Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution.
During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each release's dependency requirements and SHA-256 outer_checksum. After resolving versions, gleam_cli::dependencies::lookup_package makes a second request to the unsigned Hex API through gleam_core::hex::get_package_release and records the outer_checksum and dependency names from that JSON response into manifest.toml, instead of the values from the verified repository metadata. The Hex repository signature does not cover the API response.
An adversary in the middle who can intercept TLS with a certificate trusted by the Gleam process (for example a TLS-inspecting proxy using a CA in the operating system trust store or added through GLEAM_CACERTS_PATH), and who can modify both the API release response and the corresponding repository tarball, can supply a package archive with a matching forged checksum without the Hex repository signing key. Gleam verifies the forged tarball against the forged checksum, accepts it, and extracts it as a dependency source, resulting in loss of integrity of the downloaded package contents.
Only projects that resolve or update Hex dependencies are affected, which happens when the manifest is missing, a dependency is added or updated, or dependency requirements change. Builds that reuse an unchanged, known-good manifest.toml continue to verify tarballs against its pinned checksum. This issue affects gleam: from 0.18.0 before 1.18.0.
The Advanced Responsive Video Embedder plugin for WordPress version 10.8.7 contains a critical authentication bypass vulnerability due to a hardcoded backdoor token. This backdoor allows unauthenticated attackers to gain administrator privileges by supplying a known token that matches a hardcoded SHA-256 hash in the plugin source. The vulnerability arises because the authentication bypass occurs before any normal authentication checks, with no nonce or capability verification. This flaw was likely introduced maliciously by an attacker with commit access to the plugin's codebase.
A malicious file identified by the SHA-256 hash 41f06f992406b144eaa87a5a91961a8ab4e46d9a38fc94e03ccd644a97252949 was observed by OffSeq Mirage honeypot sensors five times between July 29, 2026, and August 2, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the Netherlands. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash bf20fa97c5afa6cb4d25611fb5a6b9d1fc3dc18ecb07f6ba1bd80d9de05ad5b2. This file was observed twice on July 28, 2026, associated with attacker activity involving the T1105 technique (Ingress Tool Transfer). The hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. No patch or remediation information is available.
A malicious file identified by the SHA-256 hash 5f0f014674efd7ae577b0cce3b2a056dcae394d81c5ab5c09b311cf5f2fbb83c was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This indicator is intended for matching against files in environments and security feeds to detect potential compromise. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash d487a3bbd941c891d83433d955b05d9a569a04a61f8dc6b33b79c8842dc42100 was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 87da5dd36a95e1c0acbaff137a56d94a9339fdcf42577974b53fbd6f69c11219 was observed twice on July 28, 2026, by OffSeq Mirage honeypot sensors. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was transferred from attacker infrastructure located in MU. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific software versions or exploits in the wild are reported. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash a330fdc4266c2163a661aab758c06d52de0e923872dfb95f16f371183d4280f0 was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in MU. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this file hash to detect potential compromise.
A malicious file identified by the SHA-256 hash 6da698e64fba6eceba3457ffe1b5f844c8f155f46825da36ed67b4db66ef12af was observed by OffSeq Mirage honeypot sensors three times between July 27 and July 31, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload may be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Bulgaria. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e was observed by OffSeq Mirage honeypot sensors on July 27, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash da6d923c304f3844fb563ec63a9ff3b62f5cc177335192dfbc55667d24d9308d was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The activity was observed from attacker infrastructure located in MU. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 805a01d5cda9cf31423b7fc2cc70165098505500c9107bb47b4303c0a60cb208 was observed twice on July 26, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958 was observed twice in attacker activity on July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The activity was detected by OffSeq Mirage honeypot sensors and linked to attacker infrastructure in MU. There is no information on known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash dc8586402cbd86a2593fab196f3ced051326c21120144264492c07c5d91f2cfa was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG).
A malicious file identified by the SHA-256 hash 5b694a7351bb12f07ad0d3bde910eacd5debeccdfcdb52081317e4da944cb730 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in MU. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available for this indicator. Organizations should match this hash against their environments and security tools to detect potential presence.
A malicious file identified by the SHA-256 hash 752f690e3926fc04088edfb0cb06f679f4a2e44f88e7d0d9aa16d3ebf8db99cf was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Bulgaria. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or CVE identifiers are associated with this indicator. There is no known exploit in the wild linked to this file hash at this time.
A malicious file identified by the SHA-256 hash c43795d89b5cbde3f1b16fea18fb586e024a23ac4e2fbb48a0a18dd851a45876 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that may be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG). No known exploits in the wild or vendor patches are reported. Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash e144da3f5a982d5ed3a6c4edfa98bbfdc83fca9f67791f83123801061dc12eb4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 25 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 74ef10b3118313e6f1a26b71b60b5b978f193c796c1ec24a57cf2832334ff8c7 was observed multiple times in attacker activity between July 25 and July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds. No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash d1515ff3e467c83dff345353f38acc27ac1788964a7b5a320fb2f3b1c0eb63a6 was observed by OffSeq Mirage honeypot sensors 80 times between July 25 and July 27, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Bulgaria (BG). Defenders are advised to match this hash against files in their environments and threat intelligence feeds.