A new variant of the PamStealer malware targets macOS users by masquerading as a fake Wavel cryptocurrency wallet application. It uses a complex server-side decryption process involving a custom utility and live ECIES key exchange, preventing offline payload decryption. The malware, rewritten in Swift, steals credentials from seventeen browsers, extracts keychain data, collects system fingerprints, and harvests user files including shell history and account photos. It maintains persistence through multiple redundant mechanisms and suppresses notifications by terminating background task management processes.
CVE-2026-43798 is a critical vulnerability in Apple swift-nio-ssh where a single crafted SSH message allows an unauthenticated network attacker to perform an out-of-bounds stack write with attacker-controlled length and content. This flaw affects any application built on swift-nio-ssh versions prior to 0.14.1 and can lead to severe impacts including confidentiality, integrity, and availability compromise. The vulnerability is addressed in swift-nio-ssh version 0.14.1.
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
A vulnerability in OpenClaw CLI on macOS allows combined POSIX inline-command flags to bypass the exec allowlist, potentially executing shell content outside intended restrictions. This affects versions from 2026.1.29 up to but not including 2026.5.6. The impact depends on the operator's configuration and whether untrusted input can reach the vulnerable code path. A patch is available in version 2026.5.6. Until patched, requiring approval for combined shell flag forms on macOS is recommended, along with general hardening such as narrowing allowlists and disabling the feature if not needed.
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination backends. A flat-keyspace source object store populated with native non-rclone tooling can contain a raw .. key segment, and affected b2, swift, qingstor, oracleobjectstorage, internetarchive, smb, storj, sftp, webdav, ftp, filelu, shade, and sia destinations use path.Join(root, remote) before EncodeDot can neutralize the segment. A copy or upload can therefore escape the configured root into another bucket, share, or path reachable by the victim credential, with sftp and smb potentially reaching other filesystem or share locations under the same login authority. This issue is fixed in version 1.75.1.
A double-free vulnerability exists in the swift-crypto component used by Red Hat Hardened Images RPMs when an RSA public key initialization from DER or PEM bytes fails during decoding. This flaw can cause memory corruption leading to a denial of service (system crash). Red Hat has issued an update including fixed RPM packages for nodejs24 and related components to address this issue.
Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a low-privileged role (e.g. the "User"/"Usuario" role) to read arbitrary bank account records belonging to their company by sending an authenticated request to the endpoint with a valid bearer token, because the API route is protected only by the auth:api middleware and carries no permission gate, unlike the equivalent web route, which enforces can('read bank'), and the handler resolves records with Account::where('company_id', Auth::user()->company_id)->get(), performing only company scoping and no role or permission check before returning the data. This results in the unauthorized disclosure of sensitive banking information (e.g. IBAN, SWIFT/BIC, account identifiers) to users who should not have access to it.
A sophisticated multi-layered scam operation targets fans seeking tickets for Celine Dion's French tour through two primary vectors. Fraudsters embed themselves in Facebook Groups and Marketplace, using social engineering to create artificial urgency and selling tickets before official presale dates. They exploit Ticketmaster's legitimate transfer feature to resell identical digital tickets to multiple victims, accepting direct bank transfers from compromised accounts. Simultaneously, threat actors deploy fraudulent websites impersonating official distributors like AXS and Ticketmaster, exploiting Shopify's payment infrastructure to appear legitimate. These sites share common technical indicators suggesting use of a recycled phishing kit previously deployed for other major concert events, including Oasis and Taylor Swift tours. The scheme combines emotional manipulation with technical deception to defraud victims desperate for concert access.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8ab8561c6c561b045d817d4fab3aa0754ce7cd767a3c5ec07b95151dda6b92c8)
swift-parse-stream advertises itself as an SVG sanitizer/minifier but ships an undocumented `getPlugin` export in index.js that, when invoked, performs an HTTP GET against https://www.jsonkeeper.com/b/3P9BF (an anonymous user-paste host) and runs `eval(parsed.model)` on the returned JSON's `model` field. The destination is attacker-controlled and mutable: whoever controls the paste can change the executed JavaScript at any time without republishing the package. The README does not mention this code path. Any caller — typically a second compromised package chaining into this one — that reaches `getPlugin()` hands arbitrary remote code execution to the paste's owner, running in the consumer application's process with its full privileges and access to its environment, filesystem, and network.
## Source: ghsa-malware (026b5362bac218ef01a452bd1c22598c75fad3bc2d2157ffc16dd5214fcc9152)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, Swift Metrics, and Swift Distributed Tracing. Prior to Swift W3C TraceContext version 1.0.0-beta.5 and Swift OTel version 1.0.4, a denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header. This allows crashing the process with data coming from the network when used with, for example, an HTTP server. Most common way of using Swift W3C Trace Context is through Swift OTel. Version 1.0.0-beta.5 of Swift W3C TraceContext and version 1.0.4 of Swift OTel contain a patch for this issue. As a workaround, disable either Swift OTel or the code that extracts the trace information from an incoming header (such as a `TracingMiddleware`).
China-linked threat actors rapidly weaponized the React2Shell vulnerability shortly after its public disclosure, indicating a swift exploitation attempt in the wild. React2Shell is a critical remote code execution vulnerability affecting systems that use the React framework or related components. Although no confirmed exploits in the wild have been reported yet, the speed of weaponization suggests imminent risk. European organizations using vulnerable React-based applications or AWS services could face unauthorized code execution, leading to data breaches, service disruption, or lateral movement within networks. Mitigation requires immediate patching, monitoring for suspicious activity, and restricting access to vulnerable services. Countries with significant cloud adoption and software development sectors, such as Germany, the UK, France, and the Netherlands, are at higher risk. Given the ease of exploitation and potential impact on confidentiality, integrity, and availability, this threat is assessed as high severity. Defenders should prioritize rapid vulnerability management and threat hunting to prevent compromise.
Oracle has released an emergency patch addressing a critical security flaw in its E-Business Suite. Although specific technical details about the vulnerability are not disclosed, the severity is rated critical, indicating a high risk of exploitation. No known exploits are currently reported in the wild, but the urgency of the patch suggests potential for significant impact if left unpatched. European organizations using Oracle E-Business Suite should prioritize applying this patch to prevent possible compromise. The flaw could affect confidentiality, integrity, and availability of enterprise resource planning data and processes. Countries with a high adoption of Oracle E-Business Suite and significant enterprise infrastructure are most at risk. Immediate mitigation involves deploying the official patch and reviewing access controls and monitoring for suspicious activity. Given the critical nature and potential for broad impact, this vulnerability demands swift action to avoid operational disruption or data breaches.
