Malicious code in proxy-check-ii (PyPI)

Source: amazon-inspector a736498f3f882a4ba79f793dc893883db41d8cb5a74ecfe0c66dace9cc477a20 The wheel is advertised as 'proxy-check-ii' with a one-line summary of 'packaged command for running the bundled qsshd executable' and no README, homepage, source, or author metadata. It installs a 7.7MB...

Malicious code in proxy-checker-j (PyPI)

Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual payload is a Go SSH daemon qsshd that opens persistent remote...

Malicious code in proxy-check-i (PyPI)

Source: amazon-inspector 2da390c130eb840eb129a5d43faf0a64a0f0f602070243613aa0e2f8ea8f6d04 The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator persistent shell, exec, pty, and TCP port-forwarding on the...

Malicious code in myasicapi (PyPI)

Source: kam193 62067570b5217e75a025ba09e5e4f0d059439d8a7d30e056bdd501fe97e4f844 The code and related Github project promise to monitor hardware cryptominers. However, the code additionally hides two malicious capabilities functionalities: 1. acting as an attacker-controller proxy, 2. reversed she...

Malicious code in morin (PyPI)

Source: amazon-inspector 37c27d25a4c203cbb89156281fbacc7feb424a09eaa296f7c3dedff860891f1f morin/common.py hardcodes an HTTP proxy at 191.102.147.15:8000 with embedded credentials proxies = 'https': 'http://5TUMV6:[email protected]:8000' and unconditionally routes all Telegram API calls throug...

Malicious code in dbzy-tools (PyPI)

Source: amazon-inspector a0432a46ed92acb897826fc16d26cba900bd3d18f0de5baa7f2909a44d9ec625 The package advertises itself as a network debugging tool but its CLI and modules compose a remote-access toolkit. The dbzy-tools console entry calls core.startconfigurl which fetches JSON from a...

Malicious code in data-proxy-for-test (PyPI)

Source: amazon-inspector 2cb07f37b05b892d9785cc03fba0754ea4af3a50fab0ca6bb345ecac52b939a2 Package distributes as data-proxy-for-test while copying the identity author Sergey Parfenyuk, homepage/source pointing at github.com/sparfenyuk/mcp-proxy, README, and mcpproxy module layout of the legitimat...

Malicious code in chrome-stealth (PyPI)

Source: kam193 a97fed2b45bf12e5c4ba72089cdc2a1aff4ef42cb5eed242565268439946041a By using the package, the computer is attached to participate in a proxy network and share its IP and bandwidth. This is clearly stated, but the package has no real functionality besides that. Additionally, the stated...

Malicious code in ant-mcp-proxy-for-test (PyPI)

Source: kam193 51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564 During use of the package, it silently downloads and executes remote executables or scripts. During analysis, the remote resources were no longer available. The malicious action is triggered only on MacOS and the...

Malicious code in aio-http-proxy-support (PyPI)

--- Credit: OpenSSF source...

SUSE-SU-2026:22889-1 Security update for curl

This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409. - CVE-2026-8927: env-set cross-proxy Digest auth state leak...

libssh: libssh: denial of service via unchecked ProxyCommand fork() failure

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server

A flaw was found in the modproxyftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol FTP server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service DoS for the...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers

A flaw was found in Apache HTTP Server. This heap-based buffer overflow vulnerability can be exploited by a malicious backend server when using ProxyPassReverseCookie directives. This could lead to a denial of service DoS condition, making the server unavailable to legitimate users...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

EUVD-2026-46254

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

CVE-2026-59846

CVE-2026-59846 affects libssh: a flaw in ProxyCommand handling where a malicious username expanded via %r can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. No specific exploit/public-fix details are provided in the connected documents; remediat...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the ProxyCommand process when a malicious username is expanded through %r, which can inject shell metacharacters, expose environment...