents can then be re-seeded and executed by other hosts, potentially leading to widespread compromise.
A malicious file identified by the SHA-256 hash 561b9327e87addc615ec1c93342af9227faf8bc904218ad513cf86b8ff26a467 was observed by OffSeq Mirage honeypot sensors eight times between August 18 and August 26, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain and the Netherlands. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.
A malicious file identified by the SHA-256 hash 51b052a524af278366fb5527d4a5eee949b63f85168c37d4f97aefe3e73fe66a was observed by OffSeq Mirage honeypot sensors in attacker activity between August 16 and September 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. The hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash a6296a79f44e21b76604d2d2bbf795d2cf380f70e39d45fbf166707ff3b4a6a4 was observed 56 times in attacker activity between August 15 and September 9, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Bulgaria, Brazil, Chile, China, Colombia, Germany, and Hong Kong. This indicator should be matched against files in environments and security tools to detect potential compromise.
CVE-2026-47191 is a vulnerability in Siemens kas, a setup tool for bitbake-based projects, affecting versions prior to 5.3. The issue involves improper verification of cryptographic signatures when relying solely on git commit IDs (SHA-1 or SHA-256) to validate repository state. This can allow an attacker who controls the repository to trick users into checking out malicious branches with the same name. The vulnerability primarily impacts SHA-256 commit IDs due to the possibility of hash collisions with SHA-1. Version 5.3 addresses this issue. Workarounds include avoiding sole reliance on commit IDs, validating cryptographically signed commits or tags, or using mirrored repositories with verified integrity.
OpenClaw CLI versions up to 2026.2.14 used the deprecated SHA-1 hashing algorithm for sandbox identifier cache keys. This hashing was used to determine if existing sandbox containers could be safely reused. Because SHA-1 is vulnerable to collisions, this posed a risk of cache poisoning and unsafe sandbox state reuse. The vulnerability is fixed in version 2026.2.15 by replacing SHA-1 with SHA-256 for these hashes, restoring collision resistance.
This release of Red Hat build of Quarkus 3.27.5 includes the following CVE fixes:
* scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack [quarkus-3.27] (CVE-2026-53712)
* jansi: Jansi: Heap buffer overflow leads to Denial of Service [quarkus-3.27] (CVE-2026-8484)
* postgresql: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade [quarkus-3.27] (CVE-2026-54291)
* sshd-core: Apache MINA SSHD: Unauthorized command execution due to
improper certificate validation [quarkus-3.27] (CVE-2026-56624)
For more information, see the release notes page listed in the References section.
A malicious file identified by the SHA-256 hash 15dfb2762480c825beb4f3cf3c57becf9386c02065f23525604fef2c8992f280 was observed by OffSeq Mirage honeypot sensors 58 times during attacker activity between August 13 and August 14, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file is associated with a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Brazil, Chile, China, Hong Kong, Luxembourg, Pakistan, and Saudi Arabia. This indicator should be matched against files in environments and security tools to detect potential compromise.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc)
On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check. The.dat file is a Linux x86_64 ELF RedShell remote-access implant disguised as a 'native math accelerator'. The implant beacons to hardcoded C2 host 217.60.77.63 over plain HTTP and exposes command handlers that download and execute additional ELF binaries and shellcode from http://217.60.77.63/Others/* and /SC/* endpoints, including in-memory execution via memfd_create/fexecve to avoid touching disk. It installs a masquerading systemd user unit 'svc-update.service' (Description=System Update Service, Restart=always) for persistence, provides SOCKS5 proxy and TCP port-forwarding, and offers built-in commands to enumerate users/env/processes/network configuration, harvest SSH keys and credentials from ~/.ssh and credential stores, and stream arbitrary filesystem paths to the operator via a chunked 'POST /api/extract-receive' handler labeled with a 'Loot_*' destination. The package's stated day-math purpose has no need for a native binary; the ELF's exposed command set (RedShell) is unrelated to any math functionality.
## Source: ghsa-malware (4eb4b412fdc46f4d5569e4b581cf64a9e1bed94cc7cd8fcd91613b98f73ac20f)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force attacks against the unsalted hash.
A malicious file identified by the SHA-256 hash 5f3709aa1823bc153c63dc5d0bccab9fbf9e252a910a08a639e857bd9f8f0149 was observed by OffSeq Mirage honeypot sensors on 2026-08-08. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. The hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 135cefead339d5e0813e38049da8666efefef7c7b64c6ed22f5fec62b676ced1 was observed by OffSeq Mirage honeypot sensors on August 8, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash can be used as an indicator of compromise to detect the presence of this malicious file in environments and security tools.