Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01 On require of the package, index.js loads polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains...

Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in devplatform-nx-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

NewStart CGSL MAIN 6.06 : libreswan Multiple Vulnerabilities (NS-SA-2025-0243)

The remote NewStart CGSL host, running version MAIN 6.06, has libreswan packages installed that are affected by multiple vulnerabilities: - pluto in Libreswan before 4.11 allows a denial of service responder SPI mishandling and daemon crash via unauthenticated IKEv1 Aggressive Mode packets. The...

EUVD-2013-2036

Malware in sbrugna...

EUVD-2015-4301

Malware in sbrugna...

"Activator" Alert: MacOS Malware Hides in Cracked Apps, Targeting Crypto Wallets

Cracked software have been observed infecting Apple macOS users with a previously undocumented stealer malware capable of harvesting system information and cryptocurrency wallet data. Kaspersky, which identified the artifacts in the wild, said they are designed to target machines running macOS...

SUSE CVE-2013-2052

Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service pluto IKE daemon crash and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be t...

Samba Internal DNS Server Out-of-Bounds Read Vulnerability

Samba is a freeware implementation of the SMB protocol on Linux and UNIX systems, consisting of a server and a client program. When Samba versions 4.0.0 through 4.4.0rc3 are deployed as an AD DC and running an internal DNS server, an out-of-bounds read vulnerability exists in the processing of DN...

Gratipay: No Valid SPF Records.

SPF record lookup and validation for: gratipay.com SPF records are published in DNS as TXT records. The TXT records found for your domain are: ALIAS for nara-9076.herokussl.com Checking to see if there is a valid SPF record. No valid SPF record found of either type TXT or type SPF. Check...

Amazon Linux AMI : php55 (ALAS-2014-372)

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document...

Medium: php

Issue Overview: A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. acinclude.m4, as used in the...

php security update

CentOS Errata and Security Advisory CESA-2014:1013 Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base...

Medium: php55

Issue Overview: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. A denial of service flaw was found in the way the File Information fileinfo extension parsed certain...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2254-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2254-1 advisory. Christian Hoffmann discovered that the PHP FastCGI Process Manager FPM set incorrect permissions on the UNIX socket. A local attacker could use this issu...

UBUNTU-CVE-2014-4049

Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service crash and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function...

CVE-2013-2054

Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service pluto IKE daemon crash and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this...