Malicious code in reguestsc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6 Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer. -...

MAL-2026-11413 Malicious code in reguestsc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6 Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer. -...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223

CodeIgniter (PHP framework) prior to version 4.7.4 is affected by an upload validation bypass in the is_image and mime_in rules. If an application preserves the client-supplied filename and stores uploads in a web-accessible, script-enabled directory, a remote attacker could upload executable con...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223: Unrestricted Upload of File with Dangerous Type

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

JetBrains PyCharm < 2026.1.4 / 2026.2 Arbitrary Code Execution

According to its self-reported version, the JetBrains PyCharm installation on the remote host is prior to 2026.1.4. It is, therefore, affected by an arbitrary code execution vulnerability. In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was...

CVE-2026-59946

A flaw was found in Composer, a dependency manager for PHP. A malicious package can exploit a vulnerability in Composer's binary installation process by using specially crafted path segments. This allows an existing file on the host system to have its permissions changed to be world-readable and...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Malicious code in streak-core-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34 [email protected] presents itself as a 'day-math primitives' library, but index.mjs the package main, executed on any require/import contains an...

MAL-2026-11148 Malicious code in streak-core-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34 [email protected] presents itself as a 'day-math primitives' library, but index.mjs the package main, executed on any require/import contains an...

Malicious code in kordyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c379ec39ec7791c9128dc4e1b82199ce29d7540a9a9984036af2ac79de38e1bf [email protected] advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities 'Early release — placeholder...

MAL-2026-11139 Malicious code in kordyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c379ec39ec7791c9128dc4e1b82199ce29d7540a9a9984036af2ac79de38e1bf [email protected] advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities 'Early release — placeholder...

Freeloader — Updated!

Docker support for plexmediaservercrack Patches Plex Media Server running in Docker — both the official plexinc/pms-docker image and the community lscr.io/linuxserver/plex image — using the same LDPRELOAD-on-the-PMS-exec mechanism as the native systemd install. See the top-level README and the fu...

Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

MAL-2026-11094 Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

CVE-2026-57916

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has...