{
  "date": "2026-10-25",
  "watches": [
    {
      "id": "dawn",
      "ranAt": "2026-10-25T09:43:00Z",
      "note": "Quiet watch: sources checked, nothing new in scope. PHP2Shell and Brotli threads still active with no confirmed break-ins; LiteLLM, GitLab, eMudhra and Railway threads unchanged."
    },
    {
      "id": "midday",
      "ranAt": "2026-10-25T16:05:00Z",
      "note": "Unit 42 describes a real intrusion in its PHP2Shell brief, so treat unpatched PHP as possibly compromised. Also: Wasmtime aarch64 sandbox escape, happy-dom and HF datasets code-execution bugs, and an npm Ionic/Cordova malware cluster."
    },
    {
      "id": "evening",
      "ranAt": "2026-10-25T21:57:00Z",
      "note": "No new threats in scope. PHP2Shell entry refreshed with reports of a suspected North Korea-linked scanning campaign; Brotli, LiteLLM, GitLab, eMudhra, Railway and Wasmtime threads unchanged."
    },
    {
      "id": "night",
      "ranAt": "2026-10-26T00:52:00Z",
      "note": "eMudhra thread update: Oracle's out-of-band Java fix and a pending CPython ssl denylist (CVE-2026-115557). Also an Aider config-execution bug and agent-instruction-file research; nothing critical."
    }
  ],
  "items": [
    {
      "id": "php2shell-unit42-agentic-intrusion",
      "severity": "critical",
      "kind": "vulnerability",
      "ecosystems": [
        "Runtimes",
        "Packagist"
      ],
      "packages": [
        "php < 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35"
      ],
      "title": "Update: Unit 42 describes a PHP2Shell-era intrusion that reached AD credentials within two hours",
      "summary": "Palo Alto Networks' Unit 42 updated its PHP2Shell threat brief (Oct 23, 12:30 PT) with a case in which attackers, apparently driven by an agentic AI platform, ran recon through a web shell at a European government body and obtained password hashes and MFA secrets within two hours of initial exploitation, then tried NTLM relay into Active Directory. The brief does not name the exact CVE used in that case, so treat it as strong but not definitive evidence that PHP2Shell has moved from attempts to real break-ins; our Oct 24 entry said none had been confirmed. Evening update: The Hacker News also reports that CYFIRMA tied a scanning campaign, with moderate confidence, to a suspected North Korea-linked actor probing 216 unpatched hosts in 12 countries (single source so far), and that ReliaQuest has published log artifacts for detection. Fixed PHP releases are unchanged (8.5.12, 8.4.27, 8.3.36, 8.2.35); a third flaw, CVE-2026-115560, still awaits a regular release, and neither main CVE was in CISA KEV as of this watch.",
      "action": "Assume unpatched internet-facing PHP may already be compromised: patch, then hunt for web shells and unexpected outbound connections from PHP hosts since Oct 17, and rotate credentials those hosts could reach.",
      "ids": [
        "CVE-2026-109618",
        "CVE-2026-109619"
      ],
      "sources": [
        {
          "name": "Unit 42",
          "url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/"
        },
        {
          "name": "Recorded Future",
          "url": "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation"
        },
        {
          "name": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html"
        }
      ],
      "addedAt": "2026-10-25T16:05:00Z",
      "watch": "midday",
      "thread": "php2shell",
      "status": "active",
      "exploit": true,
      "checks": [
        {
          "label": "PHP version",
          "cmd": "php -v | head -1"
        },
        {
          "label": "Recently changed PHP files in web roots",
          "cmd": "find /var/www -name '*.php' -newermt 2026-10-17 2>/dev/null | head -50"
        },
        {
          "label": "Upload-progress probes in logs",
          "cmd": "grep -rl 'PHP_SESSION_UPLOAD_PROGRESS' /var/log/nginx /var/log/apache2 /var/log/httpd 2>/dev/null"
        }
      ],
      "match": [
        "php-fpm",
        "php8",
        "mod_php",
        "frankenphp",
        "php2shell"
      ],
      "updatedAt": "2026-10-25T21:57:00Z"
    },
    {
      "id": "wasmtime-aarch64-br-table-sandbox-escape",
      "severity": "high",
      "kind": "vulnerability",
      "ecosystems": [
        "crates.io",
        "Runtimes"
      ],
      "packages": [
        "wasmtime < 36.0.19 / 48.0.7 / 49.0.4"
      ],
      "title": "Wasmtime sandbox escape on aarch64 via huge br_table (CVSS 9.9); fixed in 36.0.19, 48.0.7, 49.0.4",
      "summary": "CVE-2026-115893 (GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379), published Oct 23, is a Cranelift code-generation bug on 64-bit Arm: a Wasm br_table with roughly 256,000 or more targets can compile to a wrong jump target, letting a guest module escape the sandbox. It matters to anyone running untrusted WebAssembly with Wasmtime on aarch64, such as plugin hosts and edge or serverless platforms; x86-64 is not named as affected. Fixed releases are 36.0.19, 48.0.7 and 49.0.4, which also roll up several smaller wasmtime-wasi fixes including a symlink-rename filesystem escape (RUSTSEC-2026-0352). A related truncation bug, CVE-2026-115889, is fixed in 36.0.19 and 43.0.0. No public exploit or in-the-wild use is reported.",
      "action": "Bump wasmtime (and wasmtime-wasi) to 36.0.19, 48.0.7, 49.0.4 or later wherever you run untrusted Wasm, prioritising Arm hosts.",
      "ids": [
        "CVE-2026-115893",
        "GHSA-mghf-wjfp-p5xm",
        "RUSTSEC-2026-0379",
        "CVE-2026-115889"
      ],
      "sources": [
        {
          "name": "TheHackerWire",
          "url": "https://www.thehackerwire.com/vulnerability/CVE-2026-115893/"
        },
        {
          "name": "CVE Brief",
          "url": "https://cvebrief.com/cve/cve-2026-115893/"
        }
      ],
      "addedAt": "2026-10-25T16:05:00Z",
      "watch": "midday",
      "thread": "wasmtime-aarch64-br-table",
      "status": "patched",
      "checks": [
        {
          "label": "wasmtime in Cargo.lock",
          "cmd": "grep -A1 -E '^name = \"wasmtime(-wasi)?\"' Cargo.lock"
        },
        {
          "label": "wasmtime CLI version",
          "cmd": "wasmtime --version"
        },
        {
          "label": "Host architecture",
          "cmd": "uname -m"
        }
      ],
      "match": [
        "cranelift",
        "wasmtime-wasi"
      ]
    },
    {
      "id": "happy-dom-esm-alias-code-injection",
      "severity": "medium",
      "kind": "vulnerability",
      "ecosystems": [
        "npm"
      ],
      "packages": [
        "happy-dom >= 17.0.0 < 21.0.4"
      ],
      "title": "happy-dom import-alias injection runs code in the Node host when JS evaluation is on; fixed in 21.0.4",
      "summary": "CVE-2026-115895 (GHSA-834v-8h66-3h79, CVSS 8.8) is an incomplete fix for the earlier CVE-2026-33943: happy-dom's ESM compiler pastes an unvalidated named-import alias into generated code, so attacker-supplied module source can reach Node's process and fs APIs. It only applies when enableJavaScriptEvaluation is turned on and untrusted HTML or modules are processed, which rules out most test-runner use. The advisory metadata lists 21.0.4 as patched, though its body text says no fix was available when reported. No exploitation is reported.",
      "action": "Upgrade happy-dom to 21.0.4 or later, and keep enableJavaScriptEvaluation off for any untrusted content (for example server-side rendering or scraping).",
      "ids": [
        "CVE-2026-115895",
        "GHSA-834v-8h66-3h79"
      ],
      "sources": [
        {
          "name": "GitHub advisory",
          "url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-834v-8h66-3h79"
        },
        {
          "name": "CVE Brief",
          "url": "https://cvebrief.com/cve/cve-2026-115895/"
        }
      ],
      "addedAt": "2026-10-25T16:05:00Z",
      "watch": "midday",
      "checks": [
        {
          "label": "Installed happy-dom",
          "cmd": "npm ls happy-dom"
        },
        {
          "label": "JS evaluation enabled in code",
          "cmd": "grep -rn 'enableJavaScriptEvaluation' --include='*.js' --include='*.ts' --include='*.mjs' . 2>/dev/null | grep -v node_modules"
        }
      ]
    },
    {
      "id": "hf-datasets-pandas-pickle-rce",
      "severity": "medium",
      "kind": "vulnerability",
      "ecosystems": [
        "PyPI",
        "AI models"
      ],
      "packages": [
        "datasets <= 5.1.0"
      ],
      "title": "Hugging Face datasets runs pickled code when loading files with the pandas builder; no release fix yet",
      "summary": "CVE-2026-57845 (CVSS 8.8, published Oct 24 by VulnCheck) covers datasets.load_dataset(\"pandas\", ...), which hands user-supplied files to pandas.read_pickle, so a crafted dataset file runs code with the loader's privileges. All versions through 5.1.0 are listed as affected, a fix is proposed in PR #8879 but not released, and the researcher has published a proof of concept. Exposure is limited to pipelines that load third-party datasets through the pandas builder, but that is a common pattern in ML training jobs.",
      "action": "Do not load untrusted datasets with the pandas builder; prefer Parquet, CSV or JSON loaders and pin datasets until a fixed release ships.",
      "ids": [
        "CVE-2026-57845"
      ],
      "sources": [
        {
          "name": "CVE Brief",
          "url": "https://cvebrief.com/cve/cve-2026-57845/"
        }
      ],
      "addedAt": "2026-10-25T16:05:00Z",
      "watch": "midday",
      "exploit": true,
      "checks": [
        {
          "label": "Installed datasets",
          "cmd": "pip show datasets 2>/dev/null | grep -i '^version'"
        },
        {
          "label": "pandas builder in code",
          "cmd": "grep -rnE 'load_dataset\\(\\s*[\"'\\'']pandas' --include='*.py' . 2>/dev/null"
        }
      ],
      "match": [
        "huggingface-datasets",
        "hf-datasets"
      ]
    },
    {
      "id": "npm-ionic-cordova-malware-cluster",
      "severity": "medium",
      "kind": "malicious-package",
      "ecosystems": [
        "npm"
      ],
      "packages": [
        "appit-cordova-admob",
        "appit-cordova-plugin-ionic",
        "cordova-plugin-geofence-appit",
        "ionic-insta-search",
        "ionic-tiktok-scraper",
        "ionic-youtube-search",
        "ionic-sound-cloud-loader-api",
        "tiktok-video-scraper"
      ],
      "title": "Cluster of Ionic/Cordova and social-scraper npm packages flagged as malware",
      "summary": "On Oct 25 the GitHub Advisory Database (mirrored in OSV) published a batch of malware advisories for npm packages posing as Ionic/Cordova plugins and Instagram, TikTok, YouTube and SoundCloud helpers, including appit-cordova-admob, appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search, ionic-tiktok-scraper, insta-api-wrapper and sound-cloud-loader-api. All versions are listed as malicious and the advisories say any machine that installed them should be treated as compromised. Payload, download counts and whether this is typosquatting or a hijacked publisher are not public yet.",
      "action": "Check lockfiles for these names; if present, remove them and rotate secrets from a clean machine.",
      "ids": [
        "MAL-2026-18253",
        "GHSA-9w8h-674f-4x2j"
      ],
      "sources": [
        {
          "name": "OSV",
          "url": "https://osv.dev/vulnerability/MAL-2026-18253"
        },
        {
          "name": "Helix Threat Watch",
          "url": "https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware"
        }
      ],
      "addedAt": "2026-10-25T16:05:00Z",
      "watch": "midday",
      "checks": [
        {
          "label": "Names in lockfiles",
          "cmd": "grep -nE 'appit-cordova|cordova-plugin-geofence-appit|ionic-(insta|tiktok|youtube|sound-cloud)|insta-(api-wrapper|reel-search)|tiktok-video-scraper|sound-cloud-loader-api' package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null"
        }
      ]
    },
    {
      "id": "emudhra-oracle-java-cpython-update",
      "severity": "high",
      "kind": "advisory",
      "thread": "emudhra-ca-compromise",
      "status": "patched",
      "title": "Update: Oracle ships an out-of-band Java fix for the eMudhra roots; CPython assigns CVE-2026-115557, fix not yet released",
      "summary": "Oracle published a Security Alert on Oct 24 (CVE-2026-114820, CVSS 9.1) whose Java updates remove the affected eMudhra root CA certificates from the JDK trust store; listed as affected are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise 21.3.20. Oracle's page does not list fixed version numbers and points to its patch availability note and an eMudhra page instead, so check your vendor's build notes. Separately, CPython assigned CVE-2026-115557 (CVSS 9.4) for a defense-in-depth denylist in the ssl module that rejects any chain containing a compromised eMudhra intermediate key; the pull request is approved and marked as a release blocker with backports requested to 3.11-3.15, but it was not merged as of this watch. One aggregator claims a public proof of concept exists for the Java issue; we could not confirm that.",
      "ecosystems": [
        "Runtimes",
        "PyPI"
      ],
      "packages": [
        "java (Oracle Java SE 8u511 / 11.0.33 / 17.0.21 / 21.0.13 / 25.0.5 / 27.0.1)",
        "graalvm (for JDK 17.0.21 / 21.0.13, Enterprise 21.3.20)",
        "python < 3.16.0 (ssl denylist pending)"
      ],
      "match": [
        "jdk",
        "oracle-java",
        "cpython"
      ],
      "action": "Apply Oracle's Oct 24 Java update (or your JDK vendor's equivalent) on hosts that make TLS connections, and keep certifi and OS CA bundles current for Python until the CPython fix ships.",
      "ids": [
        "CVE-2026-114820",
        "CVE-2026-115557"
      ],
      "checks": [
        {
          "label": "Java version in use",
          "cmd": "java -version 2>&1 | head -2"
        },
        {
          "label": "eMudhra roots still in the JDK trust store",
          "cmd": "keytool -list -cacerts -storepass changeit 2>/dev/null | grep -i -A1 emudhra"
        },
        {
          "label": "Python and certifi versions",
          "cmd": "python3 --version; pip show certifi 2>/dev/null | grep -i '^version'"
        }
      ],
      "sources": [
        {
          "name": "Oracle Security Alert",
          "url": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"
        },
        {
          "name": "CPython PR #160042",
          "url": "https://github.com/python/cpython/pull/160042"
        },
        {
          "name": "CVE Brief",
          "url": "https://cvebrief.com/cve/cve-2026-115557/"
        }
      ],
      "addedAt": "2026-10-26T00:52:00Z",
      "watch": "night"
    },
    {
      "id": "aider-conf-yml-command-execution",
      "severity": "medium",
      "kind": "vulnerability",
      "title": "Aider runs shell commands from a repository's .aider.conf.yml without asking; no fixed release yet",
      "summary": "CVE-2026-115726 (CVSS 7.8, published Oct 25 via VulnCheck) affects the Aider AI coding assistant through 0.86.2: it loads a .aider.conf.yml from the working repository without a trust prompt, and values in fields such as notifications-command or editor are run through a shell. Opening Aider inside a cloned, untrusted repository can therefore run attacker commands with your privileges. The public issue was opened Oct 20 with no maintainer response or fix so far, and no exploitation or public exploit is reported.",
      "ecosystems": [
        "PyPI"
      ],
      "packages": [
        "aider-chat <= 0.86.2"
      ],
      "match": [
        "aider"
      ],
      "action": "Do not start Aider in repositories you have not reviewed; inspect any .aider.conf.yml for command-bearing keys first.",
      "ids": [
        "CVE-2026-115726"
      ],
      "checks": [
        {
          "label": "Installed Aider version",
          "cmd": "pip show aider-chat 2>/dev/null | grep -i '^version'"
        },
        {
          "label": "Repo configs with command fields",
          "cmd": "find . -name .aider.conf.yml -not -path '*/node_modules/*' -exec grep -HnE '^(notifications-command|editor):' {} +"
        }
      ],
      "sources": [
        {
          "name": "Aider issue #5885",
          "url": "https://github.com/Aider-AI/aider/issues/5885"
        },
        {
          "name": "CVE Brief",
          "url": "https://cvebrief.com/cve/cve-2026-115726/"
        }
      ],
      "addedAt": "2026-10-26T00:52:00Z",
      "watch": "night"
    },
    {
      "id": "agents-md-downloads-folder-hijack",
      "severity": "context",
      "kind": "context",
      "title": "Research: a planted AGENTS.md in ~/Downloads steered Codex into installing an npm package",
      "summary": "Forever Security reports finding a malicious AGENTS.md in a customer's Downloads folder, which was also the coding agent's working directory; the agent read it and tried to install an unvetted npm package named function-color. The researchers reproduced the technique against OpenAI Codex and showed a CLAUDE.md variant that redirected Claude Code's API traffic to a server they controlled. It relies on a browser dropping the file into Downloads and the user then starting an agent there, and the researchers say there is nothing for the vendors to patch. The takeaway for teams is to start agents only in the project they should work on and to review unfamiliar agent instruction files.",
      "ecosystems": [
        "npm",
        "Other"
      ],
      "sources": [
        {
          "name": "BleepingComputer",
          "url": "https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/"
        }
      ],
      "addedAt": "2026-10-26T00:52:00Z",
      "watch": "night"
    }
  ]
}