Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons This project is mostly a callstack scanner which tries to identify IOCs indicating an unpacked or injected C2 agent. All checks are based on the observation that C2 agents wait between their callbacks causing the beacons thread to idle and this tool aims to analyze what...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel versions 5.8 through 5.19.x, prior to 5.19.16, local attackers who were able to inject WLAN frames into the mac80211 stack could carry out a NULL pointer dereferencing denial-of-service attack against the beacon protection of P2P devices...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fixed a deadlock in ieee80211beaconsstop. There is a deadlock in ieee80211beaconsstop, as shown below: Thread 1 | Thread 2 | ieee80211sendbeacon ieee80211beaconsstop | modtimer spinlockirqsave //1 | Wa...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: Abort software beacon handling if disabled A malicious USB device can send a WMISWBAEVENTID event from an ath9khtc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver...

wifiphisher

Acerca de Wifiphisher es un framework de Punto de Acción falso para realizar compromisos de equipos rojos o pruebas de seguridad Wi-Fi. Usando Wifiphisher, los probadores de penetración pueden lograr fácilmente una posición de hombre en el medio MitM contra clientes inalámbricos mediante la...

Malicious code in postcss-gap-fallback-util (npm)

Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs whoami, id, and hostname via childprocess.execSync, curls the...

Certified Randomness with Optimal Rate

The generation of certified random bits is an emerging near-term application of quantum computers. Potential applications, such as randomness beacons and CRS generation, require nearly uniform randomness, whose rate the ratio of min-entropy to bitlength is 1. However, existing protocols for...

DEBIAN-CVE-2026-97517

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

CVE-2026-97517

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

AZL-103937 CVE-2026-97517 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

UBUNTU-CVE-2026-97517

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

CVE-2026-97517 wifi: nl80211: reject beacons with bad HE operation

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

EUVD-2026-86115

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

CVE-2026-97517

The Linux kernel contains a vulnerability in the wifi: nl80211 component where the system fails to properly validate HE operation elements in beacons. Specifically, the kernel does not adequately verify that the element is longer than the fixed part and has an appropriate size for the internal va...

CVE-2026-97517

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

CVE-2026-97517: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

Linux Distros Unpatched Vulnerability : CVE-2026-97517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size...

kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address

A beacon protection bypass vulnerability was found in the Linux kernel's mac80211 WiFi stack. According to IEEE 802.11-2020, beacon frames must be sent to the broadcast address, but mac80211 incorrectly accepts unicast beacon frames with the Protected Frame bit set to 1. This allows attackers to...

Malicious code in analytics-merge-beacons (npm)

--- Credit: OpenSSF source...

Malicious code in sm-payment (npm)

Source: amazon-inspector 926b17cedd788f5f626b3c4001ca9f1b9572abe425b87d40d6f03814d211e3e7 package.json declares preinstall and postinstall lifecycle scripts that curl a hardcoded bare IP over plain HTTP http://16.192.173.5/sm-payment/pre and.../post automatically on npm install. The package has n...