A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
CVE-2026-115981 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. It involves manipulation of the REQUEST_URI argument in the upgrade/index.php file, allowing remote attackers to execute script code. The vulnerability has a medium severity rating with a CVSS score of 4.8. Public exploit code has been disclosed, but no known active exploitation in the wild is reported. The vendor was notified early about this issue.
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)."
A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
The npm package 'tailwind-base-buttons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the computer may have been given to an attacker.
The noelc-css-blender npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by this package.
The npm package tailwindcss-theme-kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
CVE-2026-115973 is a medium severity vulnerability in FaveoSuite Faveo Helpdesk version 2.0.3 affecting the password recovery functionality. The issue lies in the ForgotPasswordController::sendResetLinkEmail and PasswordController::reset functions, which allow weak password recovery mechanisms. This vulnerability can be exploited remotely without authentication and may lead to compromised account recovery processes.
This report discusses difficulties in getting phishing sites hosted on Vercel's platform taken down despite abuse reports. The phishing site impersonates a legitimate brand to harvest credit card data via fake checkout and 3DS OTP prompts. The reporter seeks community advice on effective takedown strategies, including reporting methods and escalation tactics. No direct technical details or exploit code are provided.
A malicious file identified by the SHA-256 hash d3e15a3cb34e3615b12e148369ac3bcebd5566760ebbf569ec59d02505420a74 was observed three times on October 24, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland. This indicator should be matched against files in security environments and threat intelligence feeds for detection purposes.
This content discusses the cybersecurity strategy of reducing the attack surface by minimizing unnecessary technology complexity within enterprise environments. It highlights recent high-severity PHP vulnerabilities that prompted urgent advisories and temporary website shutdowns, illustrating challenges in identifying and patching embedded vulnerable components. The article emphasizes that many enterprises accumulate redundant applications and dependencies over time, increasing security obligations without proportional business value. Reducing unnecessary software and infrastructure can lower risk and improve security sustainability.
This content describes a free, read-only bash script designed to triage WordPress sites for signs of compromise related to the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and a third CVE-2026-115560. The script checks PHP versions, WordPress core and plugin integrity, suspicious PHP files in uploads, recent file modifications, common web-shell patterns, user accounts, cron jobs, logs, Docker containers, and configuration settings relevant to the vulnerabilities. It generates detailed Markdown reports without modifying the target systems. The PHP2Shell vulnerabilities are critical remote code execution bugs patched in PHP releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but the third CVE has no fixed build yet, with a recommended mitigation of setting session.upload_progress.enabled=0. The script helps detect potential backdoors planted before patching, as updating PHP alone does not remove them.