LiveSunday, October 25, 2026·Last watch 20:52 ET
Compromised releases, malicious packages and exploited bugs that touch your dependencies and pipelines, with what to do about each. Checked four times a day.
Quiet watch: sources checked, nothing new in scope. PHP2Shell and Brotli threads still active with no confirmed break-ins; LiteLLM, GitLab, eMudhra and Railway threads unchanged.
Unit 42 describes a real intrusion in its PHP2Shell brief, so treat unpatched PHP as possibly compromised. Also: Wasmtime aarch64 sandbox escape, happy-dom and HF datasets code-execution bugs, and an npm Ionic/Cordova malware cluster.
No new threats in scope. PHP2Shell entry refreshed with reports of a suspected North Korea-linked scanning campaign; Brotli, LiteLLM, GitLab, eMudhra, Railway and Wasmtime threads unchanged.
eMudhra thread update: Oracle's out-of-band Java fix and a pending CPython ssl denylist (CVE-2026-115557). Also an Aider config-execution bug and agent-instruction-file research; nothing critical.
Threats not yet marked resolved. Open one for its full timeline.
Paste package names (one per line), or load a manifest or lockfile: package.json, package-lock.json, requirements.txt, poetry.lock, Pipfile.lock, Cargo.lock, go.mod, Gemfile.lock, composer.json. Matching entries get a "Matches your stack" label on every page, and you can filter to just those.
Your list stays in this browser (local storage). Files are read on your device and never uploaded. Matching is by package name, not version, so a match means "check this", not "you are vulnerable".
Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief (Oct 23, 12:30 PT) with a case in which attackers, apparently driven by an agentic AI platform, ran recon through a web shell at a European government body and obtained password hashes and MFA secrets within two hours of initial exploitation, then tried NTLM relay into Active Directory. The brief does not name the exact CVE used in that case, so treat it as strong but not definitive evidence that PHP2Shell has moved from attempts to real break-ins; our Oct 24 entry said none had been confirmed. Evening update: The Hacker News also reports that CYFIRMA tied a scanning campaign, with moderate confidence, to a suspected North Korea-linked actor probing 216 unpatched hosts in 12 countries (single source so far), and that ReliaQuest has published log artifacts for detection. Fixed PHP releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); a third flaw, CVE-2026-115560, still awaits a regular release, and neither main CVE was in CISA KEV as of this watch.
php < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35php -v | head -1find /var/www -name '*.php' -newermt 2026-10-17 2>/dev/null | head -50grep -rl 'PHP_SESSION_UPLOAD_PROGRESS' /var/log/nginx /var/log/apache2 /var/log/httpd 2>/dev/nullAssume unpatched internet-facing PHP may already be compromised: patch, then hunt for web shells and unexpected outbound connections from PHP hosts since Oct 17, and rotate credentials those hosts could reach.
ReferencesCVE-2026-109618, CVE-2026-109619
SourcesUnit 42, Recorded Future, The Hacker News
Oracle published a Security Alert on Oct 24 (CVE-2026-114820, CVSS 9.1) whose Java updates remove the affected eMudhra root CA certificates from the JDK trust store; listed as affected are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise 21.3.20. Oracle's page does not list fixed version numbers and points to its patch availability note and an eMudhra page instead, so check your vendor's build notes. Separately, CPython assigned CVE-2026-115557 (CVSS 9.4) for a defense-in-depth denylist in the ssl module that rejects any chain containing a compromised eMudhra intermediate key; the pull request is approved and marked as a release blocker with backports requested to 3.11-3.15, but it was not merged as of this watch. One aggregator claims a public proof of concept exists for the Java issue; we could not confirm that.
java (Oracle Java SE 8u511 / 11.0.33 / 17.0.21 / 21.0.13 / 25.0.5 / 27.0.1)graalvm (for JDK 17.0.21 / 21.0.13, Enterprise 21.3.20)python < 3.16.0 (ssl denylist pending)java -version 2>&1 | head -2keytool -list -cacerts -storepass changeit 2>/dev/null | grep -i -A1 emudhrapython3 --version; pip show certifi 2>/dev/null | grep -i '^version'Apply Oracle's Oct 24 Java update (or your JDK vendor's equivalent) on hosts that make TLS connections, and keep certifi and OS CA bundles current for Python until the CPython fix ships.
ReferencesCVE-2026-114820, CVE-2026-115557
CVE-2026-115893 (GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379), published Oct 23, is a Cranelift code-generation bug on 64-bit Arm: a Wasm br_table with roughly 256,000 or more targets can compile to a wrong jump target, letting a guest module escape the sandbox. It matters to anyone running untrusted WebAssembly with Wasmtime on aarch64, such as plugin hosts and edge or serverless platforms; x86-64 is not named as affected. Fixed releases are 36.0.19, 48.0.7 and 49.0.4, which also roll up several smaller wasmtime-wasi fixes including a symlink-rename filesystem escape (RUSTSEC-2026-0352). A related truncation bug, CVE-2026-115889, is fixed in 36.0.19 and 43.0.0. No public exploit or in-the-wild use is reported.
wasmtime < 36.0.19 / 48.0.7 / 49.0.4grep -A1 -E '^name = "wasmtime(-wasi)?"' Cargo.lockwasmtime --versionuname -mBump wasmtime (and wasmtime-wasi) to 36.0.19, 48.0.7, 49.0.4 or later wherever you run untrusted Wasm, prioritising Arm hosts.
ReferencesCVE-2026-115893, GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379, CVE-2026-115889
SourcesTheHackerWire, CVE Brief
CVE-2026-115726 (CVSS 7.8, published Oct 25 via VulnCheck) affects the Aider AI coding assistant through 0.86.2: it loads a .aider.conf.yml from the working repository without a trust prompt, and values in fields such as notifications-command or editor are run through a shell. Opening Aider inside a cloned, untrusted repository can therefore run attacker commands with your privileges. The public issue was opened Oct 20 with no maintainer response or fix so far, and no exploitation or public exploit is reported.
aider-chat <= 0.86.2pip show aider-chat 2>/dev/null | grep -i '^version'find . -name .aider.conf.yml -not -path '*/node_modules/*' -exec grep -HnE '^(notifications-command|editor):' {} +Do not start Aider in repositories you have not reviewed; inspect any .aider.conf.yml for command-bearing keys first.
ReferencesCVE-2026-115726
SourcesAider issue #5885, CVE Brief
CVE-2026-115895 (GHSA-834v-8h66-3h79, CVSS 8.8) is an incomplete fix for the earlier CVE-2026-33943: happy-dom's ESM compiler pastes an unvalidated named-import alias into generated code, so attacker-supplied module source can reach Node's process and fs APIs. It only applies when enableJavaScriptEvaluation is turned on and untrusted HTML or modules are processed, which rules out most test-runner use. The advisory metadata lists 21.0.4 as patched, though its body text says no fix was available when reported. No exploitation is reported.
happy-dom >= 17.0.0 < 21.0.4npm ls happy-domgrep -rn 'enableJavaScriptEvaluation' --include='*.js' --include='*.ts' --include='*.mjs' . 2>/dev/null | grep -v node_modulesUpgrade happy-dom to 21.0.4 or later, and keep enableJavaScriptEvaluation off for any untrusted content (for example server-side rendering or scraping).
ReferencesCVE-2026-115895, GHSA-834v-8h66-3h79
SourcesGitHub advisory, CVE Brief
CVE-2026-57845 (CVSS 8.8, published Oct 24 by VulnCheck) covers datasets.load_dataset("pandas", ...), which hands user-supplied files to pandas.read_pickle, so a crafted dataset file runs code with the loader's privileges. All versions through 5.1.0 are listed as affected, a fix is proposed in PR #8879 but not released, and the researcher has published a proof of concept. Exposure is limited to pipelines that load third-party datasets through the pandas builder, but that is a common pattern in ML training jobs.
datasets <= 5.1.0pip show datasets 2>/dev/null | grep -i '^version'grep -rnE 'load_dataset\(\s*["'\'']pandas' --include='*.py' . 2>/dev/nullDo not load untrusted datasets with the pandas builder; prefer Parquet, CSV or JSON loaders and pin datasets until a fixed release ships.
ReferencesCVE-2026-57845
SourcesCVE Brief
On Oct 25 the GitHub Advisory Database (mirrored in OSV) published a batch of malware advisories for npm packages posing as Ionic/Cordova plugins and Instagram, TikTok, YouTube and SoundCloud helpers, including appit-cordova-admob, appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search, ionic-tiktok-scraper, insta-api-wrapper and sound-cloud-loader-api. All versions are listed as malicious and the advisories say any machine that installed them should be treated as compromised. Payload, download counts and whether this is typosquatting or a hijacked publisher are not public yet.
appit-cordova-admobappit-cordova-plugin-ioniccordova-plugin-geofence-appitionic-insta-searchionic-tiktok-scraperionic-youtube-searchionic-sound-cloud-loader-apitiktok-video-scrapergrep -nE 'appit-cordova|cordova-plugin-geofence-appit|ionic-(insta|tiktok|youtube|sound-cloud)|insta-(api-wrapper|reel-search)|tiktok-video-scraper|sound-cloud-loader-api' package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/nullCheck lockfiles for these names; if present, remove them and rotate secrets from a clean machine.
ReferencesMAL-2026-18253, GHSA-9w8h-674f-4x2j
SourcesOSV, Helix Threat Watch
Forever Security reports finding a malicious AGENTS.md in a customer's Downloads folder, which was also the coding agent's working directory; the agent read it and tried to install an unvetted npm package named function-color. The researchers reproduced the technique against OpenAI Codex and showed a CLAUDE.md variant that redirected Claude Code's API traffic to a server they controlled. It relies on a browser dropping the file into Downloads and the user then starting an agent there, and the researchers say there is nothing for the vendors to patch. The takeaway for teams is to start agents only in the project they should work on and to review unfamiliar agent instruction files.
SourcesBleepingComputer
No entries for this day match those filters.
Four times a day (06:00, 12:00, 18:00 and 21:00 Eastern), Claude reads advisory and malware feeds, including cve.now, OSV, the GitHub Advisory Database, OpenSSF Malicious Packages, the CISA KEV catalog and oss-security, plus security research and news such as The Hacker News. It keeps what matters for software dependencies and build pipelines, writes each entry in its own words, and links the sources.
Entries are triage notes, not full advisories. "Am I affected?" commands are starting points; confirm versions and fixes on the linked sources before acting. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.