BaconSampler

Bacon Sampler 아웃바운드 트래픽을 스니핑하여 의심스러운 비콘 같은 콜백을 찾아냅니다. 정해진 시간마다 계속 돌아온다면, 아침 식사는 아닐 테니까요. 아웃바운드 연결 Windows + libpcap Bacon Sampler는 경량 아웃바운드 연결 캐처로, 네트워크 트래픽의 지글거림을 스니핑하고 "비콘 같은" 행동멀웨어가 본사로 전화하는 듯한 주기적이고 느린 콜백을 플래그합니다. 수동적으로 아웃바운드 연결과 DNS 조회를 모니터링한 후, 일정한 간격, 반복되는 목적지, 이상한 지터, 일관된 바이트 크기 등 정상적인...

EDRPrison

EDRPrison 공동 저자: @oops4githttps://github.com/oops4git EDRPrison은 합법적인 WFP 콜아웃 드라이버인 WinDivert를 활용하여 EDR 시스템을 효과적으로 무력화합니다. Shutter, FireBlock, EDRSilencer와 같은 도구에서 영감을 얻은 이 프로젝트는 네트워크 기반 우회 기술에 중점을 둡니다. 이전 도구들과 달리 EDRPrison은 내장 WFP에만 의존하는 대신 외부의 합법적인 WFP 콜아웃 드라이버를 설치하고 로드합니다. 또한 EDR 프로세스 또는 해당 실행...

EDRSilencer

EDRSilencer 폐쇄 소스 도구인 MdSec NightHawk의 FireBlock에 영감을 받아, 직접 만든 버전을 만들기로 했고, 이 도구는 Windows Filtering PlatformWFP API를 사용하여 실행 중인 EDR 프로세스의 아웃바운드 트래픽을 차단할 목적으로 만들어졌습니다. 이 도구는 다음 기능을 제공합니다: 알려진 실행 중인 EDR 프로세스를 검색하고 WFP 필터를 추가하여 아웃바운드 트래픽 차단 특정 프로세스에 대한 WFP 필터 추가 이 도구로 생성된 모든 WFP 필터 제거 필터 ID를 기반으로 특...

CVE-2026-50045

A vulnerability in Unbound allows a remote attacker to bypass upstream amplification limits by querying a deeply nested name under a DNSSEC-signed parent. This triggers excessive outbound traffic per query, potentially causing a denial of service DoS. Mitigation Restrict recursive DNS access...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the deserializeErrors function during SSR hydration. An attacker can cause unexpected constructor execution on the client, potentially resulting in...

PT-2026-64212

Name of the Vulnerable Software and Affected Versions React Router versions 6.4.0 through 7.17.0 Description In Framework Mode and Data Mode applications performing manual SSR Server-Side Rendering, a flaw exists where attacker-supplied input can overwrite specific aspects of errors caught during...

Malicious code in metrics-probe-dc85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaa3316d23c1a348fb5c68a36eb775ca51f90d0e44973508dd5a8ba5a139e932 On install, package.json declares postinstall: node run.js, which auto-executes run.js when the package is installed. run.js imports os, fs, http,...

MAL-2026-5786 Malicious code in @solana-labs/ancor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3265b293c8d6ebf4e866644687ab8bb9f03345c704acf7c885574886ad396b5b Package is published as @solana-labs/ancor — a name one character off from anchor, the well-known Solana smart-contract framework published as...

CVE-2026-42398

Server-Side Request Forgery CWE-918 in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations...

MAL-2026-4726 Malicious code in weavedb-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2da95bd75489853f6b09a9aef5a5ee03ee6715b41dac446d29f273c750027a3 package.json declares "preinstall": "./dist/runtime.node", which directly executes a 976KB Linux ELF binary at every npm install. The .node extension...

CVE-2026-42313

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the setconfigvalue API method @permissionPerms.SETTINGS in src/pyload/core/api/init.py gates security-sensitive options behind a hand-maintained allowlist ADMINONLYCOREOPTIONS. The allowlist contains...

CVE-2026-42313

Summary of CVE-2026-42313 / pyload-ng: A non-admin user with SETTINGS permission can enable a proxy and point pyload at any attacker-controlled host, causing all outbound traffic (downloads, captcha fetch, update checks, plugin HTTP calls) to be routed through that attacker. The vulnerability ste...

CVE-2026-42313 pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the setconfigvalue API method @permissionPerms.SETTINGS in src/pyload/core/api/init.py gates security-sensitive options behind a hand-maintained allowlist ADMINONLYCOREOPTIONS. The allowlist contains...

CVE-2026-42313 pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the setconfigvalue API method @permissionPerms.SETTINGS in src/pyload/core/api/init.py gates security-sensitive options behind a hand-maintained allowlist ADMINONLYCOREOPTIONS. The allowlist contains...

GHSA-PG67-9WJV-MR85 pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

Summary The setconfigvalue API method @permissionPerms.SETTINGS in src/pyload/core/api/init.py gates security-sensitive options behind a hand-maintained allowlist ADMINONLYCOREOPTIONS. The allowlist contains "proxy", "username" and "proxy", "password" — which protect the proxy credentials — but i...

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

Summary The setconfigvalue API method @permissionPerms.SETTINGS in src/pyload/core/api/init.py gates security-sensitive options behind a hand-maintained allowlist ADMINONLYCOREOPTIONS. The allowlist contains "proxy", "username" and "proxy", "password" — which protect the proxy credentials — but i...

CVE-2026-25598

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action Community Tier that allows outbound network connections to evade audit logging. Specifically, outbound traffi...

CVE-2026-25598 Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action Community Tier that allows outbound network connections to evade audit logging. Specifically, outbound traffi...

CVE-2026-25598 Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action Community Tier that allows outbound network connections to evade audit logging. Specifically, outbound traffi...

GHSA-CPMJ-H4F6-R6PQ Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

Summary A security vulnerability has been identified in the Harden-Runner GitHub Action Community Tier that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when...