New Backdoor Auto-color Linux Targets Systems in US and Asia

Auto-color: New Linux backdoor malware targeting the US and Asia. Learn about its advanced evasion, persistence, and detection…...

New Linux Malware 'Auto-Color' Grants Hackers Full Remote Access to Compromised Systems

Universities and government organizations in North America and Asia have been targeted by a previously undocumented Linux malware called Auto-Color between November and December 2024, according to new findings from Palo Alto Networks Unit 42. "Once installed, Auto-color allows threat actors full...

CVE-2025-1412 Session Persistence After User-to-Bot Conversion

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

CVE-2025-1412 Session Persistence After User-to-Bot Conversion

Mattermost versions 9.11.x = 9.11.6, 10.4.x = 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot...

Malicious code in string-width-aliased (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da87811ca5c10d2b1336d454f91e621244269510433b79f3e5365176b8bcbe59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gurubu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4e2206593db7db1c14c4f78386bcef91c603218c4c26feda8f080978f342cbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in get-gas-oracle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa46803ba15ebf06b3d92214a74ba203e31af1ed6ec4c410412efccd009dd0e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-native-android-library-simpl-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4460dc946645a2b0bcd6489a7ae7a24c7c2803c369d27f2efa3de46ab7735558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opensource.razorpay.dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24d0cff23cd279c7679ff230e73f2030f97701dd01f54be53b182dbcf72e7dcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Uncovers New XCSSET macOS Malware Variant with Advanced Obfuscation Tactics

Microsoft said it has discovered a new variant of a known Apple macOS malware called XCSSET as part of limited attacks in the wild. "Its first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies,"...

Malicious code in uyurettrtrtst (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f69974d01d68b2e9cd5e64fdd40891f5a03977026f82ced386274cf20c966e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pionex-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fdba857c815f2790dc98795d90b7549921706c69ae2d250aedff3f22eae169c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in weex-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5dc8201c1f5628c039b881bee7d0251b1034d1ad7a7ef923c7e8e2d83d2bd28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fameex-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30866b33f1946c32827bc503bff079d415f3accdf1edfd777dbdf21d357c1201 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in orangex-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e602f5938bee28a86f24337d394cf7720c3354700e633b8fb0d3ab2c13a83c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in orangex-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d75dcd0936faaa1ade20abad6c214921354886d0070329789e51d75e0a82c48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in p2pb2b-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59f7063c9fcff0127b36c127dedd6b0a9f5ea43bc5ae8534adea55a756413730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yizhifabao60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32fa0d2dfcf257bafeb5a31945cec97ee3b47588cb115fe2f8dc52e8df6f4374 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yizhifabao59 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dbe805e6d76dac9bacdd03a8404a4b9f868d77ceee1f73c59eeb698092b5768 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ABB Cylon FLXeon 9.3.4 Session Persistence Vulnerability

ABB Cylon FLXeon version 9.3.4 has an issue where user sessions on controllers remain active for up to seven days, even after a client-side logout. ABB Cylon FLXeon 9.3.4 Session Persistence Vulnerability Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FB...