Mangle

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Mangle or to submit an issue, reference https://github.com/Tylous/Mangle. Mangle Authored By Tyl0us Featured at Source Zero Con 2022 Mangle is a tool that manipulates aspects of compiled executables .exe or DLL. Mangle can remove kno...

Denial of Service Attacks on Beam Allocation in Large LEO Constellations

We study the vulnerability of beam allocation approaches in large low-Earth-orbit LEO satellite constellations to adversarial demand inflation resulting in denial-of-service attacks. We consider an attack model in which an adversary places injects additional terminals and evaluate these attacks...

CLSA-2026-1792078892 openssh: Fix of 4 CVEs

CVE-2026-106555: reset GSSAPI client state before each authentication attempt - CVE-2026-106553: store GSSAPI delegated credentials only after successful GSSAPI authentication - CVE-2026-106583: disallow '$' and '' in command-line user names - CVE-2026-106585: reject compressed packets that...

RHLW-2026-2CF5E53D95861E97 Lightwell Security Advisory: spring-security-saml2-service-provider 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-saml2-service-provider 5.7.11.rhlw-00006 with backported fixes for CVE-2026-40988, CVE-2026-41003, and CVE-2026-41694. CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider CVE-2026-41003: Unencoded HTM...

The Hidden DoS Vector in SQL Parsers

SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. Our research focused on two...

Backdoor in the Loop: Compromising Agentic Search Via Malicious Retrievers

Agentic retrieval-augmented generation RAG interleaves reasoning with repeated retrieval, giving the retriever influence over both the evidence an agent observes and its subsequent search decisions. We study retriever backdoors that exploit this feedback loop and repurpose weak backdoor...

FragToken: Amplifying LLM Inference Costs through Noncanonical Token Generation

As large language model LLM inference becomes increasingly expensive, resource-consumption attacks pose a growing threat to model providers. Existing attacks typically amplify cost by inducing abnormally long or repetitive outputs on attacker-controlled or triggered requests, making them easier t...

CVE-2026-63627

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition via the doUpgrade process. An attacker can inflate their credit balance by sending multiple concurrent downgrade requests, resulting in multiple refunds for a single legitimate downgrade. Remediation Upgrade...

GHSA-5GMM-HJFJ-8FF7 Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

Summary The service downgrade implementation in app/Livewire/Services/Upgrade.php::doUpgrade executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for...

Malicious code in lisa-gudeg59-breki (npm)

Source: amazon-inspector 3a9802d401ea885a1d60d2f608b6a53c6a0674edb4009f435853649f7b3b5bf0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-jus17-ruro (npm)

Source: amazon-inspector fa99fba90a729b48d1c12250a50a324f2ec8cd4fd3cf8f20526be13866d5c63d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-gulai65-sukiwir (npm)

Source: amazon-inspector 41f8e7fd29a5d1a1eae2b3bd752239ddb96c15de0253c6ed6b60f34955a488ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-esdoger11-ruro (npm)

Source: amazon-inspector 17fe3e222f19afc6fa0d58951afbd6dfdeba82b7522495961936c5350ba1dac2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-gandul10-breki (npm)

Source: amazon-inspector 741978cd9cfc69b1628822762aa6b7b97270d570b66d9ceca42c283210148a9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-gado-gado96-miaww (npm)

Source: amazon-inspector 67149864300e4491d1fe829a7b10a840b3c39bc353558ed50bd3a635786ec69b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-gandul17-riris (npm)

Source: amazon-inspector ab52ef42d2ea0f089b054f4e3eec2ffca094663af10a2da8341343f9cc5265d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-gorengan43-miaww (npm)

Source: amazon-inspector ec4c750e8253dbc17a91dc7534d6fe696afb6a83380005daee26c9fa11c19281 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-gepuk30-breki (npm)

Source: amazon-inspector c83a11f8dbc4e3aae610dfe29d822e90e76101a85dc774493b6e7f9329fb3602 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lisa-bubursumsum21-miaww (npm)

Source: amazon-inspector a087b5bac4d193340f795eb4817486455054c8ad1a29f46b5911e54aa5f0447b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...