Malicious code in n8n-nodes-port-scanner (npm)

Source: amazon-inspector cffdebe2e0a27deb3751af547baace8a403244cb92d214db726d3700a192d61e index.js executes a top-level IIFE at require-time that 1 runs hostname, hostname -I, id, ip route, ip neigh/arp and reads /etc/resolv.conf, opens a raw TCP socket to 103.27.109.184:8893, and writes the...

Malicious code in n8n-nodes-http-probe (npm)

Source: amazon-inspector 0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af index.js executes a top-level IIFE on module load that 1 spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacker an interactive shell on the installer's host; 2 runs...

Joern 4.0.589

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Rendering on Real Silicon: GPU Render-Timing As a Passive, AI-Resistant CAPTCHA Signal

Conventional CAPTCHAs pose puzzles that modern AI systems increasingly solve, while behavioral and cryptographic-attestation defenses carry privacy or enrollment costs. We investigate an orthogonal signal: the physical timing behavior of a client's GPU under a controlled WebGL rendering workload...

CVE-2026-15755: Improper Neutralization of Input During Web Page Generation

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Malicious code in dcchbot (PyPI)

Source: amazon-inspector df79831d1b486c8ca704295b410cec7b66be85aa87c3244d97ff1e87f643183a The package performs multiple installer-hostile behaviors. 1 dcchbot/init.py auto-invokes run on import, which triggers interactive input prompts and an outbound HTTPS GET to a non-PyPI third-party domain...

Malicious code in dash-grid-normalizer (PyPI)

Source: amazon-inspector 362011eafffa765e7f6c24df4ec2c7bb8f9fb6b6414570a5d193e6ea90e1250a On import, src/dashgridnormalizer/init.py calls hydrateremotelayoutprofile, which reassembles a payload from four string segments, base64-decodes and zlib-decompresses it, and passes the result to...

Malicious code in acme-widget-layout-utils (PyPI)

Source: amazon-inspector ff800752007d4e55ddc8172e04c8d75ac04d61b499cc58d97f016cd34d70d6c4 On import, src/acmewidgetlayoututils/init.py executes a textbook reverse-shell pattern: it opens a TCP socket, duplicates the socket file descriptor onto stdin/stdout/stderr via os.dup2, and execs /bin/sh -i...

CLSA-2026-1784636012 openssh: Fix of CVE-2026-60001

CVE-2026-60001: sshd did not enforce the minimum per-attempt authentication delay in the GSSAPI and keyboard-interactive paths, enabling timing-based user enumeration. Backport upstream commit d43ba60c...

CLSA-2026-1784634529 openssh: Fix of CVE-2026-60001

CVE-2026-60001: sshd did not enforce the minimum per-attempt authentication delay in the GSSAPI and keyboard-interactive paths, enabling timing-based user enumeration. Backport upstream commit d43ba60c...

PT-2026-62213

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation requires human...

Broken Gates: Re-Evaluating Web Bot Defenses in the Age of LLM Agents

LLM-based browser agents are rapidly changing the threat landscape for web security. Unlike traditional automation frameworks that execute predefined scripts, these agents can autonomously navigate websites, reason about page content, and interact with web interfaces using natural-language...

CVE-2026-15380 Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required ITMS 8.7.3...

CVE-2026-15380

CVE-2026-15380 : A non-admin interactive user can achieve full SYSTEM code execution via a DCOM/task scheduler logic chain in Symantec ITMS. No network access or memory corruption required. Connected records confirm the vulnerability and impact as stated; no explicit exploit details, mitigations,...

Kubernetes API

Authenticates to a Kubernetes API server token, kubeconfig, or in-cluster SA and creates an interactive Kubernetes session !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes API bind listener — opens a cluster API session for post modules.""" from kittysploit import from...

PT-2026-60728

Name of the Vulnerable Software and Affected Versions ITMS version 8.7.3 Description A non-administrator interactive user can achieve full SYSTEM code execution. This is possible through a logic chain involving DCOM Distributed Component Object Model, a Microsoft technology for communication...

SMB Client

Connects to a remote SMB server and creates an interactive SMB shell session !/usr/bin/env python3 -- coding: utf-8 -- """ SMB client listener — connects to a remote SMB service and creates an interactive session. """ from kittysploit import from lib.protocols.smb.smbclient import SMBAuth,...

Joern 4.0.582

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Beyond Success Rate: Cost-Aware Evaluation of Offensive and Defensive Security Agents

Security-agent evaluations commonly measure peak offensive capability under generous inference budgets, emphasizing vulnerability discovery, exploit development, penetration testing, and CTF completion. Such measurements are useful but incomplete: in operational security, every reasoning step, to...