Malicious code in rulesdir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c805fe99761f008f2684b4317d760d59a99462becf37b554d6673444045ae3fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in no-barrel-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d26ffac772339a03c38a909739d6648394caa3bf5f5d6052d35cb5c0ef21ac33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-55018 Malicious code in graphhub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f3f531a91594ad386dc82c959af2f53b1e335972b4a7a451fe0184252616c3 The package graphhub was found to contain malicious code. Source: ghsa-malware 4b0d6ee11320721cc3e65d9887c3b251b574bc7e67419fe63dedaa18b15dad9b Any...

CVE-2025-64489 SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 contain a privilege escalation vulnerability where user sessions are not invalidated upon account deactivation. An inactive user with an...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions 7.14.7 and earlier and 8.0.0-beta.1 through 8.9.0, which stems from a user session not being disabled when the account is deactivated, which could result in elevated...

Metasploit Wrap-Up 11/07/2025

New module content 3 Centreon authenticated command injection leading to RCE via broker engine "reload" parameter Author: h00die-gr3y [email protected] Type: Exploit Pull request: 20672 contributed by h00die-gr3y Path: linux/http/centreonauthrcecve20255946 AttackerKB reference: CVE-2025-5946...

From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools

A China-linked threat actor has been attributed to a cyber attack targeting an U.S. non-profit organization with an aim to establish long-term persistence, as part of broader activity aimed at U.S. entities that are linked to or involved in policy issues. The organization, according to a report...

MAL-2025-49730 Malicious code in dandh8112 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f2bb5fabeb29dfa7cd1921c6c28f491ec017dddaae26b427f956b1f5f3c288 The package dandh8112 was found to contain malicious code. Source: ghsa-malware 439693dc034f10b79277c48f7d3457adc09a623d5d067afa83543f5393f8825e Any...

Malicious code in xss-payload-7n-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9fcaefcc21332259306a4bbad6a54cda89ef8c6d4874d5176f4bf8f9cb194c The package xss-payload-7n-ctf was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49387 Malicious code in xss-payload-7n-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9fcaefcc21332259306a4bbad6a54cda89ef8c6d4874d5176f4bf8f9cb194c The package xss-payload-7n-ctf was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49379 Malicious code in @chatclub/claude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6acfccb78a615c7f037fe5dbd1001d9a77ca4015c89c94122ba5dd78978b66b The package @chatclub/claude-code was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49366 Malicious code in mojio-client-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fea28b1c502ade1afb436a22ffc2bd83e1c413dd85b274370f805ec0760be91 The package mojio-client-lite was found to contain malicious code. Source: ghsa-malware...

Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly

Google on Wednesday said it discovered an unknown threat actor using an experimental Visual Basic Script VB Script malware dubbed PROMPTFLUX that interacts with its Gemini artificial intelligence AI model API to write its own source code for improved obfuscation and evasion. "PROMPTFLUX is writte...

Malicious code in @bbkkfkk/pre (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9c1f8ea16f76d6d90b7428b1448704b5b42f2db84e96945cc9c85237013060e The package @bbkkfkk/pre was found to contain malicious code. Source: ghsa-malware 18fa96a25503e48ec0ab99b483a5e7c4c8acd355e03c509295d39daf6509b21a A...

Lexmark Printers Improper Input Validation (CVE-2022-29850)

Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel

Microsoft has disclosed details of a novel backdoor dubbed SesameOp that uses OpenAI Assistants Application Programming Interface API for command-and-control C2 communications. "Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as ...

Aether - Adaptive Exploit and Threat Hunting Engine for EVM-based Repositories

Aether is a Python-based framework for analyzing Solidity smart contracts, generating vulnerability findings, producing Foundry-based proof-of-concept PoC tests, and optionally validating those tests on mainnet forks. It combines static analysis, prompt-driven LLM analysis, and AI-ensemble...

PT-2025-45498

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and prior SuiteCRM versions 8.0.0 through 8.9.0 Description SuiteCRM is a Customer Relationship Management CRM software application. A flaw exists where user sessions are not invalidated when an account is deactivated....

New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

The North Korea-linked threat actor known as Kimsuky has distributed a previously undocumented backdoor codenamed HttpTroy as part of a likely spear-phishing attack targeting a single victim in South Korea. Gen Digital, which disclosed details of the activity, did not reveal any details on when t...

MAL-2025-49321 Malicious code in axis-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09aeea2ea73dbe2f884c0231d608d337880bb8bfd99f38837bb012f8f952eba1 The package axis-tools was found to contain malicious code. Source: ghsa-malware aa8f4e19cbedf81f11461e5e9017bd02d7135a5f126ed59b58b3669d6a7c8156 Any...