CVE-2025-68820

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4rawinode If ext4getinodeloc fails e.g. if it returns -EFSCORRUPTED, iloc.bh will remain set to NULL. Since ext4xattrinodedecrefall lacks error checking, this will lead to a null pointer...

Security Bulletin: Due to use of Apache Commons Text, IBM Operations Analytics - Log Analysis is affected by Remote Code Execution Attacks

Summary Apache Commons Text in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the string manipulation and interpolation. CVE-2025-46295. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features...

Integrating APK Image and Text Data for Enhanced Threat Detection: A Multimodal Deep Learning Approach to Android Malware

As zero-day Android malware attacks grow more sophisticated, recent research highlights the effectiveness of using image-based representations of malware bytecode to detect previously unseen threats. However, existing studies often overlook how image type and resolution affect detection and ignor...

LLMs in Code Vulnerability Analysis: A Proof of Concept

Context: Traditional software security analysis methods struggle to keep pace with the scale and complexity of modern codebases, requiring intelligent automation to detect, assess, and remediate vulnerabilities more efficiently and accurately. Objective: This paper explores the incorporation of...

Zeek 8.0.5

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

MAL-2026-198 Malicious code in shopee-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ba8299c56484696126f8c09607e181246e87dd9c5f6a18cee51aec5d1f5ddd8 The package shopee-chat was found to contain malicious code. Source: ghsa-malware 052cf5d16ba6c226e8563598b02f71cc8f9bddb733c4074426526c4e860c66b8 An...

Malicious code in conmiyagi-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2e125bb096a79fe5c600e1826a5926312c29943a9f33edb1f2efbb0e0416203 The package conmiyagi-map was found to contain malicious code. Source: ghsa-malware fc52bddaac2d657d1e598f3b111f1195c1841882824da63324fac949f6f341ab...

[SECURITY] Fedora 42 Update: python-pdfminer-20240706-5.fc42

Pdfminer.six is a community maintained fork of the original PDFMiner. It is a tool for extracting information from PDF documents. It focuses on getting and analyzing text data. Pdfminer.six extracts the text from a page directly from the sourcecode of the PDF. It can also be used to get the exact...

Operational Runtime Behavior Mining for Open-Source Supply Chain Security

Open-source software OSS is a critical component of modern software systems, yet supply chain security remains challenging in practice due to unavailable or obfuscated source code. Consequently, security teams often rely on runtime observations collected from sandboxed executions to investigate...

Malicious code in mui7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 229ec4207198813ec81b334b0a5ac72c964258b80165cda21a1c25564819ad83 The package mui7 was found to contain malicious code. Source: ghsa-malware 81251ad548d890c9ade683aab8ffd6fb9d307a5e8bf6359d3b31f91080d26e8e Any...

MAL-2026-196 Malicious code in oe-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53c7a0c82b0a316878dbbd5767381ca0ef874192a308eb5001b953915dc816b The package oe-oauth was found to contain malicious code. Source: ghsa-malware 412d8ae25ded16fb507e7d120484a172ece322758c56fb4da2a6a7cd79b5be49 Any...

MAL-2026-195 Malicious code in mui7icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a78d5005068e75f9e5cc23616c1aa5a52bded7585e24cac270cdc0623c54de8 The package mui7icons was found to contain malicious code. Source: ghsa-malware bb725c3a171c7afa85beb301d5067750d7d43a1cd8f3dc836c4296dda3cd283b Any...

MAL-2026-199 Malicious code in vet-bones (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ce97e3af4cf9c82b0a51f4b693273ac59c6b1357b445b5613fbdcf7edec9a9 The package vet-bones was found to contain malicious code. Source: ghsa-malware 963e426141db06e18a04d497aed8ab05c8c6acfc76e6570d7c4a0bd2d81d7658 Any...

Malicious code in vet-bones (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ce97e3af4cf9c82b0a51f4b693273ac59c6b1357b445b5613fbdcf7edec9a9 The package vet-bones was found to contain malicious code. Source: ghsa-malware 963e426141db06e18a04d497aed8ab05c8c6acfc76e6570d7c4a0bd2d81d7658 Any...

MAL-2026-197 Malicious code in resto_ui_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd3404a7cf3642d3e49538ae488a44a564dc5dd94102302ab33814b62e4427a The package restouicomponents was found to contain malicious code. Source: ghsa-malware...

MAL-2026-188 Malicious code in shopping-cart-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35497d79077eb5f8f79659d420f79568f9fcf905b9ab2f2cceb043eb6eba574 The package shopping-cart-service was found to contain malicious code. Source: ghsa-malware...

CVE-2026-22609 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafeimports method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected...

EUVD-2026-1685

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafeimports method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected...

CVE-2026-22609 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafeimports method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected...

QES-Backed Virtual FIDO2 Authenticators: Architectural Options for Secure, Synchronizable WebAuthn Credentials

FIDO2 and the WebAuthn standard offer phishing-resistant, public-key based authentication but traditionally rely on device-bound cryptographic keys that are not naturally portable across user devices. Recent passkey deployments address this limitation by enabling multi-device credentials...