# Threat Watch by Helix

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1848 incidents, 75 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 1041 incidents, 52 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 109 incidents, 96 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (223)

### [critical] Malicious PyPI packages twitter-request-diagnostics and test-01-rafamarrara-learning-dc backdoor web apps
https://helix.ml/threat-watch/i/malicious-pypi-packages-twitter-request-diagnostics-and-test-01-rafamarrara-learning-dc-backdoor-web-apps · Supply chain · no-fix-needed · since 2026-10-30
Two malicious PyPI packages, twitter-request-diagnostics and test-01-rafamarrara-learning-dc (both version 1.0.0), were published and documented by OpenSSF malicious-packages and the GitHub Advisory Database on 2026-10-30 as part of campaign 2026-10-test-01-rafamarrara-learning-dc. Both pose as web middleware adding a diagnostic endpoint but actually exfiltrate environment variables (stealing secrets such as API keys and credentials) and contain hidden backdoor functionality allowing remote execution of attacker-sent commands. Any developer or application that installs either package is exposed to credential theft and remote code execution. No patched versions exist; the packages are malware and must be removed entirely rather than upgraded.
Do: Immediately remove twitter-request-diagnostics and test-01-rafamarrara-learning-dc from all environments and dependency manifests; Rotate all secrets, API keys, and credentials that could have been exposed via environment variables on affected systems; Audit systems where the packages ran for signs of command execution or unauthorized access; Check CI/CD pipelines and lockfiles for the packages and block them in dependency scanning; Report any installs to your security team and monitor for related campaign packages

### [critical] Linux kernel TCP use-after-free race (MPTCP-linked root exploit) — Ubuntu/RHEL unpatched (CVE-2026-98432)
https://helix.ml/threat-watch/i/linux-kernel-tcp-use-after-free-race-mptcp-linked-root-exploit-ubuntu-rhel-unpatched-cve-2026-98432 · Vulnerabilities · partial · since 2026-10-29 · CVE-2026-98432
A use-after-free race condition in the Linux kernel's IPv4 TCP handshake code (introduced in Linux 4.4, fixed upstream Oct 5) lets a remote unauthenticated attacker who can reach an exposed TCP service win a race to leak kernel memory (bypassing KASLR) and overwrite a callback pointer to execute arbitrary commands as root. Anthropic reported its Claude AI model wrote a working exploit (48 min to leak an address, 5 min to root) targeting servers with a multipath TCP listener; IPv6 is unaffected. Kernel team scores it 9.8; Red Hat, Oracle, SUSE and Amazon score 5.9–8.1. Debian, Oracle, SUSE and Amazon have shipped fixed kernels; Ubuntu and RHEL have not as of Oct 29, 2026.
Fixed: Upstream fix applied Oct 5, 2026 and backported to all maintained stable branches; Amazon Linux 2023 kernel6.18-6.18.56-125.164.amzn2023 and kernel6.12-6.12.113-138.209.amzn2023; Debian linux 6.12.113-1 and 6.1.190-1; SUSE kernel-default 6.12.0-160000.40.1 or later
Do: Check whether your distribution/kernel has shipped the CVE-2026-98432 fix and apply the vendor kernel update as soon as available (Debian, Oracle, SUSE, Amazon fixes already out); Until patched, restrict exposure of TCP services, especially any using multipath TCP (MPTCP), via firewalling/ACLs; Disable or avoid MPTCP listeners on internet-facing Linux servers where feasible; Monitor kernel/distribution advisories (ALAS2023-2026-3251/3335, ELSA-2026-500397/98/99, DSA-6568-1, DLA-4841-1/4850-1) and vendor status pages for fix releases; Watch for signs of exploitation: unexpected kernel crashes or root-level compromise on hosts with exposed TCP/MPTCP services

### [high] VAPOR PANDA (China-nexus) used ARTEX AI agents running DeepSeek to target 200+ organizations in 11 days, compromising at least nine (no CVE)
https://helix.ml/threat-watch/i/vapor-panda-china-nexus-used-artex-ai-agents-running-deepseek-to · Breaches · no-fix-needed · since 2026-10-29
CrowdStrike reported on Oct 29, 2026 that VAPOR PANDA, a China-nexus espionage group active since 2021, ran the ARTEX agentic AI pentest framework against more than 200 organizations in at least 14 countries during an 11-day campaign that began Oct 17, 2026. The ARTEX agents ran mainly on the Chinese DeepSeek LLM, with a second subscription-based commercial model that CrowdStrike could not confirm. CrowdStrike OverWatch confirmed post-exploitation activity at nine organizations. They include two Latin American foreign ministries, with a third likely compromised, a Middle East interior ministry, a Greek government entity, telecoms in the US, Belgium and the Philippines, and two US pharmaceutical companies. At least 12 more organizations faced password spraying or credential scanning. The targets also included semiconductor, defense, nuclear, financial and think-tank organizations. Initial access came from several routes: an unsigned SAML assertion combined with an XXE flaw, which was then used to query the cloud metadata service for a role that could run commands on thousands of instances; web shells plus an unauthenticated orchestration service, which gave root in a production container environment; a 2022 directory export with unrotated keys, used to forge an admin token; VPN configs and a client key recovered from old mail leaks; and password spraying. Follow-on steps included LAPS password reads, resource-based constrained delegation abuse, mailbox access, JSP/PHP web shells, and the BLOODALCHEMY backdoor at two ministries. A human operator steered the agents in Chinese and had them look for Windows hosts without an EDR sensor. One intrusion's planning agents consumed about 1.4 billion input tokens. No CVE or product patch is named; the fixes are key rotation, SAML and IMDS hardening, and EDR coverage. CrowdStrike says this activity is separate from the ARTEX use Microsoft attributes to Storm-0940 in the ConnectWise Cloud Backup compromise, which suggests that several China-nexus actors have adopted the framework.
Do: Rotate signing keys, Kerberos preauthentication keys and service credentials after any suspected exposure, including keys that sit in backups and old directory exports; Enforce SAML signature validation on every service provider and reject unsigned assertions; Require IMDSv2 on cloud instances and restrict which roles may send commands to instances (for example SSM Run Command); Hunt for ARTEX markers: command lines containing 'artx' or 'artex', cloud roles with an 'artx' prefix, 'art18-' comments, and C:\ProgramData\artx5v\; Block or hunt the C2 domains published by CrowdStrike (nginxmysql[.]com, sqlserver-sqlite[.]com, www[.]ddduuuppp[.]com) and look for Chisel, SoftEther and Tor tunnels; Deploy EDR to every host, internal-only servers included; the operator specifically searched for Windows machines without a sensor; Patch internet-facing appliances and long-lived Linux servers, and review VPN configs or keys that have leaked by email

### [high] ARTEX AI-driven attacks: ConnectWise Cloud Backup supply-chain compromise and suspected same-actor 123 Reg breach (no CVE)
https://helix.ml/threat-watch/i/storm-0940-artex-ai-driven-supply-chain-attack-connectwise-cloud-backup-china-aligned-actor-compromised-m365-tenants-via · Supply chain · no-fix-needed · since 2026-10-21
Microsoft attributed a supply-chain attack on ConnectWise Cloud Backup customers' Microsoft 365 environments to China-state-aligned Storm-0940, active since 2021. From September 2026 the group used ARTEX, an open-source LLM-driven agentic penetration-testing framework, to automate reconnaissance, password spraying and OAuth abuse. After a four-day campaign (ending Oct 14) against 327 M365/Exchange Online accounts across eight organizations with 151,000+ failed logons peaking at 2,900/minute, Storm-0940 compromised ConnectWise Cloud Backup the next day, reaching 2,250+ tenants; AI agents performed directory reconnaissance, modified application credentials for persistence, and altered identities, groups and privileged roles. ConnectWise shut down services Oct 17 and began phased restoration Oct 21. Separately, UK registrar 123 Reg disclosed a Sept 18 'AI-driven' attack exposing customer contact, VAT and product data, with artifacts (mirrored Anthropic skills, Chinese/Singapore-hosted infrastructure) suggesting the same ARTEX-using China-nexus actor CrowdStrike tracked (CSA-261162) against South Korean financial firms.
Do: Review Microsoft 365 audit logs for anomalous sign-ins, OAuth application consent, and application credential modifications since early September 2026; Rotate credentials and re-authorize or remove suspicious OAuth/enterprise applications, especially those tied to ConnectWise Cloud Backup; Keep ConnectWise Cloud Backup connections disabled per vendor guidance until phased restoration completes and integrity is confirmed; Harden against AI-automated password spraying: enforce MFA/2SV, conditional access, and rate-limit/lockout monitoring at scale; Monitor Microsoft Graph and directory operations for persistence mechanisms, privileged role changes, and backdoor creation; For 123 Reg customers: enable two-step verification and treat unsolicited communications claiming to be from 123 Reg with caution; Track Microsoft Threat Intelligence and CrowdStrike (CSA-261162) guidance on ARTEX-based agentic attack activity

### [critical] npm malware: dowload_ebok_armageddon_by_max_hastings_kv3s4 — malicious package fully compromises installed machines
https://helix.ml/threat-watch/i/npm-malware-dowload-ebok-armageddon-by-max-hastings-kv3s4-malicious-package-fully-compromises-installed-machines · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-p6mc-228w-6q75 on 2026-10-29 flagging the npm package dowload_ebok_armageddon_by_max_hastings_kv3s4 as embedded malicious code (CWE-506). The package, apparently a fake ebook-download lure, has no legitimate source code and no patched versions; all versions (>= 0) are affected. GitHub states any computer with the package installed or running should be considered fully compromised, with attackers potentially having full remote control and access to secrets and keys. Downloads are low (~10/month), limiting reach, but any installation is treated as an active compromise. There is no fix; the only remediation is removal plus incident response, since uninstalling may not remove all malicious software.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer; Isolate and reimage/rebuild affected machines rather than relying on uninstalling the package; Audit dependency locks and CI caches for the package name and block it in registries/proxies; Review logs and network traffic for signs of attacker access following installation

### [critical] Malicious npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-reiki-sviluppa-e-usa-lenergia-reiki-by-matt-harvey-9q55p-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-h86m-7gvf-j79h on 2026-10-29 flagging the npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p as embedded malicious code (CWE-506). The package, apparently a typosquat-style ebook downloader, receives roughly 9 downloads per month and every version (>= 0) is affected with no patched version available. GitHub states any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional malware that persists after package removal. No fix exists; remediation is removal plus credential rotation.
Do: Treat any machine where the package was installed as fully compromised; rotate all secrets and keys from a clean machine; Remove the package and rebuild/reimage affected systems; Audit npm dependency trees and lockfiles for the package name; Check for persistence mechanisms and follow-up malware on affected hosts; Block the package in internal registries and CI

### [critical] Malicious npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t fully compromises hosts
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-nur-mal-schnell-das-mammut-retten-by-knut-kruger-eva-schoffmann-davidov-ouz6t-fully-c · Supply chain · no-fix-needed · since 2026-10-29
GitHub published advisory GHSA-5cmc-vx46-22wx on 2026-10-29 flagging the npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t as malware (CWE-506, embedded malicious code). All versions (>=0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. The package appears to be a fake ebook-download package with very low reach (~7 downloads/month). Removal of the package does not guarantee removal of all malicious software, so affected machines require full remediation. No CVE is assigned; the package should be treated as compromised infrastructure rather than a vulnerable dependency.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, from a clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit dependency trees and lockfiles for the package name and block it in registry proxies/allowlists; Review access logs and network activity from affected hosts for signs of attacker control; Report any related compromise indicators to your security team and GitHub/npm

### [critical] Malicious npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-el-piso-mil-el-piso-mil-1-by-katharine-mcgee-h1llc-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-j272-m9j4-g3v9 on 2026-10-29 flagging the npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. All versions (>= 0) are affected and no patched version exists. The package appears to be a fake ebook-download package with very low usage (~2 downloads/month), typical of typosquat or SEO-lure malware. No CVE is assigned; the advisory is reviewed malware classification.
Do: If the package is installed, treat the machine as fully compromised and rotate all secrets and keys immediately from a clean computer; Remove the package and rebuild/reimage affected machines rather than relying on uninstall; Audit npm lockfiles and CI caches for the package name and block it in dependency firewalls/allowlists; Review systems for persistence and unauthorized access following exposure

### [critical] Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-lolita-by-vladimir-nabokov-oy1gy-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub's advisory database published a malware advisory (GHSA-cjmr-6xg2-vf8h) for the npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy, an ebook-download-themed package containing embedded malicious code (CWE-506). All versions (>= 0) are affected and there are no patched versions; the package will not be fixed. GitHub states that any computer with the package installed or running should be considered fully compromised, with attacker control of the machine, so secrets and keys stored on it must be treated as stolen. Reach appears limited (~7 downloads/month), but any installation grants full control to an outside entity. Removal of the package does not guarantee removal of the malicious software it installed. Affected users should treat the host as breached and rotate all credentials from a clean machine.
Do: Immediately isolate and rebuild any machine where the package was installed or run; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer; Remove the package and audit for persistence mechanisms and additional malware it may have deployed; Review npm dependency trees and lockfiles for the package and block it in registries/proxies; Check access and CI logs for signs of attacker activity following installation

### [medium] Amadeus IT Group breach leaks 92,000 Japan Airlines customer reservation records
https://helix.ml/threat-watch/i/amadeus-it-group-breach-leaks-92-000-japan-airlines-customer-reservation-records · Breaches · no-fix-needed · since 2026-10-28
Japan Airlines disclosed that Amadeus IT Group, which operates its flight reservation, ticketing and check-in systems, suffered a breach exposing reservation data for 92,000 JAL and Japan Transocean Air customers, including names, reservation codes and flight information. For about 2,000 customers, passport numbers, frequent flyer numbers, email addresses and phone numbers were stolen. Flight operations were unaffected and credit card numbers were not compromised. The breach is part of a wave of attacks on Japanese firms (Sony Network Communications ISP, Burger King Japan, Capcom), prompting emergency measures from PM Takaichi's government. JAL will contact affected customers individually with anti-phishing guidance; no fix applies beyond Amadeus's own response.
Do: Monitor for phishing and social engineering targeting customers using stolen reservation and passport data; Review third-party/IT-provider access to customer reservation data and enforce least privilege; Notify affected customers per regulatory requirements and warn against impersonation scams; Verify Amadeus's containment status and contractual incident-response obligations

### [medium] Suspected hack behind military base freezer failures — US Pentagon bases food spoilage, linked to French supermarket attack
https://helix.ml/threat-watch/i/suspected-hack-behind-military-base-freezer-failures-us-pentagon-bases-food-spoilage-linked-to-french-supermarket-attack · Breaches · no-fix-needed · since 2026-10-29
The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, per Reuters sources. Officials treat the incidents as a possible hack and are coordinating with French investigators following a similar freezer-failure attack on a supermarket in France, suggesting a common actor or technique targeting refrigeration/OT systems. The attack caused physical supply-chain impact — spoiled food at military installations — rather than data theft. No CVE is involved; no technical details, attribution, or remediation have been published. Investigation is ongoing as of 2026-10-29.
Do: Review network segmentation and remote access for building management and refrigeration control systems at facilities; Monitor OT/BMS controllers for anomalous commands or firmware changes; Coordinate with DoD/cert authorities on indicators once released; Assess food supply integrity and contingency stock at affected sites; Harden vendor remote-maintenance access paths to cold-chain equipment

### [critical] WordPress 7.1.4: unauthenticated race condition in core update process enables RCE; exploitation attempts detected
https://helix.ml/threat-watch/i/wordpress-7-1-4-unauthenticated-race-condition-in-core-update-process-enables-rce-exploitation-attempts-detected · Vulnerabilities · patched · since 2026-10-29
WordPress 7.1.4 was released on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. Wordfence reports that threat actors are already actively attempting to exploit the flaw following the release, making rapid patching urgent. All self-hosted WordPress sites that have not yet updated to 7.1.4 are affected. Site owners should verify their WordPress version and update immediately, as exploitation attempts were detected after the release.
Fixed: 7.1.4
Do: Verify your WordPress version and update to 7.1.4 immediately; Check logs for exploitation attempts against the update process; Ensure automatic updates for minor/security releases are enabled; Review site integrity and look for signs of compromise

### [high] Navigate360 school-safety tipline data breach — Crime Stoppers suspend use amid poor transparency
https://helix.ml/threat-watch/i/navigate360-school-safety-tipline-data-breach-crime-stoppers-suspend-use-amid-poor-transparency · Breaches · no-fix-needed · since 2026-10-27
Navigate360, which operates school-safety and Crime Stoppers tiplines, suffered a data breach whose details the company has not transparently disclosed. Following investigative reporting by Valérie Ouellet and Michelle Allan into the Crime Stoppers data, multiple Ontario Crime Stoppers organizations, including Toronto Crime Stoppers, suspended use of Navigate360 tiplines, citing the breach and an unacceptable incident response. U.S. state education departments are collaborating to seek answers from the vendor. Affected parties include students, tipsters, and organizations relying on the tipline service; data exposed in the breach may include tipline submissions. No fix applies; remediation depends on the vendor providing disclosure and organizations deciding whether to continue using the service.
Do: Suspend or disable Navigate360 tipline use until the vendor provides a credible breach disclosure; Notify potentially affected tipsters and comply with breach-notification obligations; Assess what data your organization shared with Navigate360 and exposure risk; Demand contractual transparency and incident-response commitments from the vendor; Evaluate alternative tipline providers

### [critical] 2026-10-bq-helix-recon: bq-helix-build-hook-6ade983e / bq-helix-recon-6ade983e PyPI packages — infostealer executes on install and every Python startup, exfiltrating credentials and cloud tokens
https://helix.ml/threat-watch/i/2026-10-bq-helix-recon-bq-helix-build-hook-6ade983e-bq-helix-recon-6ade983e-pypi-packages-infostealer-executes-on-instal · Supply chain · no-fix-needed · since 2026-10-29
Two malicious PyPI packages, bq-helix-build-hook-6ade983e and bq-helix-recon-6ade983e, were published to the GitHub Advisory Database on 2026-10-29 as part of the 2026-10-bq-helix-recon campaign. bq-helix-build-hook-6ade983e (0.1.0) runs an infostealer during installation, collecting credential files, environment variables and cloud metadata endpoint data before exfiltrating it. bq-helix-recon-6ade983e (0.1.0, 0.1.2) additionally drops PTH/sitecustomize files that trigger the malicious code on every Python startup, giving persistence beyond the initial install. Both abuse the .pth mechanism and exfiltrate cloud tokens, generic data, environment variables and credentials. No patched versions exist; any installation of these packages constitutes compromise of the build or runtime environment.
Do: Immediately uninstall and purge bq-helix-build-hook-6ade983e and bq-helix-recon-6ade983e from all environments and CI caches; Rotate all credentials, cloud tokens and API keys present on affected machines, including cloud metadata-issued tokens; Rebuild affected environments from clean images; remove any .pth or sitecustomize files the packages dropped; Audit pip install logs and dependency lockfiles for these package names; Block the package names in PyPI proxies/mirrors and dependency-scanning tooling

### [high] Icepick: DHS/Okta SSO — hacktivists leak 41,000 DHS employee records incl. undercover ICE agents
https://helix.ml/threat-watch/i/icepick-dhs-okta-sso-hacktivists-leak-41-000-dhs-employee-records-incl-undercover-ice-agents · Breaches · no-fix-needed · since 2026-10-29
A hacktivist group calling itself the Department of Peace leaked records of more than 41,000 DHS employees — names, offices, contact details and assignments — to DDoSecrets and hacker maia arson crimew, who published the 'Icepick' dataset on October 28, 2026. The group says the data came from an Okta single sign-on service used by DHS; Okta denies its systems were breached. Reuters verified details for several employees. A searchable tool at icepi.cx indexes 41,191 people and 55,603 internal groups, exposing HSI certified undercover agents, use-of-force instructors tied to ICE shootings, and operational group names. DHS says it is aware of a potential breach and is investigating. This is the third major federal data leak in about a month, following FBI and Pentagon incidents.
Do: Treat leaked DHS contact data as public; assume targeted phishing, doxxing and social engineering against staff, especially those in undercover or sensitive roles; Review and rotate credentials, tokens and sessions tied to the affected Okta SSO tenant; audit for unauthorized access; Harden identity provider logging, MFA and privileged access monitoring across DHS agencies; Assess operational risk to personnel named in undercover, use-of-force and intelligence groups and consider protective measures; Monitor for follow-on leaks or extortion referencing the dataset

### [high] Florida Department of Education student financial aid breach — unauthorized access may expose data of ~4.9 million people
https://helix.ml/threat-watch/i/florida-department-of-education-student-financial-aid-breach-unauthorized-access-may-expose-data-of-4-9-million-people · Breaches · no-fix-needed · since 2026-10-29
The Florida Department of Education disclosed that staff learned of unauthorized criminal access to its Florida Student Financial Aid website on October 19, 2026. The breach may have exposed personal information — including Social Security numbers — belonging to approximately 4.9 million people, making it one of the larger state education-sector breaches. The department activated its cybersecurity incident response upon discovery. Details on the attack vector, threat actor, and exact data types exposed have not been publicly confirmed, and the full scope remains under investigation. Affected individuals are users of Florida's state student financial aid programs. No patch applies; remediation centers on incident response, forensics, and notification to affected individuals.
Do: Monitor for follow-up notifications from the Florida Department of Education and enroll in any offered credit monitoring or identity protection; Place fraud alerts or credit freezes with the major credit bureaus given potential SSN exposure; Watch for phishing or scams that reference the breach or student aid applications; Organizations in the education sector should review web application access controls, monitoring, and incident response plans for similar aid/portal systems

### [medium] RIZAP: employee uploaded 726 members' health records to personal generative AI chat
https://helix.ml/threat-watch/i/rizap-employee-uploaded-726-members-health-records-to-personal-generative-ai-chat · Breaches · no-fix-needed · since 2026-10-29
On 20 August 2026 an employee of RIZAP Inc., a Japanese fitness and health-guidance group, extracted records from the health-guidance management system RIZAP operates for insurers and uploaded them to a generative AI service on a personal account that the company had never approved. The records covered 726 members of insurers using the service, exposing health-related personal data to a third-party AI platform outside corporate control. The incident is insider misuse rather than an external attack; no CVE or vendor patch applies. Remediation centres on policy enforcement, DLP, and AI access controls rather than software fixes.
Do: Review and restrict use of unapproved generative AI services on corporate systems and accounts; Deploy DLP/egress monitoring to detect bulk extraction of member records; Audit employee access to the health-guidance management system and enforce least privilege; Notify affected insurers and members as required by Japanese privacy law; Provide staff training on handling health data and approved AI tooling

### [high] UNM Health Sciences Center cyberattack: extortion group BYOD claims theft of student/employee PII, EHR data
https://helix.ml/threat-watch/i/unm-health-sciences-center-cyberattack-extortion-group-byod-claims-theft-of-student-employee-pii-ehr-data · Breaches · no-fix-needed · since 2026-10-26
UNM Health Sciences Center reports a cyberattack that its IT team detected at about 11:30 a.m. on Monday 2026-10-26, according to the Daily Lobo as reported by Help Net Security. Staff were told to shut down and unplug computers, and the center announced the incident at 2:30 p.m. MDT. Ambulances were diverted to health systems in Albuquerque and Santa Fe for about two hours on Monday, and outpatient surgeries and appointments were suspended for the rest of that day. All UNM hospitals were open on Monday, clinics were to resume appointments on Tuesday, and classes at four colleges stayed canceled that day. Reports say a synthetic voice message played on hospital computers claimed theft of student and employee data, SSNs and documents; this is reported, not confirmed. The BYOD group, which The Record describes as a new ransomware gang, claimed on its leak site on Monday evening: 36,000 machines compromised on the main campus and hospital; two Oracle databases; the Entra tenant; Banner student records; HR and payroll data; and Cerner EHR rosters. These are unconfirmed claims. The 36,000 figure counts machines, not people. UNM says it notified state and federal law enforcement and that the matter is an active investigation. Whether ransomware was used is unclear.
Do: Treat the incident as a likely large-scale PII breach; prepare identity-protection and notification processes for patients, employees, and students pending confirmation; Hunt for attacker persistence across the Windows/Entra environment before trusting restored systems; rotate credentials, tokens, and service accounts; Verify integrity of Oracle, Banner, and Cerner data and review access logs for exfiltration; Monitor BYOD leak site for data publication and validate any claims against internal evidence; Coordinate with law enforcement before public disclosure; preserve forensic evidence

### [critical] PHP2Shell / Fragnesia: Palo Alto Networks PAN-OS management interfaces — China-linked actors chain PHP RCE with kernel privesc to root firewalls (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300)
https://helix.ml/threat-watch/i/php2shell-fragnesia-internet-facing-firewalls-china-linked-hackers-chain-php-rce-with-linux-kernel-privesc-to-root-firew · Breaches · partial · since 2026-10-28 · CVE-2026-109618, CVE-2026-109619, CVE-2026-46300
Dream reported a suspected China-nexus actor chaining two unauthenticated PHP RCE flaws (PHP2Shell, CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300, CVSS 7.8) to root internet-facing firewalls and deploy PHP root webshells. Using FOFA, attackers identified ~19,000 firewalls from one vendor, filtered targets in the US, Japan, Taiwan and South Korea running newer PHP, and on October 23-24 exploited 25 devices, rooting 24, including three systems tied to a US government-affiliated environment. On two of those they deployed a reverse SSH tunnel, pivoted to an internal firewall management server, stole configurations and credentials, decrypted an LDAP service account password, enumerated the domain, password-sprayed, and attempted AD backdoor accounts. Palo Alto Networks confirmed active exploitation against internet-exposed PAN-OS management interfaces; PHP fixes shipped October 21, 2026 (8.5.12, 8.4.27, 8.3.36, 8.2.35), and PAN-OS fixes are rolling out with some versions still pending. CISA added CVE-2026-46300 to KEV with a October 31, 2026 deadline for federal agencies.
Fixed: PAN-OS 12.2.4-h1; PAN-OS 12.1.4-h13; PAN-OS 12.1.7-h11; PAN-OS 12.1.10-h3; PAN-OS 11.2.4-h23; PAN-OS 11.2.7-h23; PAN-OS 11.2.10-h16; PAN-OS 11.2.13-h4; PAN-OS 11.2.16-h1; PAN-OS 11.1.4-h38; PAN-OS 11.1.6-h40; PAN-OS 11.1.7-h12
Do: Immediately restrict PAN-OS/Panorama management interface access to trusted internal IPs and remove management interfaces from the public internet; monitor for FOFA-indexed exposure; Upgrade PAN-OS to fixed versions where available (e.g. 12.2.4-h1, 12.1.4-h13, 11.2.4-h23, 11.1.4-h38, 10.2.7-h39) and apply remaining fixes as released; patch PHP to 8.5.12/8.4.27/8.3.36/8.2.35 and apply Fragnesia kernel fixes; Where fixes are unavailable, apply Palo Alto mitigations: route MGT traffic through a DP port, replace inbound management certificates, decrypt inbound management traffic, and enable threat prevention on management services; Check firewalls and PHP-enabled services for PHP root webshells and reverse SSH tunnels; review management server access logs and configurations for tampering; Rotate credentials stored on firewall management servers, including LDAP service accounts, and audit AD for suspicious or backdoor accounts

### [medium] Amadey botnet: Australian Signals Directorate severs C2 access to ~180,000 infected computers
https://helix.ml/threat-watch/i/amadey-botnet-australian-signals-directorate-severs-c2-access-to-180-000-infected-computers · Breaches · no-fix-needed · since 2026-10-29
The Australian Signals Directorate gained access to the backend of the Amadey malware operation and disconnected its command-and-control server from roughly 180,000 infected victim computers, cutting criminals' remote access to those machines. Amadey is a commodity malware loader used to deliver additional payloads such as infostealers and ransomware. The victims are a large, anonymous, multinational set of compromised computer owners rather than a single named organisation. The action is a disruption, not a vendor fix: infected hosts remain compromised locally, and the underlying infections that allowed Amadey in still need remediation. No CVE applies; exploitation was ongoing in the wild until the takedown.
Do: Check endpoints for Amadey and other malware indicators and fully remediate any infections rather than assuming disconnection from C2 means clean; Harden initial-infection vectors Amadey typically uses (phishing, cracked software, exposed RDP) with MFA, patching, and RDP restrictions; Monitor for reconnection attempts to known Amadey C2 infrastructure and block related indicators; Report suspected infections to national CERT/authorities to support further disruption efforts

### [high] Frontline Education breach: Student SSNs, Medicaid IDs and DOBs exposed via Frontline Central and School Health Management
https://helix.ml/threat-watch/i/frontline-education-breach-student-ssns-medicaid-ids-and-dobs-exposed-via-frontline-central-and-school-health-management · Breaches · no-fix-needed · since 2026-10-29
Frontline Education announced on Oct. 26, 2026, a cybersecurity incident affecting its Frontline Central and School Health Management products, which are used by school districts to manage employee and student health records. Data exposed may include Social Security numbers, dates of birth, and government ID numbers, including Medicaid IDs, for both adults and minors whose information was processed through these products. The vendor has not publicly detailed how the intrusion occurred, how many individuals or districts are affected, or whether data was exfiltrated. Affected individuals are being notified; no fix applies beyond the vendor's incident response, so organizations using the products should monitor vendor advisories and notifications.
Do: Check whether your district uses Frontline Central or School Health Management and await/verify vendor breach notifications; Identify affected students and staff and prepare identity-protection and notification obligations under FERPA/state breach laws; Monitor Frontline Education advisories for scope updates and indicators of compromise; Review access to and data sharing with Frontline products; consider credential resets for district accounts; Prepare communications for parents/guardians of minors whose SSNs or Medicaid IDs were exposed

### [critical] Malicious npm package react-native-drago-callkit — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-react-native-drago-callkit-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-jp74-4rg3-7ppj on 2026-10-29 flagging the npm package react-native-drago-callkit as containing embedded malicious code (CWE-506). Affected versions are 0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.15 and 1.0.16, with no patched versions available. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the code grants outside parties full control of the machine. All secrets and keys on affected machines should be treated as stolen. No source code repository is known for the package. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove the malicious software.
Do: Immediately remove react-native-drago-callkit from all projects, lockfiles and CI pipelines; Treat every machine that installed or ran the package as fully compromised; rotate all secrets, keys and credentials from a clean machine; Rebuild affected machines and audit for persistence mechanisms and residual malware; Audit npm dependency trees and lockfiles for the package and block it in registry/proxy allowlists; Review access logs and network egress for signs of exfiltration since installation

### [critical] Malware in orderbook-volt-plugin npm package — full machine compromise
https://helix.ml/threat-watch/i/malware-in-orderbook-volt-plugin-npm-package-full-machine-compromise · Supply chain · no-fix-needed · since 2026-10-29
GitHub published a malware advisory (GHSA-w9pq-6r9f-pj96) for the npm package orderbook-volt-plugin, flagged as CWE-506 embedded malicious code. Versions 0.0.0-stage, 0.0.1 and 0.0.2 are affected, with no patched versions available and no known source code. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers gained full control and can access secrets, keys and data. All users of the package are affected; the only remediation is removal plus credential rotation from a clean machine, since removal cannot guarantee elimination of all malicious software.
Do: Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer; Remove the package and audit affected machines for persistence; consider rebuilding from trusted images; Check npm lockfiles and CI/CD environments for the package and any versions of it; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — auth-bypass exploited to steal AES traffic keys via Volt Typhoon-linked 'Silent Train' infrastructure (CVE-2026-20127)
https://helix.ml/threat-watch/i/keydrift-uat-11473-cisco-catalyst-sd-wan-attackers-exploited-auth-bypass-flaw-to-steal-aes-traffic-keys-cve-2026-20127 · Breaches · patched · since 2026-10-29 · CVE-2026-20127
Cisco Talos reported that attackers exploited CVE-2026-20127, a CVSS 10.0 unauthenticated auth-bypass flaw in Cisco Catalyst SD-WAN controller components, to deploy a malware framework dubbed KeyDrift. On Controllers, LittleFilch hooks vdaemon to capture AES-256 traffic-encryption keys, exfiltrating them RSA-encrypted via UDP; on Validators a fake aaamgr loads PolyFlame, an in-memory backdoor/C2 relay. Talos tracks the actor as UAT-11473, targeting space/satellite, defense/aerospace and policy research, and assesses with high confidence its infrastructure overlaps Volt Typhoon's 'Silent Train' covert access network detailed by Lumen's Black Lotus Labs, which says Volt Typhoon exploited the flaw by late 2025 against telecoms, governments, defense contractors, MSPs and critical infrastructure, likely for pre-positioning and espionage. Cisco patched in February 2026 with no workaround; upgrading may not remove implants, so incident response and key rotation are advised.
Fixed: 20.9.8.2; 20.12.6.1; 20.12.5.3; 20.15.4.2; 20.18.2.1
Do: Verify whether SD-WAN Controllers/Managers/Validators were compromised before upgrading — check for KeyDrift artifacts (/etc/sv/sshd run script, /etc/sv/aaamgr/, conf_sshd, rsshd, libdssl.so, libcommon.so, /tmp/system-vdaemon, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf); Upgrade to a fixed release (20.9.8.2, 20.12.5.3/20.12.6.1, 20.15.4.2 or 20.18.2.1 per train); migrate off EOL trains; Until patched, restrict ports 22 and 830 to known controller IPs on on-prem deployments; Deploy Talos Snort rules (67387–67416 Snort 2; 7:44–7:73 Snort 3) to detect C2; Follow Cisco's SD-WAN hardening guide; if compromise signs found, start incident response, contact Cisco TAC, and rotate AES keys; review exposure of other management/control-plane platforms targeted via Silent Train (Versa Director, N-able N-central, VeloCloud Orchestrator, Quest KACE)

### [critical] Malicious npm package @chatunitycenter/baileys — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-chatunitycenter-baileys-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub published advisory GHSA-g6j7-j669-23g6 on 2026-10-29 flagging the npm package @chatunitycenter/baileys as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and there are no patched versions, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. Anyone who installed this package — likely developers seeking the Baileys WhatsApp automation library — is affected. No fix exists; remediation requires removal, secret rotation from a clean machine, and system rebuild.
Do: Treat any machine with @chatunitycenter/baileys installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems rather than trusting cleanup; Audit npm lockfiles and CI environments for the package and block it in dependency firewalls; Review access logs and monitor for follow-on attacker activity

### [critical] Zip Cloaking: Rust zip crate — parser differential bypasses scanners for arbitrary file write/RCE, plus symlink write, alloc-abort and legacy-decoder DoS (CVE-2026-115905, CVE-2026-115908, CVE-2026-115909, CVE-2026-115907)
https://helix.ml/threat-watch/i/zip-cloaking-rust-zip-crate-parser-differential-lets-crafted-zips-bypass-security-scanners-and-overwrite-arbitrary-files · Vulnerabilities · patched · since 2026-10-28 · CVE-2025-29787, CVE-2026-115905, CVE-2026-115907, CVE-2026-115908, CVE-2026-115909
The Rust zip crate (zip-rs/zip2) has four critical/high vulnerabilities. CVE-2026-115905 (<=9.0.4): ZipArchive trusts the Central Directory File Header while ZipStreamReader trusts the Local File Header, so crafted ZIPs present different filenames/contents to scanners vs extraction, enabling scanner bypass, arbitrary file overwrite, DoS and RCE; shallow_copy_file can also desync headers. CVE-2026-115908 (>=7.2.0,<9.0.0): ZipArchive::extract validates symlink targets only lexically, allowing arbitrary file writes outside the extraction dir (including cross-drive/UNC on Windows) when the destination path is guessable; a regression reintroduced CVE-2025-29787 conditions. CVE-2026-115909 (>=1.3.0,<9.0.0): attacker-declared ZIP64 uncompressed size in the symlink branch causes an uncatchable SIGABRT from a 112-byte archive. CVE-2026-115907 (>=5.1.0,<9.0.0, legacy-zip feature): Shrink decoder capacity-overflow panic from attacker-controlled uncompressed size. All fixed in 9.0.0/9.0.5; public PoCs exist, no in-the-wild exploitation reported.
Fixed: zip 9.0.0; zip 9.0.5
Do: Upgrade the zip crate to 9.0.5 immediately (covers all four CVEs); Audit upload pipelines for ZipStreamReader::extract/visit on untrusted archives and any ZipArchive::extract of attacker-supplied ZIPs; Treat archives inspected with CDFH-based parsers as unverified if extraction uses streaming readers; block or re-scan archives whose LFH/CDFH entries disagree; Disable or gate the legacy-zip feature if not needed; run extraction in isolated sandboxes with resource limits and validate post-extraction paths; On Windows, restrict symlink creation privileges (SeCreateSymbolicLinkPrivilege) for extraction processes

### [high] VMware ESX insufficient logging zero-day (CVE-2026-41709) exploited by Warp Panda; PHP2Shell/Fragnesia chains root firewalls
https://helix.ml/threat-watch/i/broadcom-vmware-esx-cve-2026-41709 · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-101767, CVE-2026-102764, CVE-2026-109618, CVE-2026-109619, CVE-2026-41709, CVE-2026-46300, CVE-2026-76418
CISA added CVE-2026-41709 (CVSS 2.7), an insufficient logging flaw in VMware ESX, to KEV on Oct 28, 2026 after CrowdStrike revealed China-nexus Warp Panda (UNC5221) exploited it as a zero-day in early 2026 to suppress audit trails in espionage against the US legal sector. Warp Panda exploits internet-facing edge devices, pivots to vCenter deploying BRICKSTORM/SharpStorm, harvests M365 session tokens and registers rogue MFA devices. Separately, a China-nexus actor used Dream-documented AI-assisted campaigns chaining PHP2Shell (CVE-2026-109618/109619) with the Fragnesia Linux kernel LPE (CVE-2026-46300, KEV, due Oct 31) to root 25 firewalls and steal AD credentials; Palo Alto confirmed active exploitation of its management interface, and Cisco confirmed exploitation of firewall DoS flaw CVE-2026-76418. Broadcom fixed CVE-2026-41709 in July 2026; FCEB agencies must remediate by Nov 11, 2026.
Fixed: VMware Cloud Foundation: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, 5.2.4; VMware vSphere Foundation: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025; VMware ESX: ESXi80U3j-25429389; VMware Telco Cloud Platform: ESXi80U3j-25429389
Do: Patch VMware ESX/ESXi, vSphere Foundation, Cloud Foundation, and Telco Cloud Platform to fixed builds immediately; patch Linux kernel for Fragnesia (CVE-2026-46300) by Oct 31 and Palo Alto/Cisco firewall software per vendor advisories.; Hunt for Warp Panda activity: audit ESXi/vCenter logs for gaps, look for BRICKSTORM/SharpStorm indicators, and check for bypassed audit logging on internet-facing edge devices.; Review cloud and M365 environments for harvested session tokens: revoke sessions, check for rogue MFA device registrations, enforce token binding/conditional access.; Reduce internet exposure of ESXi, vCenter, and edge/VPN appliances; follow CISA BOD 26-04 forensic triage requirements; discontinue use if mitigations unavailable.; Assume prior admin-level activity may be unlogged; perform forensic triage on any ESXi host or firewall that was internet-reachable or admin-accessed during 2026.

### [medium] BAE Systems / US Bankruptcy Noticing Center outage — no data extracted, service restored after 2+ weeks
https://helix.ml/threat-watch/i/bae-systems-us-bankruptcy-noticing-center-outage-no-data-extracted-service-restored-after-2-weeks · Breaches · no-fix-needed · since 2026-10-29
BAE Systems, which operates the federal judiciary's Bankruptcy Noticing Center (BNC) under contract with the Administrative Office of the US Courts, restored the service on October 26 after it stopped processing bankruptcy notices around October 9 due to an undisclosed incident. BAE states no data was extracted and no PII was breached, and that no other systems were affected, but has not disclosed the cause or confirmed whether it was a cyberattack. No ransomware or cybercrime group has claimed responsibility. The outage disrupted notice delivery for all US federal bankruptcy courts; the Judicial Conference declared a 'Bankruptcy Rules emergency' on October 22, allowing judges to extend deadlines and pause time periods. The BNC began clearing the backlog of delayed notices oldest-first after restoration.
Do: If your organisation files or depends on bankruptcy notices, verify notices you expected during Oct 9–26 were delivered and re-file/resend any missing ones; Use any extended deadlines or relief orders issued under the Bankruptcy Rules emergency for filings affected by the outage; Monitor AOUSC and BAE communications for the root-cause determination and any follow-on security guidance; Review contingency procedures for court-notice delivery outages in case of recurrence

### [critical] black-spindle-2 (npm): malicious postinstall beacon exfiltrates host data on install (no CVE)
https://helix.ml/threat-watch/i/black-spindle-2-npm-malicious-postinstall-beacon-exfiltrates-host-data-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-29
The npm package black-spindle-2 (versions 100.0.0 and 301.0.0) contains malicious code flagged by Amazon Inspector and reported via OpenSSF/GitHub Advisory GHSA-qcg8-4xw5-5ccq. Its package.json declares a postinstall script that runs curl over plain HTTP against an anonymous ngrok-free.app tunnel (http://778e-181-63-25-28.ngrok-free.app), embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation and providing a channel to exfiltrate host or environment values via the expanded shell expression; the shipped index.js is an empty stub, so the beacon is the package's entire effect. No patched versions exist; the fix is to remove the package. Anyone who installed these versions is affected.
Do: Search dependency trees and lockfiles for black-spindle-2 and remove it; do not install; If installed, treat the build machine as compromised: rotate secrets, tokens, and environment credentials exposed during install; Block ngrok-free.app tunnels in CI/build egress and disable install lifecycle scripts (npm config set ignore-scripts true); Audit npm install logs for connections to the ngrok host; Prefer pinned dependencies and provenance-verified packages

### [critical] poc-revshell (PyPI): malicious package ships reverse-shell backdoor triggered on pip install or import (no CVE)
https://helix.ml/threat-watch/i/poc-revshell-pypi-malicious-package-ships-reverse-shell-backdoor-triggered-on-pip-install-or-import-no-cve · Supply chain · no-fix-needed · since 2026-10-29
The PyPI package poc-revshell 0.1.0 contains an embedded reverse-shell backdoor (CWE-506), flagged by Amazon Inspector and catalogued by OpenSSF/GitHub as malware. setup.py registers a PostInstall cmdclass that spawns a daemon thread during pip install: it connects a TCP socket to hardcoded 127.0.0.1:4444, dup2s the descriptor onto stdin/stdout/stderr, and execs /bin/sh -i (or cmd.exe on Windows). The same thread launch sits at module top level in __init__.py, so every import poc_revshell repeats the handoff. Any co-resident listener on port 4444 receives a full interactive shell under the installing user's identity. The loopback destination limits the attack to a local attacker on the installer's host. No fixed version exists; the package is malware and should be removed, not upgraded.
Do: Search environments for poc-revshell in dependency manifests, lockfiles, and installed site-packages and remove it; Audit hosts where it was installed or imported for signs of a local listener on port 4444 and for unexpected shells or persistence; Rotate credentials and review activity of accounts used for the install, assuming user-level compromise if exposure is suspected; Block the package name in internal PyPI mirrors/proxies and alert on any future install attempts; Review install-time execution policies (e.g. pip hooks, setup.py execution) in CI and developer images

### [critical] @dmangal/curse-dependent-ecto (npm): malicious install-time script exfiltrates env secrets and files via webhook.site
https://helix.ml/threat-watch/i/dmangal-curse-dependent-ecto-npm-malicious-install-time-script-exfiltrates-env-secrets-and-files-via-webhook-site · Supply chain · no-fix-needed · since 2026-10-29
The npm package @dmangal/curse-dependent-ecto (versions 99999.0.0–99999.0.2) contains malicious code in its binding.gyp, which node-gyp executes automatically during npm install. The embedded node -e script greps /workspace/, /root/, /tmp/, /opt/, /var/ and /etc/ for files containing the 'HTB{' marker, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates all process.env keys, and POSTs the results (GREP:, FILE:, ALLENV: payloads) to a hardcoded webhook.site endpoint. The package has no native source files — binding.gyp exists solely to run the exfiltration command — and the implausible 99999.x version string suggests a dependency-confusion lure. Any developer or CI environment installing it leaks CI secrets, API tokens, environment-injected credentials and workspace file contents. No patched versions exist; the only fix is removal/blocking.
Do: Remove and uninstall @dmangal/curse-dependent-ecto from all projects and lockfiles; audit installs since exposure; Rotate all CI secrets, API tokens and environment-injected credentials on any machine or runner that installed it; Search logs and filesystems for files containing 'HTB{' and for outbound requests to webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0; Block the webhook.site endpoint and pin dependency versions; enable npm audit/registry malware scanning in CI; Guard against dependency confusion by scoping internal package names in a private registry

### [critical] spectral-core (npm) typosquat: install-time script steals env secrets and AWS metadata
https://helix.ml/threat-watch/i/spectral-core-npm-typosquat-install-time-script-steals-env-secrets-and-aws-metadata · Supply chain · no-fix-needed · since 2026-10-29
The npm package spectral-core, a typosquat resembling the legitimate @stoplight/spectral-core, was published with malicious install-time code. Versions 3.0.2–3.0.7 and 3.0.9–3.0.12 ship only package.json and a binding.gyp with gypfile:true, so npm runs node-gyp rebuild on install; a 'none'-type target executes an embedded node -e script. The script reads /proc/1/environ and /proc/self/environ (container/CI secrets and cloud credentials), gathers DNS/socket/ARP/route reconnaissance, queries the AWS EC2 metadata service at 169.254.169.254 for user-data and meta-data, and POSTs everything to a hardcoded webhook.site collector. The package ships no library functionality (declared index.js is absent), so its sole purpose is credential exfiltration. No patched versions exist; the fix is to not use the package.
Do: Check lockfiles and CI logs for any install of spectral-core versions 3.0.2–3.0.12 and remove it; treat any machine or CI runner that installed it as compromised; Rotate all credentials present in environment variables on affected hosts, especially CI/CD secrets and AWS keys; invalidate EC2 instance roles and session tokens; Audit AWS CloudTrail and webhook.site-related egress for exfiltration; block webhook.site and the metadata endpoint abuse patterns; Pin dependencies and use the scoped @stoplight/spectral-core instead; Enable npm install scripts restrictions (e.g. --ignore-scripts) and registry allowlists in CI

### [critical] Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-packages-m98th-m98bet-789bet-m98vip-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub's advisory database published four critical malware advisories on 2026-10-29 for npm packages m98th, m98bet, 789bet, and m98vip, flagged under CWE-506 (Embedded Malicious Code). Every version of each package is affected and no patched versions exist, so the packages cannot be safely used at all. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. The package names suggest a gambling/brand-impersonation typosquat campaign. Reach appears low (m98vip shows ~17 downloads/month), but any developer or CI machine that installed them is at risk of secret and key theft. No fix exists; remediation is removal plus credential rotation and system rebuild.
Do: Remove m98th, m98bet, 789bet and m98vip from all machines, CI runners and lockfiles immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected machines; removal of the package does not guarantee malware removal; Audit install logs and dependency trees for these packages and any related suspicious packages; Block these package names in npm registry proxies/internal mirrors and alert developers

### [critical] Node2Shell: Brotli decoder OOB write across Node.js, Python, Bun, .NET, Java, Envoy/Istio and Perl IO::Compress::Brotli enables RCE, memory disclosure or CPU pinning via crafted compressed streams (CVE-2026-111497)
https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe · Supply chain · partial · since 2026-10-23 · CVE-2026-111497, CVE-2026-115936
CVE-2026-111497 is an out-of-bounds write in the upstream Google Brotli C library decoder (1.0.3–1.2.0), dubbed Node2Shell. A crafted brotli stream confuses 'malformed' with 'need more input' in DecodeBlockTypeAndLength(), causing an unbounded copy into adjacent decoder state (memory disclosure, crash, potential RCE — Imperva demonstrated code execution on Node.js 24.22.0 ARM64) or an infinite loop pinning a CPU. Because most runtimes bundle the library, patching system libbrotli does not help. Fixes shipped 2026-10-21 onward for Node.js 22.23.4/24.22.1/26.12.1, Brotli 1.0.10/1.1.1/1.2.1, Python 1.2.1, Bun 1.4.4, brotli4j 1.24.0, .NET 8.0.33/9.0.22/10.0.14, Envoy and Istio branch fixes, and IO-Compress-Brotli 0.023; EOL Node.js lines remain unpatched. A public PoC appeared 2026-10-22; in-the-wild exploitation is confirmed and the CVE is on CISA's KEV. Both inbound (Express 5/body-parser 2.x accept br bodies) and outbound (fetch/axios/got auto-decode br) paths are exposed, and corruption is largely invisible to WAFs and monitoring.
Fixed: Brotli 1.0.10, 1.1.1, 1.2.1; Node.js 22.23.4, 24.22.1, 26.12.1; Python Brotli 1.2.1 / brotlicffi 1.2.1.0; Bun 1.4.4; brotli4j 1.24.0; .NET 8.0.33, 9.0.22, 10.0.14; Envoy 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0; Istio 1.29.9, 1.30.6, 1.31.2; IO-Compress-Brotli 0.023
Do: Patch immediately: upgrade Node.js to 22.23.4/24.22.1/26.12.1, Python Brotli/brotlicffi to 1.2.1, Bun to 1.4.4 (rebuild bun build --compile binaries), brotli4j to 1.24.0, .NET to 8.0.33/9.0.22/10.0.14, Envoy/Istio to fixed branch releases, and IO-Compress-Brotli to 0.023; rebuild/redeploy dependent applications; Treat as actively exploited per CISA KEV; prioritize internet-facing services that decompress attacker-controlled brotli data, including parsers mounted before authentication; Audit both inbound and outbound paths: Express 5/body-parser 2.x accept br request bodies by default, and fetch/axios/got/node-fetch auto-decode br responses (e.g. webhooks, link previews, feed readers); If you cannot patch now, set inflate: false on Express 5/body-parser 2.x parsers or reject Content-Encoding: br at the reverse proxy — mitigations only, they do not cover the outbound path and may break legitimate clients; Do not trust process.versions.brotli (still reports 1.2.0 on patched Node.js 24.22.1); verify fixed process.version from official nodejs.org distributions; Monitor for unexplained CPU spikes or hung threads during brotli decoding; note corruption completes with HTTP 200 and no exception

### [critical] npm typosquat malware: bcxhdh1kjlopsde & cjlowuxbnexkhgpzq — full machine compromise on install
https://helix.ml/threat-watch/i/npm-typosquat-malware-bcxhdh1kjlopsde-cjlowuxbnexkhgpzq-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub added two malware advisories on 2026-10-29 for npm packages bcxhdh1kjlopsde (GHSA-v78q-7787-v9rq) and cjlowuxbnexkhgpzq (GHSA-pr23-gvcv-c422). Both are flagged CWE-506 embedded malicious code, with every version (>=0) affected and no patched versions available. GitHub's standard malware warning states any machine with the packages installed or running should be considered fully compromised, with attacker control implying secrets and keys must be rotated. One package shows ~51 downloads/month; the other's popularity is unstated. The packages have no known source code repositories, consistent with throwaway malicious publishes. Removal of the package alone is not guaranteed to remove the malicious software. No CVEs; no fix will be issued — remediation is removal plus host forensics and credential rotation.
Do: Remove bcxhdh1kjlopsde and cjlowuxbnexkhgpzq from all dependency manifests, lockfiles and caches; block them in registry proxies; Rotate all secrets, keys, tokens and credentials stored on any machine where the packages were installed, from a clean machine; Rebuild affected machines from trusted images; do not assume uninstalling the package removes the malware; Audit CI/CD runners and developer workstations for exposure and review npm install logs for these package names; Add these packages to denylists and alert on any future install attempts

### [critical] Tailwind npm malware wave: seven more malicious Tailwind/PostCSS animation packages fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-wave-tailwindcss-theme-kit-noelc-css-blender-tailwind-base-buttons-malicious-packages-fully-compromise-insta · Supply chain · no-fix-needed · since 2026-10-24
GitHub's advisory database published malware advisories between 2026-10-24 and 2026-10-29 covering seven npm packages: tailwindcss-theme-kit (GHSA-v5xr-xjx7-ggwf), noelc-css-blender (GHSA-cj2x-975v-jmwf), tailwind-base-buttons (GHSA-5j43-343m-gggg), tailwindcss-keyframe-kit (GHSA-282x-w96h-wv7f, ~902 downloads/month), tailwindcss-animate-catalog (GHSA-4mf5-57pc-vj85, ~869 downloads/month), tailwind-animationlab (GHSA-7cm4-74gj-gfp2, ~616 downloads/month) and tailwind-keyframes (GHSA-vh6h-8m24-j9mj, ~444 downloads/month). All versions (>= 0) are affected, no patched versions exist, and each is rated critical under CWE-506 (embedded malicious code). The advisories state any computer with these packages installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Removal of the package does not guarantee removal of the malicious software. No common name or CVE is assigned; no known source code is available. Any developer or CI environment that installed these packages is affected.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine that installed these packages, using a clean computer; Remove the packages from all projects, lockfiles and CI caches, and audit for persistence mechanisms left behind; Rebuild or wipe affected developer machines and CI runners; review logs for outbound connections or exfiltration; Check dependency trees and lockfiles for the seven package names and block them in registry proxies/allowlists; Audit npm install history and monitor accounts for suspicious activity

### [medium] Cyberattack on Belgian FPS Finance takes MyMinfin tax portal offline before filing deadline
https://helix.ml/threat-watch/i/cyberattack-on-belgian-fps-finance-takes-myminfin-tax-portal-offline-before-filing-deadline · Breaches · no-fix-needed · since 2026-10-29
Belgium's FPS Finance took its main online tax platform, MyMinfin, offline on 2026-10-29 after a cyberattack, days before an October 31 filing deadline for certain income types. Affected taxpayers will receive extended deadlines. Authorities have not identified the attackers or the access method and say there is no indication of data breach or theft, though investigation continues. Services were suspended as a precaution while systems are secured; other government applications remain partially operational. The incident follows an earlier October shutdown of Belgian government websites over critical PHP vulnerabilities (remote code execution) affecting servers across Europe; no link between the incidents has been established.
Do: Monitor FPS Finance communications for revised filing deadlines and service restoration notices; Taxpayers with October 31 obligations should await the announced extension rather than assume the deadline stands; Be alert for phishing or scam sites impersonating MyMinfin while the official portal is down; Government operators should verify PHP servers are patched against the recently disclosed critical RCE vulnerabilities; Watch for updates on whether data exposure is confirmed

### [critical] Oracle EBS SQL injection to RCE now scanned/exploited in the wild (CVE-2026-101767)
https://helix.ml/threat-watch/i/oracle-ebs-sql-injection-to-rce-now-scanned-exploited-in-the-wild-cve-2026-101767 · Vulnerabilities · patched · since 2026-10-28 · CVE-2025-61882, CVE-2026-101767, CVE-2026-35273
Threat actors began scanning and running exploratory exploits against Oracle E-Business Suite instances for CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution. Defused observed exploit attempts against decoy EBS systems on Oct 27, 2026, though Oracle has not yet tagged the flaw as exploited in the wild. Shadowserver tracks over 670 Internet-exposed Oracle EBS instances, mostly in the US. Oracle patched the flaw in its October 20, 2026 Critical Security Patch Update and warned that some customers were compromised because they had not applied available patches. Oracle products are frequent targets: Clop and ShinyHunters previously exploited EBS and PeopleSoft zero-days, and CISA has listed 46 Oracle bugs as actively exploited since 2021.
Fixed: October 2026 Critical Security Patch Update (2026-10-20)
Do: Apply Oracle's October 2026 Critical Patch Update immediately if running EBS; Take EBS instances off the public Internet or restrict HTTP access to the Thin Client Framework servlet; Check logs and decoys for exploit attempts against CVE-2026-101767 since disclosure; Assume compromise if unpatched and exposed; investigate for data theft and follow-on access; Stay on actively supported Oracle versions and keep up with quarterly CPU patches

### [critical] Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN and IT-management platforms
https://helix.ml/threat-watch/i/silent-train-volt-typhoon-zero-day-campaign-against-edge-and-management-infrastructure · Breaches · patched · since 2026-10-28 · CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20127
On 2026-10-28 Lumen's Black Lotus Labs published 'Silent Train', its name for the way China's Volt Typhoon has reached US targets since November 2023. It is not a standing botnet. For each operation the actor builds a fresh chain of four to six hops: two non-US VPSs (Ucloud, Alibaba Cloud and Huawei Cloud appear in examples), then hacked overseas SOHO and IoT gear (Intelbras modems, TP-Link, Ruckus, Zyxel, Cambium), then hacked US devices (Netgear Orbi), and sometimes a hacked enterprise box such as a FortiGate as the last hop. A chain can be stood up in under two minutes. Sessions average about four hours, and afterwards the temporary SSH services, keys and configs are wiped. Later chains added Chisel and FRP reverse tunnels, and from early 2025 hacked enterprise systems were kept for one to three months. Activity runs Monday to Friday, 09:00–22:00 China Standard Time. More than 27 device classes have been abused. Black Lotus Labs confirms four zero-day campaigns through Silent Train: Versa Director (CVE-2024-39717, 2024), N-able N-central (CVE-2025-8875/8876, 2025), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited by late 2025 and still after Cisco's February 2026 fix) and Arista VeloCloud Orchestrator (CVE-2026-16812, 2026). It also assesses with moderate confidence a Quest KACE SMA zero-day that hit more than 30 victims and fell off after Quest's October 2025 updates; no CVE has been assigned. After getting in, the actor used in-memory webshells, harvested credentials, abused built-in features such as endpoint control and file transfer to reach downstream customers, and erased logs. Hundreds of victims have been notified: telecoms, US government, the defense industrial base, satellite and emergency communications, MSPs and IT firms, ROTC-linked universities, and water, energy, transport, maritime, rail and aviation. Hawaii, California and Texas are the most targeted states. All four confirmed CVEs are in CISA KEV and have vendor fixes. Black Lotus Labs says it has quietly disrupted the framework, but warns that its view is not a complete census.
Fixed: VeloCloud Orchestrator 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1 (Arista SA-0144); Catalyst SD-WAN 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, 20.18.2.1; releases before 20.9 must migrate (cisco-sa-sdwan-rpa-EHchtZk); N-central 2025.3.1 or 2024.6 HF2; Versa Director 22.1.4 or later; Quest KACE SMA: current release with the October 2025 security updates
Do: Confirm every VeloCloud Orchestrator, Catalyst SD-WAN Controller/Manager/Validator, N-central, Versa Director and KACE SMA you run (or that an MSP runs for you) is on a fixed build: VCO 5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1, SD-WAN 20.9.8.2/20.12.5.3/20.12.6.1/20.15.4.2/20.18.2.1, N-central 2025.3.1 or 2024.6 HF2, Versa Director 22.1.4+, KACE with the October 2025 updates; Take these management interfaces off the internet: allow-list admin networks or jump hosts; on on-prem Catalyst SD-WAN restrict TCP 22 and 830 to known controller IPs; Hunt for compromise on those platforms, because patching does not evict an actor already inside. On SD-WAN, check /var/log/auth.log for 'Accepted publickey for vmanage-admin' from unknown IPs and vmanage-type control-connection peering events outside maintenance windows. On VCO, look for unexpected outbound HTTP(S) from the host and for the source IPs in Arista SA-0144. On Versa Director, look for in-memory JAR webshells. On all of them, look for admin logins, API calls, remote file transfers or endpoint-control jobs nobody scheduled; If a platform was exposed while vulnerable, rotate every credential it stores or brokers (domain, device and customer credentials), review its access to downstream customers, and rebuild it from trusted media instead of cleaning it in place; Ship management-plane, firewall and auth logs off-box with long retention. The actor wipes on-device logs, so the off-box copy may be the only record. Weight review toward 01:00–14:00 UTC on weekdays (09:00–22:00 China Standard Time); On edge and SOHO gear you own, especially FortiGate and Netgear Orbi, look for SSH listeners on non-standard ports (e.g. 2222), unexpected authorized_keys entries, and Chisel or FRP tunnels (e.g. TCP 8999). Replace end-of-life routers; Apply CISA AA24-038A (Volt Typhoon) and the joint advisory AA26-113A on China-nexus covert networks; for Cisco SD-WAN follow CISA ED 26-03 hunt and hardening guidance

### [high] GitHub Actions issue-injection supply chain campaign — 61 public repos (incl. Trivy, MLflow, Brave, LangExtract) hit via hidden HTML-comment payloads in issues/PRs to steal CI/CD credentials
https://helix.ml/threat-watch/i/github-actions-issue-injection-supply-chain-campaign-61-public-repos-incl-trivy-mlflow-brave-langextract-hit-via-hidden · Supply chain · no-fix-needed · since 2026-10-29
Radware researchers identified a coordinated campaign in which an attacker used 74 GitHub accounts (many likely compromised) to file issues, pull requests and comments containing malicious commands hidden in HTML comments across 61 popular public repositories, including Trivy, MLflow, Brave browser, Google LangExtract, ToolJet, Cilium and Podman. Most of the 83 payload items were posted within a 43-minute window on September 1, 2026. Repos with workflows triggered by these events that interpolate attacker-controlled content into shell code executed the hidden commands, which harvested environment variables and exfiltrated them to attacker servers; two runs showed evidence of execution. The goal was likely stealing repo credentials for a downstream supply-chain attack. Most affected repos were notified and fixed; researchers advise least-privilege workflows and treating external content as untrusted.
Do: Audit GitHub Actions workflows triggered by issues, pull requests or comments for injection of attacker-controlled content (issue titles/bodies, PR titles, comments) into shell commands; fix with proper quoting/intermediate variables; Apply least-privilege GITHUB_TOKEN permissions and restrict secrets/environment variables available to externally triggered workflows; Separate untrusted-event-triggered workflows from jobs with elevated permissions; Review CI logs since 2026-09-01 for signs of execution and credential exfiltration; rotate exposed tokens and secrets; Treat all external issue/PR content as untrusted in CI automation

### [high] Cisco ASA/FTD SSL VPN zero-day exploited for DoS — patches released (CVE-2026-76418)
https://helix.ml/threat-watch/i/cisco-asa-ftd-ssl-vpn-zero-day-exploited-for-dos-patches-released-cve-2026-76418 · Vulnerabilities · patched · since 2026-10-29 · CVE-2026-20349, CVE-2026-76418
Cisco released fixes on 2026-10-29 for CVE-2026-76418 (CVSS 8.6), a second exploited zero-day in its Secure Firewall ASA and FTD software since August. The flaw resides in the Remote Access SSL VPN service and stems from logic errors in tunnel groups configured with secondary authentication. Unauthenticated attackers can send a malicious request during SSL VPN connection to force the device to reload, disrupting availability. Cisco learned in October that the flaw was being exploited in the wild but disclosed no details on attacks or threat actors; it is unclear whether the same actor exploited August's CVE-2026-20349. The bug surfaced via a Cisco TAC support case. No workarounds exist; disabling the tunnel group list or removing secondary authentication reduces exposure but weakens VPN security. Secure Access, cloud-delivered firewall, and Secure Firewall Management Center are not affected.
Do: Upgrade ASA/FTD to the patched releases immediately, prioritising internet-reachable SSL VPN endpoints; If patching is delayed, restrict exposure of the SSL VPN login service and consider disabling the tunnel group list or removing secondary authentication, weighing the security trade-off; Monitor firewalls for unexpected reloads and anomalous SSL VPN connection requests; Review whether secondary authentication is used in affected tunnel groups and harden remote access VPN configurations; Check for related exploitation indicators tied to the August CVE-2026-20349 zero-day

### [critical] Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script
https://helix.ml/threat-watch/i/dependency-confusion-malware-zmtcdn-components-and-zmtcdn-ui-npm-packages-exfiltrate-host-data-via-postinstall-script · Supply chain · no-fix-needed · since 2026-10-29
Two dependency-confusion packages published by npm account kill_shs — @zmtcdn/components@9999.0.0 and @zmtcdn/ui@9999.0.0 and 9999.0.7 — contain empty index.js files described as 'Security research PoC' but run node postinstall.js on npm install. The postinstall script POSTs the hostname, username, platform, working directory and the names of all environment variables to attacker-controlled endpoints (webhook.site for @zmtcdn/components, www.hinny.shop/api for @zmtcdn/ui). Any developer or CI system that installs these packages leaks host metadata and environment variable names, which can guide follow-on attacks. Flagged by OpenSSF and published to the GitHub Advisory Database on 2026-10-29 as malware (CWE-506). No patched versions exist; the only fix is to never install these packages and remove them if present.
Do: Search lockfiles, CI caches and installed node_modules for @zmtcdn/components and @zmtcdn/ui and remove them; treat any machine that installed them as potentially compromised; Rotate secrets and review environment variables on affected build machines, since env var names were exfiltrated; Block the packages and the exfiltration endpoints (webhook.site/f52af355-4783-4acb-9de1-5e44b5963025, www.hinny.shop) at proxy/firewall level; Configure npm scoped-registry mappings and internal registry placeholders to prevent dependency confusion for internal @zmtcdn scope; Audit npm install logs and enable ignore-scripts or allowlisted postinstall policies in CI

### [critical] Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install
https://helix.ml/threat-watch/i/dependency-confusion-beacon-packages-mw-communication-client-mw-test-utils-mui-wrapper-x-date-pickers-exfiltrate-user-ho · Supply chain · no-fix-needed · since 2026-10-29
On 2026-10-27 the npm account amahrou1w published three near-identical packages — mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers — within eight minutes, each a dependency-confusion candidate for internal packages of the same company. Each tarball contains only an empty index.js, README and package.json, but declares preinstall and postinstall scripts that send the installing user's name, hostname and working directory over plain HTTP to IP 38.242.235.206. The README claims it is a bug-bounty dependency-confusion proof of concept, and static analysis (OpenSSF) confirms nothing beyond the two beacons executes. Anyone whose dependency resolution pulls these versions (1.0.x/10.0.x chosen to win loose ranges) leaks machine details. No patched versions exist; the packages are flagged malware in the GitHub Advisory Database.
Do: Search lockfiles and dependency trees for mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers and remove them; Check proxy/egress logs for connections to 38.242.235.206 since 2026-10-27 and identify affected hosts and users; Pin internal package names in private registries and configure scope/registry mapping to block dependency confusion; Disable or audit install lifecycle scripts (npm config with ignore-scripts, --ignore-scripts in CI)

### [critical] spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks
https://helix.ml/threat-watch/i/spectral-net-probe-npm-malicious-package-exfiltrates-local-file-contents-via-install-time-and-load-time-callbacks · Supply chain · no-fix-needed · since 2026-10-29
GitHub Advisory Database (via OpenSSF) reports malicious code in the npm package spectral-net-probe, which contains no functional code. Versions 1.0.1 and 1.0.4 run a postinstall script that beacons to Cloudflare quick tunnels; version 1.0.10 executes on package load, fetching instructions from http://154.57.164.64:30664 and http://127.0.0.1:3000, reading up to ten local files whose paths are returned in data.cargo_hold, and uploading the first 400 characters of each file to the same hosts. The package was published by npm account kristol07, which also published phantom-chartwinds and phantom-powder-keg the same day. No patched versions exist; affected users must remove the package and investigate for file exfiltration.
Do: Remove spectral-net-probe from all projects and lockfiles; block versions 1.0.1, 1.0.4 and 1.0.10; Audit systems where it was installed for exfiltration of local file contents; block network access to 154.57.164.64:30664 and the listed trycloudflare.com hosts; Check whether phantom-chartwinds or phantom-powder-keg are in dependency trees and remove them; Review npm install logs and CI caches for the package; rotate any secrets readable from files on affected machines

### [critical] Dependency-confusion beacon package identity-two-factor targets Coinbase on npm
https://helix.ml/threat-watch/i/dependency-confusion-beacon-package-identity-two-factor-targets-coinbase-on-npm · Supply chain · no-fix-needed · since 2026-10-29
OpenSSF reported a dependency-confusion package, identity-two-factor@999.0.0 on npm, explicitly aimed at Coinbase (README and postinstall.js reference it; beacon path 'cbhq-canary'). The package has no functional code; its postinstall script runs node postinstall.js on npm install, writes a marker file to the temp directory, and POSTs hostname, username, working-directory name, CI flag and Node version to a webhook.site endpoint. It was published by the npm account hologrammmm0x, which has no other packages. Any developer or CI environment that installs the package leaks host details to the attacker. GitHub advisory GHSA-2hrq-h3vj-5wxm (CWE-506, critical) lists affected version 999.0.0 with no patched versions; the package should be removed/uninstalled, not upgraded.
Do: Search dependency locks, caches and install logs for identity-two-factor@999.0.0 and remove it; treat any machine or CI runner that installed it as potentially probed; Check temp directories for the marker file and review egress/proxy logs for requests to webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary; Block the webhook.site endpoint and audit internal package names for dependency-confusion exposure; reserve internal names on public registries; Enforce npm install scripts restrictions (e.g. --ignore-scripts, allowlists) and pin trusted registry sources in CI

### [critical] dsh-* npm malware campaign: dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider fully compromise installed machines; rotate secrets (no CVE)
https://helix.ml/threat-watch/i/malware-in-dsh-vm-tester-npm-package-full-machine-compromise-rotate-secrets-no-cve · Supply chain · no-fix-needed · since 2026-10-27
GitHub's advisory database published malware advisories for three related npm packages: dsh-vm-tester (GHSA-84fw-gj66-p5v3, versions 0.1.2–0.1.4), dsh-redteam-mode (GHSA-r4m9-8735-g966, version 0.15.2, ~4,077 downloads/month) and dsh-volcengine-provider (GHSA-8hr2-m7vq-fhpg, versions 0.2.5 and 0.2.8, ~1,860 downloads/month). All contain embedded malicious code (CWE-506) and GitHub states any computer with a package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No fixed versions exist and none of the packages have known source code, so removal is the only option and does not guarantee the machine is clean. Any developer or CI environment that installed any of these packages is affected; secrets and keys on those machines should be treated as stolen.
Do: Immediately rotate all secrets, keys, tokens and credentials stored on any machine where dsh-vm-tester, dsh-redteam-mode or dsh-volcengine-provider was installed, using a clean machine; Remove dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider from all systems, dependencies and lockfiles; Rebuild or wipe affected machines; do not assume removal fully cleans them; Audit for signs of compromise and review CI/CD pipelines that may have run the packages; Block all three packages in internal registries and dependency scanning

### [medium] ENGIE: French customer contact and contract data stolen through a partner marketing platform breach
https://helix.ml/threat-watch/i/engie-data-breach-customer-data-stolen-via-compromised-partner-marketing-platform-france · Breaches · no-fix-needed · since 2026-10-27
ENGIE says attackers stole contact and contract data of customers in France after breaching a marketing and prospecting platform that its business partners use to promote energy offers. The company says its own IT systems were not compromised, that it cut off the attackers' access to the platform after spotting unusual data access, and that no banking data was affected. The fields listed in customer notices are first and last names, postal and email addresses, phone numbers, PDL or PCE identifiers, customer IDs and contract numbers. ENGIE says it notified relevant authorities and contacted affected customers, but it has not given a count of affected people. No group has claimed the attack. A separate incident from a year earlier, in which the Scattered LAPSUS$ Hunters group leaked records from a Salesforce instance of a retail subsidiary of ENGIE North America, is not part of this breach.
Do: Warn customers of ENGIE France about phishing and fraud attempts using their stolen contact and contract details; Review access controls and monitoring on third-party/partner marketing platforms handling customer data; Audit partner integrations for excessive data access and enforce least-privilege access; Monitor for follow-on social engineering targeting energy customers using PDL/PCE and contract numbers

### [high] iRhythm data breach: 8.2M patients' data stolen from third-party-hosted apps, ransom demanded
https://helix.ml/threat-watch/i/irhythm-data-breach-8-2m-patients-data-stolen-from-third-party-hosted-apps-ransom-demanded · Breaches · no-fix-needed · since 2026-10-29
Medical device maker iRhythm disclosed a June 2026 data breach in which hackers stole personal information from third-party-hosted business applications and attempted to extort the company with threats to leak the data. An HHS OCR filing and a notice to the Oregon Attorney General put the toll at 8,179,772 individuals. Stolen data includes names, addresses, dates of birth, email addresses, phone numbers, and iRhythm account and device data such as account/serial/insurance numbers and dates of service. The company says there is no evidence of identity theft so far and no impact to products, clinical or medical device systems, manufacturing, or patient safety. Notification letters began going out in October 2026; no free credit monitoring was offered.
Do: If you or your organisation's patients may be affected, watch for iRhythm notification letters and review the company's breach notice; Monitor for medical identity theft and insurance fraud; review explanation-of-benefits statements for unfamiliar claims; Enforce strong, unique credentials and MFA on iRhythm and healthcare portal accounts; Alert staff/patients to phishing that could leverage the stolen contact data; Review third-party-hosted application security and data exposure in your own vendor relationships

### [critical] Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand
https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand · Breaches · no-fix-needed · since 2026-10-21
GMO Internet's Onamae.com Desktop Cloud, a Windows virtual-desktop service marketed for running FX auto-trading tools such as MT4/MT5, was breached. GMO found malicious programs on some customers' servers on 20 October 2026 and stopped every plan on 21 October; up to 26,739 servers may be affected, which GMO stresses is a ceiling rather than a confirmed count. Trading-tool and brokerage logins stored on those servers were taken and used: customers report unauthorized trades at several brokers (individual losses of roughly ¥0.5–4M+ in press accounts, unverified), and from 24 October GMO confirms customer information left the service. GMO says an extortion email arrived on 21 October demanding about ¥8 billion ($50M) and threatening further unauthorized trading across 70+ brokers, leaks of customer and company data, and ransomware on customers' connected PCs. GMO refused to pay. After the noon-JST 27 October deadline the attacker published material it claims is GMO and customer data; GMO had the leak site and its mirrors taken down early on 28 October. As of 28 October GMO had found no malware or ransomware on the customer PCs it analysed. How the attacker got in has not been disclosed; GMO admits a security problem in the service and that its own white-hat staff had flagged issues beforehand. GMO will not restart the platform. It will compensate verified realized trading losses, pay ¥5,000 to each current customer plus ¥10,000–25,000 per category of published data (capped at ¥3M), and offer six months of a replacement service free. It has also opened a bounty of up to US$1M for information on the attackers (270 tips by 29 October) and is passing leads its white-hat team found to the police.
Do: Treat every credential saved on the server as compromised: change MT4/MT5 and brokerage passwords from a device that never connected to the service, then end all active broker sessions (some apps keep sessions alive after a password change) and enable 2FA; Review trade history and balances at every broker you used from the service; report unfamiliar trades to the broker and to GMO, and keep evidence for the loss-compensation claim (GMO says application details come by 6 November); Treat any PC that connected to the service as potentially exposed: run a full antivirus scan and back up to offline storage before reusing it (GMO has found no malware on the devices it analysed, but has not cleared all of them). As a precaution, review RDP drive/clipboard redirection and Startup-folder persistence; Do not visit, link to or repost the material the attacker published or its mirrors: GMO warns that visitors' information is captured, the content may be inaccurate, and it is pursuing people who spread it. Report new copies at onamae.com/abuse/; If your data was published, contact GMO's 24-hour support line about the special payment (¥10,000–25,000 per data category, up to ¥3M); Expect phishing and recovery scams that exploit the incident: GMO never asks for passwords or authentication codes, and any request for fees to 'recover your losses' is fraud. Send tips about the attackers only to GMO's official bounty site and do not contact suspects yourself; Do not trade through Onamae.com Desktop Cloud again; GMO will not restart the platform and is offering a replacement environment on separate infrastructure

### [medium] Searchjacked: 319 malicious Chrome extensions hijack searches of 13.4M users, monetize via Yahoo/Bing referral fraud
https://helix.ml/threat-watch/i/searchjacked-319-malicious-chrome-extensions-hijack-searches-of-13-4m-users-monetize-via-yahoo-bing-referral-fraud · Supply chain · no-fix-needed · since 2026-10-29
Socket researchers identified 319 Chrome browser extensions, installed by roughly 13.4 million users, whose sole purpose is to hijack the browser's default search engine. Using only the chrome_settings_overrides manifest key, the extensions route all search queries through operator-controlled proxy servers, capture complete search histories tied to unique identifiers, and collect referral payments from Yahoo and Bing syndication programs (hspart/hsimp and PC/PTAG partner IDs). The extensions are deliberately hidden from Chrome Web Store indexing and promoted via paid advertising, with new domains and lures appearing quickly after takedowns; the technique has run continuously for about a decade. Because the operator controls per-request redirects, searches could selectively be sent to phishing or malware pages. No CVE applies; mitigation is removal of the extensions and blocking associated domains.
Do: Audit managed and user browsers for extensions matching search-hijacker names/brands and remove them; Reset default search provider settings and clear associated identifiers; Block known hijacker search/proxy domains at the network perimeter; Restrict Chrome Web Store extension installs via enterprise allowlists; Monitor for extensions requesting chrome_settings_overrides search-provider changes

### [high] Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)
https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570 · Supply chain · patched · since 2026-10-22 · CVE-2026-111943, CVE-2026-113470, CVE-2026-115557, CVE-2026-115570
A set of eMudhra intermediate CA certificates was compromised and is being blocked by browsers and other TLS clients. Electron releases before the patched versions did not block these intermediates in either Chromium networking or Node.js tls/https/fetch, so an attacker holding a certificate issued via the compromised intermediates and able to intercept network traffic (e.g. on-path/MitM) could impersonate a TLS server to an Electron app. Only apps making TLS network connections are affected; offline apps are not. Go (CVE-2026-111943) and Firefox (CVE-2026-113470) shipped the same mitigation. There are no app-side workarounds; fixed releases are 45.0.0-beta.6, 44.9.1, 43.8.1 and 42.11.16, published 2026-10-22/23.
Fixed: 45.0.0-beta.6; 44.9.1; 43.8.1; 42.11.16
Do: Upgrade Electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16 (or later) and rebuild/redistribute apps, prioritising apps that make TLS connections over untrusted networks; Audit which Electron apps in your estate make network connections and prioritise those handling sensitive data; Verify no pinned or custom certificate logic bypasses the new block; confirm updated builds ship the mitigation in both Chromium and Node.js TLS paths; Monitor for any further eMudhra-related revocations or advisories affecting other TLS clients in your stack

### [critical] b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE)
https://helix.ml/threat-watch/i/b20miner-npm-package-malicious-cryptominer-backdoor-fully-compromises-installed-hosts-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database published GHSA-fw7x-6chc-4244 on 2026-10-28 flagging npm package b20miner version 0.3.1 as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected hosts are at risk and must be rotated from a clean machine. No patched version exists; the package has no known source code repository. Removal of the package alone cannot be guaranteed to remove all malicious software it deployed. Affected users are any developers or CI systems that installed b20miner 0.3.1.
Do: Treat any host with b20miner 0.3.1 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected hosts, from a clean machine; Remove the package and rebuild/reimage affected systems; do not assume removal is sufficient; Audit install logs, CI caches, and lockfiles for b20miner and block the package in registries/proxies; Review for persistence mechanisms and unauthorized access following compromise

### [high] GhostAction: GitHub supply-chain campaign steals developer secrets and pivots to cloud access
https://helix.ml/threat-watch/i/ghostaction-github-supply-chain-campaign-steals-developer-secrets-and-pivots-to-cloud-access · Supply chain · no-fix-needed · since 2026-10-28
The GhostAction campaign, a supply-chain attack wave targeting GitHub, saw attackers compromise repositories and inject malicious workflows to steal developer secrets such as CI/CD credentials. While the initial hacking wave largely fizzled, researchers warn the attackers remain active on GitHub and have shifted focus toward developer endpoints and cloud access, signaling an evolution in tactics. Affected parties are open-source projects and organisations whose repositories or developer machines were compromised, with stolen credentials potentially granting access to cloud infrastructure. There is no vendor patch; mitigation relies on credential rotation, secret scanning, and workflow hardening. Organisations should audit GitHub Actions workflows, rotate exposed secrets, and monitor cloud environments for anomalous access.
Do: Rotate all GitHub tokens, CI/CD secrets, and cloud credentials that may have been exposed; Audit GitHub Actions workflows and repository commit history for unauthorised changes; Review cloud access logs for anomalous use of stolen credentials; Enable GitHub secret scanning and push protection; Harden developer endpoints and enforce MFA on GitHub and cloud accounts

### [critical] Electrum malicious-server RBF fee-bump theft via unverified mempool tx (CVE-2026-117601)
https://helix.ml/threat-watch/i/electrum-malicious-server-rbf-fee-bump-theft-via-unverified-mempool-tx-cve-2026-117601 · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-117601
A malicious Electrum server can swallow a client's just-broadcast transaction (tx1) and replace it in the client's history with a conflicting, invalid transaction (tx2) whose outputs pay the attacker; signatures are not verified due to light-client design. If the user then RBF fee-bumps the displayed tx2, they sign and pay the attacker. Attackers grinded output addresses to mimic the last four chars of the legit address and used zero-fee tx2 to bait fee bumps; some servers performed this in the wild, with two user reports including a confirmed loss. Fix in commit 90fe308 (v4.8.3, tagged 2026-10-23, released 2026-10-24) verifies signatures of is_mine inputs for mempool transactions; incoming txs remain unvalidated. Users connecting only to trusted/self-run servers are unaffected.
Fixed: electrum 4.8.3
Do: Upgrade Electrum to 4.8.3 or later immediately; Until upgraded, manually verify output addresses and amounts before signing any transaction, including fee bumps; Connect only to trusted servers, ideally run your own Electrum server; Check wallet history for unexpected replacement transactions after broadcasting; Watch for addresses whose last characters mimic your intended payee address

### [critical] @zaip-ai/cli npm package is malware — full machine compromise, no patched versions (GHSA-ffq4-h5jm-8pqr)
https://helix.ml/threat-watch/i/zaip-ai-cli-npm-package-is-malware-full-machine-compromise-no-patched-versions-ghsa-ffq4-h5jm-8pqr · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published GHSA-ffq4-h5jm-8pqr on 2026-10-28 flagging the npm package @zaip-ai/cli as embedded malicious code (CWE-506). Affected versions are 6.4.0, 6.5.0 and 7.0.0 through 7.4.0; no patched versions exist and the package has no known source code. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package reportedly sees ~5,244 downloads per month, so any developer or CI environment that installed it is at risk of secret and credential theft. Removal of the package does not guarantee removal of all malicious software it may have deployed. There is no fix; remediation is incident response, not upgrading.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine that installed or ran @zaip-ai/cli, doing so from a clean computer; Isolate and rebuild any affected machines or CI runners from trusted images; do not trust removal of the package alone; Audit systems for persistence, unexpected processes and outbound connections indicating attacker access; Check dependency lockfiles and install history to determine exposure scope and block/reinstall from a clean state; Harden CI/CD and developer endpoints against npm supply-chain installs (allowlists, provenance checks)

### [critical] itsa-utils / itsa-react-checkbox npm packages trojanized with malware (no CVE)
https://helix.ml/threat-watch/i/itsa-utils-itsa-react-checkbox-npm-packages-trojanized-with-malware-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published malware advisories on 2026-10-28 for two npm packages from the itsa ecosystem: itsa-utils version 1.4.2 and itsa-react-checkbox version 16.0.5, both flagged as embedded malicious code (CWE-506). Any machine with these packages installed or running should be considered fully compromised, with attacker control of the host implying potential theft of secrets, keys, and credentials. No patched versions exist; the packages have no known source code for remediation. itsa-utils has roughly 2,735 weekly downloads and 32 dependent repositories, so downstream projects may be exposed transitively. Removal of the packages alone cannot guarantee removal of all malicious software deployed during compromise.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine that installed these packages, using a clean machine; Remove itsa-utils@1.4.2 and itsa-react-checkbox@16.0.5 from all projects and lockfiles, pinning to known-clean versions; Rebuild/reimage affected machines and audit for persistence mechanisms, as removal may not eliminate implanted malware; Check transitive dependencies (32 dependent repos for itsa-utils) and audit CI/CD systems for exposure; Block these package versions in registries/proxies and monitor for related itsa packages being trojanized

### [critical] Malicious npm package dsh-plugin-blender-3d — full machine compromise for installers (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-dsh-plugin-blender-3d-full-machine-compromise-for-installers-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database published GHSA-hw9g-f63g-4c8x on 2026-10-28 flagging the npm package dsh-plugin-blender-3d version 0.2.1 as embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. There is no patched version and no known source code; the only remediation is removal, which may not eliminate all malicious software. Roughly 163 downloads per month are recorded. Anyone who installed version 0.2.1 should treat secrets and keys on the affected machine as stolen and rotate them from a clean computer.
Do: Rotate all secrets, keys, and credentials stored on any machine that installed the package, using a different clean computer; Remove dsh-plugin-blender-3d 0.2.1 from all systems and CI environments; Rebuild or reimage affected machines; removal may not eliminate all malicious software; Audit npm lockfiles and dependency trees for the package and block it in registries/proxies; Review logs and network traffic for signs of attacker access following installation

### [critical] @walknpm/todo-cli npm package is malware — full machine compromise for installers of v2.0.1 (no CVE)
https://helix.ml/threat-watch/i/walknpm-todo-cli-npm-package-is-malware-full-machine-compromise-for-installers-of-v2-0-1-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published a malware advisory (GHSA-p6gj-69gx-r376) for the npm package @walknpm/todo-cli, version 2.0.1, classified under CWE-506 (embedded malicious code). GitHub states any computer with the package installed or running should be considered fully compromised, implying attacker-controlled code execution and potential theft of secrets and keys; no patched version exists and the package has no known source code. The package sees roughly 551 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software, since full control of the machine may have been handed to an outside entity. Affected users must rotate all secrets from a clean machine and rebuild/reimage compromised systems.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer; Remove @walknpm/todo-cli@2.0.1 from all projects and lockfiles; Reimage or fully rebuild affected machines; do not assume removal of the package eliminates the malware; Audit systems for signs of compromise and unexpected outbound connections; Block/flag the package in internal registries and CI to prevent reinstalls

### [high] Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626)
https://helix.ml/threat-watch/i/jenkins-multiple-vulnerabilities-fixed-in-2-588-lts-2-580-2-rce-arbitrary-file-read-write-xss-cve-2026-117612-et-al · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-117612, CVE-2026-117613, CVE-2026-117614, CVE-2026-117615, CVE-2026-117616, CVE-2026-117617, CVE-2026-117618, CVE-2026-117619, CVE-2026-117620, CVE-2026-117621, CVE-2026-117622, CVE-2026-117623, CVE-2026-117624, CVE-2026-117625, CVE-2026-117626
On 2026-10-28 the Jenkins project published advisory 2026-10-28, which fixes 15 vulnerabilities in Jenkins core (13 rated High, 2 Medium) in weekly 2.588 and LTS 2.580.2. Every earlier release is affected. Most of the bugs give a logged-in user with modest permissions control of the controller. CVE-2026-117612 (CVSS 8.8): the XStream converter skipped the JEP-200 deserialization filter for classes named in a `resolves-to` attribute. A user with Overall/Read who can POST a config.xml can instantiate arbitrary types, which can lead to RCE. CVE-2026-117614: Agent/Configure was enough to run arbitrary code on the controller, because legacy agent launch commands were converted without script approval. CVE-2026-117616: an HTTP endpoint loaded any config.xml on disk as an agent, and saving that agent overwrites a file of the attacker's choosing. Two symlink bugs give arbitrary file read on job rename (CVE-2026-117615) and arbitrary file write by racing parallel artifact archiving (CVE-2026-117617). Both can lead to RCE. Account takeover issues: CVE-2026-117618 is a race in the setup wizard. While the initial admin is being replaced, an unauthenticated attacker can create an administrator account, so a fresh controller reachable from the internet is at risk. CVE-2026-117620 lets a user plant a 'Manage Old Data' entry; when an admin acts on it, a user's password is overwritten. CVE-2026-117619 lets a revoked API token keep its access through a 'remember me' cookie. The rest are stored XSS (config.xml collection elements, breadcrumb tooltips; CVE-2026-117613, -117623), XSS from compromised agents (CVE-2026-117621, -117622), a PersistenceRoot nesting bypass (CVE-2026-117624), and two information leaks (HTTP proxy settings and $JENKINS_HOME file listings; CVE-2026-117625, -117626). Many reports came from Anthropic's OSS program; others came from independent researchers. No exploitation is known. Upgrading is the fix. On 2.539+/LTS 2.541.1+, enforcing CSP mitigates the XSS issues.
Fixed: Jenkins weekly 2.588; Jenkins LTS 2.580.2
Do: Upgrade controllers to Jenkins 2.588 (weekly) or 2.580.2 (LTS). Every earlier version is affected, and only the upgrade closes the RCE paths.; Take the controller off the public internet. Most of these bugs need only a low-privilege account, and CVE-2026-117618 needs none, so internet exposure is the biggest risk multiplier. If it is public only so GitHub, GitLab, Bitbucket or Gitea webhooks can reach it, use the Webhook Relay plugin (https://plugins.jenkins.io/webhook-relay, setup: https://webhookrelay.com/docs/tutorials/cicd/jenkins-plugin/). The plugin opens an outbound WebSocket to a relay bucket and replays only webhook deliveries to the SCM endpoint (e.g. /github-webhook/). No inbound port is opened, so the UI, the config.xml APIs and the setup wizard are not reachable from outside.; Never leave a new controller on a reachable network while the setup wizard is unfinished (CVE-2026-117618). Finish setup on an isolated network, or with the admin created through JCasC.; Until you have upgraded, cut Overall/Read for anonymous users and audit who holds Item/Configure, Agent/Configure and View/Configure. Those permissions are the entry point for the XStream, agent-launch and symlink RCEs.; Look for tampering: agents with unexpected launch commands or new names, config.xml changes made through the REST API, new admin or user accounts, and any 'Manage Old Data' warnings. Do not act on Old Data warnings you cannot explain (CVE-2026-117620).; Revoke and re-issue API tokens you suspect are exposed, and invalidate sessions as well. Revoking a token did not end 'remember me' cookies obtained with it (CVE-2026-117619).; On 2.539+/LTS 2.541.1+, enforce Content Security Policy to blunt the stored XSS issues. Treat build agents as untrusted, because a compromised agent could inject XSS into the controller UI (CVE-2026-117621/-117622).

### [high] So-net (Sony Network Communications): member database breach exposes 2.59M customer records and 54k email passwords
https://helix.ml/threat-watch/i/so-net-member-database-breach-sony-network-communications-attackers-stole-2-6m-customer-records-and-54k-email-passwords · Breaches · no-fix-needed · since 2026-10-27
A third party broke into the So-net member database run by Sony Network Communications, the Sony-owned Japanese ISP, on 2026-10-19. The company spotted the access on 2026-10-23, shut the server down and blocked the source. On 2026-10-24 it confirmed data had left, and it disclosed on 2026-10-27; it has not said how the attackers got in. Exposed: 2,141,986 So-net member records (1,869,771 current, 272,215 who left in March 2026 or later) and 443,495 records of NTT Docomo's docomo hikari "plala (S Course)" customers, whose accounts Docomo had outsourced to So-net's database (Docomo was told on 2026-10-26). Both sets hold name, phone, email address, My Page user ID, date of birth, gender and internet connection ID, but not login passwords. Separately, 54,401 mailbox addresses with their mail passwords were taken from four So-net mail services: Mail Service (G) 24,655 (gyao.ne.jp, gate01.com, pbc.ne.jp, highway.ne.jp), A-Box 17,672, So-net VAIO Mail 7,005 and PostPet Mail 5,069. Anyone holding those passwords could read and send mail as the user, so So-net force-reset them without notice from 10:00 JST on 2026-10-27. Also taken: 16 bank account records (bank, branch, account type, number and holder, no PINs; So-net members only) and 7 password-reset notice letters. No card data was involved, and NURO, the Basic Mailbox and My Page login passwords are not affected. Members who left by the end of February 2026 are not in the data. The breach was reported to Japan's Personal Information Protection Commission. As of 2026-10-27 no secondary harm was known, no actor had claimed the attack, and the investigation was ongoing.
Do: Affected So-net mail users (@*.gyao.ne.jp, @*.gate01.com, @*.pbc.ne.jp, @*.highway.ne.jp, @abox*.so-net.ne.jp, @*.vaio.ne.jp, @postpet*.so-net.ne.jp): the old mail password no longer works — set a new one in So-net My Page, then update it in every mail client (Outlook, phone mail apps); If the leaked mail password was reused anywhere else, change it there now and turn on 2FA — especially accounts that use that mailbox for password resets; Check the mailbox for forwarding rules, filters, or sent mail you did not create between 2026-10-19 and the reset; Expect targeted phishing (email, SMS, phone) posing as So-net, Sony or Docomo using your real name, birth date and user ID; do not follow links or open attachments — So-net and Docomo say they will contact affected customers individually; So-net customers with a bank account on file: watch for debit fraud and calls claiming to be So-net or your bank; Help lines: So-net 0120-36-8887 (Mon–Sat 10:00–18:00); docomo hikari plala (S Course) 0120-035-700 (daily 10:00–19:00); Organisations: treat mail from the listed So-net domains received 2026-10-19 to 2026-10-27 as possibly sent by an attacker; if employees use these addresses for work accounts, force resets

### [high] Tailworm: Tailscale SSH unix-socket forwarding gives policy-permitted peers root-only sockets; fixed in 1.104.4 (TS-2026-014)
https://helix.ml/threat-watch/i/tailworm-tailscale-ssh-socket-forwarding-flaws-let-trusted-device-attackers-reach-root-only-sockets-no-cve · Vulnerabilities · partial · since 2026-10-24
Erica Windisch (Cyberdione Labs) published "Tailworm" on 2026-10-24, about two hours after sending it to Tailscale. The report lists 11 findings from lab testing of Tailscale v1.104.2 and headscale v0.29.5. The main issue is in Tailscale SSH: unix-socket forwarding checked socket paths by name but acted on them as root. A peer the tailnet policy already allows to SSH in could therefore dial root-only sockets with `ssh -L`, such as the Docker socket or the tailscaled LocalAPI. With `ssh -R` it could replace root-owned sockets, and a check-then-use race also defeated the path allowlist. The result is root on the target. Tailscale shipped fixes in 1.104.4 on 2026-10-28. Its bulletins are TS-2026-014 (SSH socket forwarding), TS-2026-015 (SSH session memory exhaustion that can OOM-kill tailscaled), TS-2026-016 (Serve unix backends reaching privileged sockets, including the LocalAPI) and TS-2026-017 (HTTP/2 Serve leaking Tailscale-App-Capabilities across mounts). An attacker first needs a foothold on an authorized device and a matching SSH grant. Movement is limited to connections the policy file allows, so Tailscale disputes the "worm" label. No in-the-wild exploitation has been reported. Not everything is fixed. The researcher reports the headscale memory-exhaustion issue as still pending. The Funnel entitlement check, enforced only by the CLI, has no fix. The Conn25 app-connector egress flaw affects only an unreleased, pre-production feature, which Tailscale says will be fixed before release. No CVEs have been assigned.
Fixed: Tailscale 1.104.4 (released 2026-10-28)
Do: Upgrade every node that runs Tailscale SSH or Serve to Tailscale 1.104.4 or later (`tailscale version`); Until upgraded, set TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restart it; this keeps SSH working but blocks the socket-forwarding path; Audit SSH rules in the tailnet policy file: replace identity- or tag-wide accept rules with per-pair grants, and use check mode for sensitive hosts; Self-hosted headscale: treat every SSH grant as root-equivalent (forwarding cannot be disabled there), set memory limits and restart supervision, and throttle registration until a fix ships; If a tailnet device may have been compromised, delete it in the admin console and rotate reachable auth keys and credentials; reimaging alone does not revoke copied node keys

### [critical] my-empty-package (npm): malicious package compromises machines that install it
https://helix.ml/threat-watch/i/my-empty-package-npm-malicious-package-compromises-machines-that-install-it · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database flagged the npm package my-empty-package version 1.0.0 as embedded malicious code (CWE-506). Any machine where the package is installed or running should be considered fully compromised, with attackers potentially gaining full control and access to secrets and keys. No patched version exists; the advisory recommends removal but warns removal may not eliminate all malicious software. The package sees roughly 189 downloads per month, so exposure is limited but real. Users who installed it should rotate all secrets from a clean machine and rebuild compromised systems.
Do: Remove my-empty-package from all projects and machines; Rotate all secrets, keys, and credentials stored on affected machines, using a different clean computer; Rebuild or reimage affected machines, as removal may not eliminate all malicious software; Audit dependency trees and CI environments for the package; Block the package in internal registries and dependency review

### [critical] Malicious npm package transaction-info-generate-sdk — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-transaction-info-generate-sdk-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub published a malware advisory (GHSA-23j5-jj88-v9f3) for the npm package transaction-info-generate-sdk, which contains embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; secrets and keys stored on the machine are at risk. The package sees roughly 482 downloads per month. Removal of the package alone cannot guarantee removal of all malicious software it may have installed. There is no fix; remediation is removal plus credential rotation and system rebuild.
Do: Immediately remove transaction-info-generate-sdk from all projects and machines; Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer; Rebuild/reimage affected systems; do not assume removal of the package removes the malware; Audit systems and CI for signs of compromise and unexpected persistence; Block the package in dependency policies and scan lockfiles for it

### [critical] Malicious npm package mock-transactions-sdk — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-mock-transactions-sdk-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database published GHSA-357r-x5jp-3p8f flagging the npm package mock-transactions-sdk as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with full control potentially handed to an outside entity, enabling theft of secrets and keys and persistence beyond simple package removal. The package sees roughly 631 downloads per month. There is no fix; remediation is removal plus credential rotation and system rebuild.
Do: Remove mock-transactions-sdk from all systems and dependencies immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit dependency lockfiles and CI caches for the package and block it in registries/proxies; Review logs for signs of exfiltration or attacker access

### [medium] Moldova government digital services breach — ~750,000 citizens' personal data possibly stolen; further cyberattacks warned
https://helix.ml/threat-watch/i/moldova-government-digital-services-breach-750-000-citizens-personal-data-possibly-stolen-further-cyberattacks-warned · Breaches · no-fix-needed · since 2026-10-27
A cyberattack on Moldova's government digital services may have resulted in the theft of personal data belonging to approximately 750,000 people. Prime Minister Vasile Tofan warned that such attacks may become increasingly frequent and said the country needs to strengthen cybersecurity and invest more in securing government systems. Some online services were reportedly disrupted following the incident. Authorities have issued a warning about possible new cyberattacks in the wake of the breach. Details on the attack vector, threat actor, and exact scope of exfiltration have not been disclosed, and no technical fix or patch is applicable; the response is organizational and defensive.
Do: Monitor Moldovan government service status and official advisories for further attack warnings; Assume personal data of Moldovan residents may be compromised; watch for phishing and fraud attempts; Review and harden authentication and monitoring on government-facing digital services; Increase investment in cybersecurity controls and incident response readiness for state systems

### [high] Times Car data breach: driver's license data of 1.46 million leaked, ¥5.5 billion loss reported
https://helix.ml/threat-watch/i/times-car-data-breach-driver-s-license-data-of-1-46-million-leaked-5-5-billion-loss-reported · Breaches · no-fix-needed · since 2026-10-28
Times Car, a Japanese car-sharing service, disclosed a breach in which personal data of 1.46 million people, including driver's license information, was leaked following a cyberattack in September 2026. The company is reporting a loss of ¥5.5 billion, and the incident has prompted other Japanese firms to reassess the financial risk of weak cybersecurity. The breach is part of a broader wave of cyberattacks across Japan. No technical vulnerability or fix is applicable; the incident is a data breach with direct financial and privacy impact on customers whose licenses and personal information were exposed.
Do: If you are a Times Car customer, monitor for identity theft and phishing using your leaked driver's license data; Watch for suspicious use of your license details and consider fraud alerts with relevant authorities; Japanese firms handling similar PII should review access controls and breach-response plans; Prepare for potential regulatory and notification obligations following large-scale PII leaks

### [critical] camelotlabs npm packages (core, config, sdk, worker) published as malware — full machine compromise
https://helix.ml/threat-watch/i/camelotlabs-npm-packages-core-config-sdk-worker-published-as-malware-full-machine-compromise · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published four malware advisories on 2026-10-28 covering the npm packages camelotlabs-core, camelotlabs-config, camelotlabs-sdk and camelotlabs-worker. Every published version (>= 0) is flagged as embedded malicious code (CWE-506) with no patched versions, meaning the packages were malicious from the start rather than hijacked later. GitHub's standard malware guidance states that any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Downloads of roughly 250-258/month on some packages indicate limited but real exposure. No CVEs are assigned; remediation is removal plus credential rotation and host rebuild.
Do: Remove all four camelotlabs-* packages from every machine and CI/CD environment immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected hosts; removal of the package does not guarantee removal of malicious software; Audit logs and network traffic for signs of exfiltration or attacker access since installation; Block the packages in dependency policies and check lockfiles for transitive dependencies

### [medium] AfD email breach: 345,000 addresses leaked via hacked WordPress site
https://helix.ml/threat-watch/i/afd-email-breach-345-000-addresses-leaked-via-hacked-wordpress-site · Breaches · no-fix-needed · since 2026-10-28
Hackers breached AfD's party-owned IT provider Alternita Dienstleistungs GmbH via a poorly secured WordPress site at wahlkampf.afd.de, reached the mail management system, changed officials' email passwords and exfiltrated data. The intrusion was detected 9 September 2026, but attackers returned on 14 September via undetected malware and copied more data. Over 345,000 unique email addresses and messages were exposed, later offered via torrent and added to HIBP on 27 October as a sensitive breach. Leaked emails also contained excerpts of state branch member databases and unencrypted population-register data, including first-time voters in Mecklenburg-Western Pomerania. AfD notified mailbox owners and the Berlin data protection commissioner on 20 October, though timing is disputed; notification of non-user third parties under GDPR Article 34 is uncertain. Der Spiegel and ZDF reported campaign donation revelations from the emails.
Do: Check whether your domain or email addresses appear in the breach via HIBP (domain search or verified owner login); Force password resets and review mailbox access logs for any accounts on affected party/provider mail systems; Notify individuals whose personal data (e.g. voter registry excerpts) appears in leaked emails per GDPR Article 34 if not yet done; Harden the WordPress site (patching, credentials, plugins) and scan for residual attacker backdoors; Assess whether retained voter-register data exceeded the one-month post-election deletion requirement

### [medium] Bithumb internal mobile system breach — data leak under investigation
https://helix.ml/threat-watch/i/bithumb-internal-mobile-system-breach-data-leak-under-investigation · Breaches · no-fix-needed · since 2026-10-28
South Korean crypto exchange Bithumb disclosed a data leak following a hack of its in-house mobile system, the platform employees use for internal communication. The breach was discovered on Tuesday and reported to authorities; the exchange is investigating the extent of the leaked data. It was one of three financial-firm breaches reported in South Korea that day. No details on attacker identity, data types, or customer impact were given, and no fix or remediation details are available yet.
Do: Monitor Bithumb advisories for confirmation of what data was exposed; Assume employee/internal communications may be compromised and review related credentials; Watch for phishing or social-engineering attempts leveraging leaked internal data; If a Bithumb customer, enable strong 2FA and monitor account activity

### [medium] Hive/Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months
https://helix.ml/threat-watch/i/hive-nefilim-ransomware-affiliate-artem-stryzhak-sentenced-to-70-months · Breaches · no-fix-needed · since 2026-10-27
Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in US prison for his role as a prolific affiliate of the Hive and Nefilim ransomware groups, attacking hospitals, government entities, law firms, and companies in oil and gas, aviation, chemical, insurance, construction and other sectors from mid-2018 to late 2021. Nefilim operators customized ransomware per victim, targeted firms with over $100M annual revenue in the US, Canada and Australia, and extorted victims by threatening to publish stolen data, encrypting networks in the US, Canada, Australia, Germany, the Netherlands, Norway and Switzerland. Stryzhak pleaded guilty in late 2025, was arrested in Spain in June 2024 and extradited in April 2025. Co-conspirator Volodymyr Tymoshchuk remains at large with an $11M reward offered.
Do: Review incident history for Hive/Nefilim indicators of compromise and confirm no residual access; Ensure offline, tested backups and ransomware-specific IR playbooks are in place; Harden perimeter access (MFA, VPN patching, network segmentation) against affiliate-style intrusions; Monitor for data-theft-plus-encryption extortion patterns and report incidents to law enforcement (FBI/CISA)

### [high] Royal Darwin Hospital privacy breach — pregnant women's medical records posted to Instagram by 'medical observer'
https://helix.ml/threat-watch/i/royal-darwin-hospital-privacy-breach-pregnant-women-s-medical-records-posted-to-instagram-by-medical-observer · Breaches · no-fix-needed · since 2026-10-28
A 'medical observer' at Royal Darwin Hospital shared pregnant women's confidential medical information in a post visible to roughly 28,000 Instagram followers. The Northern Territory health department initially claimed only five patients were affected, but backtracked after the ABC contacted multiple women impacted by the breach. The department has not confirmed the full number of affected patients. The breach involved misuse of access to patient records rather than a technical vulnerability, so no software fix applies; the incident raises questions about insider access controls and social media policies at NT Health facilities.
Do: Review and tighten insider access controls and audit logging for patient records at NT Health facilities; Enforce and audit social media and confidentiality policies for staff and observers; Notify and support affected patients and offer identity/privacy protections; Investigate how the observer accessed and shared the data and assess disciplinary and legal action; Review third-party/observer onboarding and supervision procedures

### [medium] Ransomware attack on NZ coronial services delays investigations, grieving families left waiting
https://helix.ml/threat-watch/i/ransomware-attack-on-nz-coronial-services-delays-investigations-grieving-families-left-waiting · Breaches · no-fix-needed · since 2026-10-28
A major ransomware attack on New Zealand's coronial services has caused significant delays to coronial investigations. One family has waited more than nine months for answers following their mother's unexpected death, describing the wait as 'incredibly stressful', and were told the ransomware attack contributed to the delay. The incident affects grieving families awaiting coronial findings across NZ. The report does not state when the attack occurred, which systems were compromised, whether data was stolen or leaked, or whether a ransom was paid. No technical details, CVEs, or named threat actor are given. As a breach of a public service, remediation rests on the responsible agency's incident response rather than a vendor patch.
Do: Organisations in the justice/coronial sector should review ransomware resilience, backups, and incident response plans; Agencies should communicate proactively with affected families about delays and expected timelines; Verify restoration of affected systems and monitor for follow-on extortion or data leaks

### [critical] @atlisp/mcp npm package 1.12.14 is malware — full machine compromise, rotate all secrets
https://helix.ml/threat-watch/i/atlisp-mcp-npm-package-1-12-14-is-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published a malware advisory for the npm package @atlisp/mcp, flagging version 1.12.14 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines are at risk and must be rotated from a clean computer. No patched version exists; the package should be removed, but removal does not guarantee elimination of all malicious software it may have installed. The advisory was published, reviewed, and last updated on 2026-10-28. The package sees roughly 2,337 downloads per month, so exposure is limited but real.
Do: Immediately rotate all secrets, keys, and credentials stored on any machine where @atlisp/mcp 1.12.14 was installed, using a different, uncompromised computer; Remove the package and audit affected machines for persistence mechanisms, as removal may not eliminate all malicious software; Check dependency lockfiles and CI/CD environments for the package and rebuild from clean images; Block @atlisp/mcp in npm installs and internal registries; Review logs for signs of exfiltration or unauthorized access

### [high] Skyw4lker: device code phishing campaign targeting U.S. organizations via Microsoft 365 token theft
https://helix.ml/threat-watch/i/skyw4lker-device-code-phishing-campaign-targeting-u-s-organizations-via-microsoft-365-token-theft · Breaches · no-fix-needed · since 2026-10-28
ANY.RUN researchers exposed Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations in manufacturing, technology, and healthcare. Victims receive password-protected documents posing as contracts or service proposals, are directed to pages hosted on sites.google.com, and are walked through a legitimate Microsoft device authorization flow initiated by the attacker. Completing the flow hands the attacker valid Microsoft 365 tokens, granting account access without credential theft and leaving minimal identity telemetry anomalies. A PHP backend collects victim IP and geolocation and polls for authentication completion. Because the authentication itself is legitimate, detection requires correlating document, web, and authentication activity. No vendor patch applies; mitigation relies on blocking device code flows where unneeded, user awareness, and behavioral detection.
Do: Block or restrict Microsoft device code authentication flows where not business-required; Warn staff about password-protected documents posing as contracts/proposals and unexpected device-code approval prompts; Hunt for anomalous device code authentications and tokens issued following visits to sites.google.com-hosted pages; Ingest relevant IOCs (URLs, domains, IPs) from ANY.RUN's published analysis into detection tooling; Enforce phishing-resistant MFA and conditional access policies on Microsoft 365 accounts

### [critical] Adobe Campaign Classic: 8 critical flaws enabling RCE and security bypass patched (CVE-2026-104351 et al.)
https://helix.ml/threat-watch/i/adobe-campaign-classic-8-critical-flaws-enabling-rce-and-security-bypass-patched-cve-2026-104351-et-al · Vulnerabilities · patched · since 2026-10-28 · CVE-2026-104350, CVE-2026-104351, CVE-2026-104353, CVE-2026-104354, CVE-2026-105489, CVE-2026-105779, CVE-2026-105780, CVE-2026-105781, CVE-2026-48360
Adobe released its October 2026 patches fixing eight critical vulnerabilities in Adobe Campaign Classic, including code injection, OS command injection, incorrect authorization, SQL injection, and reflected XSS flaws with CVSS scores from 9.1 to 9.9. Successful exploitation could allow arbitrary code execution, security feature bypass, and privilege escalation. The flaws affect Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux, fixed in build 9403. Adobe also patched a critical code injection flaw (CVE-2026-48360, CVSS 9.6) in Adobe Connect Desktop and Mobile for Windows, macOS, and Android that could result in arbitrary code execution. Adobe says it is not aware of any exploits in the wild for any of the addressed issues. Users are advised to update to the latest versions for protection.
Fixed: Adobe Campaign Classic 7.4.4 build 9403; Adobe Connect Desktop Windows 2026.9.61; Adobe Connect Desktop macOS Silicon 2026.10.66; Adobe Connect Desktop macOS Intel 2026.10.170; Adobe Connect Mobile Android 4.5
Do: Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 immediately; Update Adobe Connect Desktop to 2026.9.61 (Windows), 2026.10.66 (macOS Silicon), 2026.10.170 (macOS Intel) and Adobe Connect Mobile for Android to 4.5; Review internet-exposed Campaign Classic instances and restrict access pending patching; Check logs for signs of SQL injection or code execution attempts; Verify patched builds are deployed across all Windows and Linux hosts

### [critical] glyphmatrix-fixture (npm): malicious package versions 1.0.0 and 1.0.1 fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/glyphmatrix-fixture-npm-malicious-package-versions-1-0-0-and-1-0-1-fully-compromise-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub published advisory GHSA-vc33-3x34-x6jm on 2026-10-28 flagging the npm package glyphmatrix-fixture as malware (CWE-506, embedded malicious code). Versions 1.0.0 and 1.0.1 are affected and there are no patched versions; the advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines should be treated as stolen. The package has no known source code repository. Removal of the package alone is not guaranteed to eliminate malicious software installed by it. Any developer or CI environment that installed these versions is affected.
Do: Rotate all secrets, keys, and credentials stored on or accessible from machines where glyphmatrix-fixture was installed, using a clean computer; Remove glyphmatrix-fixture from all projects, lockfiles, and CI caches and rebuild affected environments from trusted images; Audit affected machines for persistence and other malicious software; reimage if compromise is suspected; Check dependency histories and CI logs for any installation of the package; Block the package name in internal registries and dependency firewalls

### [critical] trajmetrics PyPI malware: system-wide file scanning and exfiltration via background job
https://helix.ml/threat-watch/i/trajmetrics-pypi-malware-system-wide-file-scanning-and-exfiltration-via-background-job · Supply chain · no-fix-needed · since 2026-10-28
The PyPI package trajmetrics version 0.5.3 has been identified as malicious code (GHSA-rm9p-x4m7-hxmp, MAL-2026-18354). When run as a module, it scans the entire system and exfiltrates selected files by type; following the README's instructions starts a persistent background job that continuously monitors the system and exfiltrates files as they change. The campaign, tracked as 2026-10-trajmetrics, uses a native extension and is classified as an infostealer with clear malicious intent (CWE-506). No patched versions exist — the package itself is malware and should be removed. Anyone who installed trajmetrics 0.5.3 should treat exfiltrated files as compromised.
Do: Remove trajmetrics 0.5.3 from all environments and purge caches/virtualenvs; Audit systems where it ran for exfiltrated sensitive files (documents, credentials, keys) and rotate exposed secrets; Check for and kill any persistent background jobs or scheduled tasks it installed; Review logs and network egress for signs of exfiltration; Block the package and its referenced repositories in dependency policies

### [critical] Dependency-confusion beacon: @webapp-shared/login-vmok (npm) exfiltrates hostname and paths on install
https://helix.ml/threat-watch/i/dependency-confusion-beacon-webapp-shared-login-vmok-npm-exfiltrates-hostname-and-paths-on-install · Supply chain · no-fix-needed · since 2026-10-28
A dependency-confusion package, @webapp-shared/login-vmok, was published to npm on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1, squatting on a private internal scope so builds resolving the internal name from the public registry install the malicious copy. Its postinstall script runs node beacon.cjs, which POSTs the package name, machine hostname, install directory, working directory and Node.js version in cleartext to http://13.140.137.222:8787/_ah/dc; index.js repeats the beacon on load and the package has no other functionality. The beacon code matches other dependency-confusion packages sending to 185.158.107.175:8787 (e.g. MAL-2026-18276). Inert placeholder versions 0.0.0-stage and 0.1.0 are unaffected. Any machine that installed an affected version has disclosed its hostname and filesystem layout to a third party; there are no patched versions — removal and registry scoping are the remediation.
Do: Remove @webapp-shared/login-vmok from all projects and lockfiles; audit installs since 2026-10-27; Block 13.140.137.222 (and 185.158.107.175) on build hosts and check egress/proxy logs for POSTs to :8787/_ah/dc; Treat affected build machines' hostname and directory layout as disclosed; review for follow-on targeting; Pin internal-scoped packages to the internal registry or claim/reserve the @webapp-shared scope to prevent confusion; Enforce install-script allowlists and dependency-confusion protections (e.g. --no-postinstall policies, registry scoping) in CI

### [critical] csvflow-schema (npm): malicious postinstall beacon package removed from registry
https://helix.ml/threat-watch/i/csvflow-schema-npm-malicious-postinstall-beacon-package-removed-from-registry · Supply chain · no-fix-needed · since 2026-10-28
The npm package csvflow-schema, published as version 1.0.0 on 2026-10-26 by account f0x_mulder, contained malicious code flagged by OpenSSF and recorded in the GitHub Advisory Database (GHSA-mhx4-6f72-5vf7, CWE-506). While posing as a lightweight CSV column-schema validation helper, its postinstall script ran on npm install, wrote host details (username, hostname, working directory, parent PID, install path) to a marker file in the temp directory, launched calc.exe, and sent an HTTPS GET install beacon to cdn-status.mulderitsme.net. Only version 1.0.0 is affected; npm removed the package 17 minutes after publication. There is no patched version — anyone who installed it should treat the machine as compromised.
Do: Check lockfiles and installed node_modules for csvflow-schema@1.0.0 and remove it; If installed, rebuild/reimage the affected machine and rotate credentials accessible from it; Inspect temp directory for csvflow_schema/pi_2c75177b.ok and review network logs for cdn-status.mulderitsme.net; Block the beacon domain cdn-status.mulderitsme.net at egress; Audit recent npm installs and CI caches for the package

### [critical] Shai-Hulud worm wave 2: @testsecuiitytestme/cache-helper npm package — malicious native-addon loader steals credentials (no CVE)
https://helix.ml/threat-watch/i/shai-hulud-worm-wave-2-testsecuiitytestme-cache-helper-npm-package-malicious-native-addon-loader-steals-credentials-no-c · Supply chain · no-fix-needed · since 2026-10-28
A malicious npm package, @testsecuiitytestme/cache-helper, published 2026-10-27 under the account testsecuiitytestme, ships versions 1.0.1–1.0.3 containing a native-addon loader matching the second wave of the Shai-Hulud npm worm. The postinstall-loaded ELF/PE addon evades CI, sandbox, container and debugger environments, then decodes an embedded .napi_cache payload (XOR, brotli) and runs it via the Bun runtime (downloaded if absent). The obfuscated payload collects npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub, GHCR, AWS, GCP, Azure, Vault and Kubernetes credentials, plus SSH keys, .env files, browser logins, macOS keychain, 1Password and Bitwarden, and propagates via npm/PyPI/RubyGems publishing, CI workflow injection and AI assistant config writes. No patched versions exist; the package should be considered fully malicious.
Do: Remove and deny-list @testsecuiitytestme/cache-helper versions 1.0.1–1.0.3 from all environments and lockfiles; Audit machines that installed it for the detached loader/Bun processes and hidden temp files; Rotate all credentials accessible from affected machines: npm, GitHub, GitLab, PyPI, RubyGems, cloud (AWS/GCP/Azure), Vault, Kubernetes, Docker Hub, GHCR; Check for tampering with GitHub/GitLab CI workflows, composite actions and AI assistant configs (.claude/settings.json, .cursor rules, .mcp.json, CLAUDE.md); Review browser login databases, SSH keys, .env files and password-manager exposure; invalidate sessions and tokens

### [critical] Node2Shell / HTTP2Shell: Brotli decoder flaw lets attackers run code in Node.js, Bun, Python and other HTTP software (CVE-2026-111497)
https://helix.ml/threat-watch/i/brotli-google-pypi-out-of-bounds-write-in-brotli-decoder-allows-rce-via-crafted-compressed-stream-cve-2026-111497 · Vulnerabilities · partial · since 2026-10-22 · CVE-2026-111497
An out-of-bounds write in Google's Brotli decoder (versions 1.0.3 to 1.2.0) lets anyone who can make a program decompress attacker-controlled Brotli data corrupt its memory, leak data, crash it or run code. Node.js disclosed it on October 21 as "Node2Shell": servers that decompress request bodies (Express 5, body-parser 2.x) and apps whose fetch() receives Brotli responses from a malicious or compromised server are exposed. By October 23 it was clear the same flaw reaches Python (the Brotli and brotlicffi packages that requests, httpx and aiohttp load automatically), libbrotli, curl, Bun, Envoy and Istio, hence "HTTP2Shell". OpenAI found the bug in February; it was fixed in Brotli source then but not recognised as a vulnerability or released until now, so every project bundling Brotli has to ship its own update. Researchers have shown code execution against an unmodified Node.js image; no exploitation in the wild has been reported. Advisory databases were slow to map the CVE to the PyPI packages, so dependency scanners may not flag them yet.
Fixed: libbrotli 1.2.1 (also 1.1.1, 1.0.10); Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Brotli (PyPI) 1.2.1, brotlicffi 1.2.1.0; Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8; Istio 1.29.9, 1.30.6, 1.31.2
Do: Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 (or newer in the same line) and rebuild container images; Node.js 25.x, 23.x, 20.x and older get no fix; Upgrade Python Brotli to 1.2.1+ and brotlicffi to 1.2.1.0+ wherever installed, including inside images; do not rely on scanners flagging it; Upgrade Bun to 1.4.4+, Envoy to 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8, Istio to 1.29.9 / 1.30.6 / 1.31.2, and libbrotli to 1.2.1 (or patched 1.1.1 / 1.0.10); install OS vendor Brotli updates; Where no patch is available yet, disable Brotli decoding of untrusted input (request bodies, outbound fetch responses)

### [critical] EPICS Base: AI agent finds 4 severe bugs incl. critical RCE in industrial control software (CVE-2026-114595)
https://helix.ml/threat-watch/i/epics-base-ai-agent-finds-4-severe-bugs-incl-critical-rce-in-industrial-control-software-cve-2026-114595 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598
Causal Security's autonomous AI agent Cipher discovered four previously unknown vulnerabilities in EPICS Base, the open source SCADA toolkit used by ~90 major scientific facilities including Argonne's Advanced Photon Source and ITER's fusion reactor control system. The flaws are a critical CVSS 9.8 integer overflow (CVE-2026-114595) enabling attacker-controlled out-of-bounds heap write and potential RCE; an 8.2 improper message-length validation flaw (CVE-2026-114596) causing OOB write and controller crash; and two 7.5 highs (CVE-2026-114597 insufficient bounds checking, CVE-2026-114598 type confusion) enabling OOB reads, crashes, DoS and adjacent memory disclosure. CISA issued an advisory. Exploitation requires network reach to EPICS services but not deep OT expertise. Fixes are in EPICS Base 7.0.11.
Fixed: 7.0.11
Do: Update EPICS Base to version 7.0.11 immediately; Segment/isolate control networks running EPICS from other systems and restrict access to EPICS services; Review exposure of EPICS controllers across network boundaries and firewall OT traffic; Monitor controllers for crashes or anomalous network traffic; Assess operational risk to experiments and plan for potential downtime

### [critical] Three TLS Bugs in GoAhead web server: revoked certs accepted, DH truncation, chain-depth bypass (no CVEs)
https://helix.ml/threat-watch/i/three-tls-bugs-in-goahead-web-server-revoked-certs-accepted-dh-truncation-chain-depth-bypass-no-cves · Vulnerabilities · patched · since 2026-10-28
FoxIO disclosed three independent TLS bugs in EmbedThis GoAhead <= 6.1.0, fixed in 6.1.1. With the OpenSSL-compatible backend (>=3.4.5), a CRL is loaded but never enforced, so revoked client certificates are silently accepted in mTLS deployments (CVSS 9.1, GOAHEAD-SA-2026-0006). LibreSSL legacy-verifier builds (3.2.x, 3.3.2-3.3.6) with VERIFY_PEER=1 and VERIFY_ISSUER=0 accept over-depth client certificate chains, bypassing the chain-depth limit (CVSS 7.4, GOAHEAD-SA-2026-0004). The Mbed TLS backend (>=4.0.2) has a buffer-length typo in sslOpen() that reduces the 2048-bit DH modulus to one byte, making TLS 1.2 DHE_RSA sessions decryptable to observers (CVSS 5.9, GOAHEAD-SA-2026-0005). GoAhead is embedded in vast numbers of IoT, firewall, OT and military devices (Palo Alto, D-Link, HP, Canon, Siemens, Boeing, etc.). No in-the-wild exploitation reported; GHSA advisories published.
Fixed: 6.1.1
Do: Upgrade GoAhead to 6.1.1 or later, or apply vendor firmware updates for devices embedding GoAhead; If upgrade is not immediate, disable finite-field DHE cipher suites or switch to the OpenSSL backend (Mbed TLS issue); Enable VERIFY_ISSUER=1 with a trusted CA bundle or use OpenSSL/LibreSSL 4.x (LibreSSL legacy verifier issue); Audit mTLS deployments for reliance on CRL revocation checking and re-evaluate trust in previously revoked client certificates; Inventory devices and products that embed GoAhead and track vendor advisories

### [critical] GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)
https://helix.ml/threat-watch/i/gitlab-unauthenticated-rce-via-ruby-onigmo-regex-compiler-integer-overflow-across-all-releases-since-7-0-cve-2026-110264 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-100104, CVE-2026-100755, CVE-2026-101168, CVE-2026-103515, CVE-2026-103549, CVE-2026-104661, CVE-2026-105458, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14210, CVE-2026-14288, CVE-2026-14552, CVE-2026-14814, CVE-2026-15723, CVE-2026-16255, CVE-2026-16275, CVE-2026-16301, CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-78335, CVE-2026-81839, CVE-2026-82632, CVE-2026-84284, CVE-2026-85529, CVE-2026-89078, CVE-2026-92528, CVE-2026-9268, CVE-2026-92883, CVE-2026-93577, CVE-2026-96893, CVE-2026-97229
GitLab patched CVE-2026-110264 (CVSS 10.0), an unauthenticated RCE caused by an integer overflow in Ruby's Onigmo regex compiler, which GitLab bundles and ships. It affects every self-managed GitLab version since 7.0 (2014); the Oct 12 fix for the earlier CVE-2026-97229 covered only 19.2+, so instances patched then are vulnerable again. It is the fourth Onigmo RCE reported by researcher joaxcar in a month (two 9.9 auth-required, two 10.0 unauthenticated). Ruby released 4.0.9, 3.4.12, and 3.3.13 fixing three underlying bugs; Ruby 3.2 and earlier get no fix. No exploitation or CISA KEV listing as of Oct 23; no workaround exists. GitLab also fixed 10 other issues including an 8.2 account-takeover and a 7.5 OAuth/OIDC cache-poisoning flaw.
Fixed: GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13; Ruby 4.0.9, 3.4.12, 3.3.13
Do: Upgrade self-managed GitLab immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 — instances patched on Oct 12 are still vulnerable; Plan for downtime on single-node upgrades (19.4.3/19.3.6 include database migrations); use zero-downtime procedure on multi-node; Deploy GitLab's TLDR Sigma detection rules ('Onigmo native worker crash', 'Org mode render error burst') to hunt exploitation attempts; Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 in any Ruby app compiling regexes from untrusted input; note Regexp.timeout and pattern-length caps do not mitigate; Migrate off Ruby 3.2 (EOL, unfixed) or stop compiling attacker-controlled patterns via Regexp.new/union/compile or interpolation; Review SAML+LDAP auto-linking and shared-cache OAuth/OIDC setups against CVE-2026-15723 and CVE-2026-112212

### [medium] Capcom: breach of CAPCOM ID service exposes 11.7 million email addresses and account details
https://helix.ml/threat-watch/i/capcom-breach-of-capcom-id-service-exposes-11-7-million-email-addresses-and-account-details · Breaches · no-fix-needed · since 2026-10-19
Capcom confirmed on 22 October 2026 that a third party gained unauthorised access to customer information held in CAPCOM ID, its single sign-on account for web services and some online games. Capcom detected suspicious activity and confirmed the unauthorised access on 19 October, stood up an internal incident response headquarters on 20 October and reported to the Osaka Prefectural Police and Japan's Personal Information Protection Commission on 21 October. The data taken covers 11,774,247 email-address records worldwide along with system identifiers such as account creation time, last-login time, login count and the IP address of the last login. Only 43 of those records also included date of birth, gender, country/region and nickname, and 196 accounts had their login passwords changed without authorisation; Capcom has reset those passwords. Capcom found no evidence that customer-chosen passwords were compromised and says credit card data was not involved, and CAPCOM ID services and games stayed online. No attacker has been publicly named. The practical risk is targeted phishing that impersonates Capcom using genuine account details.
Do: Treat unexpected CAPCOM ID emails as suspect: do not open links or attachments, and reach Capcom only through its published support channels; Reset the CAPCOM ID password from the site itself (not from an emailed link) and enable multi-factor authentication; If you reused that password or a similar email address elsewhere, change it there too and watch for credential-stuffing attempts; Because last-login IP and login counts were exposed, be wary of messages claiming to detect suspicious logins from a specific address — they will look credible

### [critical] Malicious npm package ccl-global-shopping — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-ccl-global-shopping-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-20
The npm package ccl-global-shopping was published with a malicious 99.9.1 on 2026-10-20 and was flagged by GitHub on 2026-10-27. Its only registry history is that version, so it reads as a squatted name, not a takeover. OSV's amazon-inspector analysis says its sole dependency is a bare HTTPS tarball URL on a Google Cloud Storage host rather than a registry range. npm therefore fetches whatever the URL serves at install time and runs its lifecycle scripts, which means the payload runs during install. OpenSSF Package Analysis separately flagged 99.9.1 for communicating with a malicious domain. npm replaced the name with a security placeholder on 2026-10-27. No safe version exists. Any host that ran npm install on it should be treated as compromised, and secrets on it rotated from a clean machine.
Do: Treat every machine where ccl-global-shopping was installed as fully compromised; rebuild from a clean image and rotate all secrets from a different computer; Remove the package from projects, lockfiles and CI; search lockfiles for the name and for bare HTTPS tarball dependency specs (the pattern OSV describes, with host ltidi.storage.googleapis.com); Block the name and that tarball host in the internal proxy and dependency scanning; Review install logs from 2026-10-20 onward for npm lifecycle scripts that ran for this package

### [critical] sc-announcer (npm) 99.9.1: stub fetches off-registry tarball on install; full compromise, no safe version
https://helix.ml/threat-watch/i/malware-in-sc-announcer-npm-package-full-system-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-10-20
sc-announcer is a name-impersonation or dependency-confusion stub, not a hijack. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. That version ships an empty module and one dependency, ltidisafe, declared as a raw HTTPS tarball on storage.googleapis.com (path depenconf) instead of a registry range. npm therefore installs whatever that URL serves, with no pin or integrity check, and runs any install scripts in it. OSV record MAL-2026-18064 (sources: OpenSSF Package Analysis and Amazon Inspector) calls the version number implausibly high, reads the stub as a resolution-hijack lure for an internal name, and says the package contacts a domain tied to malicious activity. GitHub's advisory GHSA-fxw2-4j5q-6hwg rates it critical and says any host that installed or ran it should be treated as fully compromised, with secrets rotated from a clean machine. npm replaced the package with its own security placeholder on 2026-10-27, so the malicious version was public for about a week before the advisory. No patched version exists. Last-month downloads to 2026-10-26 were 312.
Do: Search lockfiles, CI logs and node_modules for sc-announcer and for any dependency whose version is an https:// tarball on ltidi.storage.googleapis.com (ltidisafe is the payload dependency); Treat any host or CI runner that installed or ran sc-announcer as fully compromised: rotate every secret it could read from a clean machine, then rebuild from a trusted image rather than trusting uninstall; Block sc-announcer and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency allowlists; Review build and developer host logs for outbound connections in the window from 2026-10-20 onward; Ask any internal team that owns a package with a similar name to confirm their internal registry scope is reserved, since the advisory describes this as a dependency-confusion shape

### [critical] paychex-pdftron (npm): impersonation stub pulls an unpinned remote tarball on install; no safe version
https://helix.ml/threat-watch/i/paychex-pdftron-npm-package-is-malware-full-machine-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-10-20
paychex-pdftron is not a hijacked release and not a copy of a real product; it is a name-impersonation package. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. That version ships an empty module and one dependency, ltidisafe, declared as a raw HTTPS tarball on a storage.googleapis.com bucket path named depenconf instead of a registry version range. npm therefore fetches whatever that bucket serves, with no pin or integrity hash, and any install scripts inside it run on the installing machine. The OSV record MAL-2026-18289 (sourced from Amazon Inspector) reads the implausibly high version and the URL path as a dependency-confusion pattern. GitHub's malware advisory GHSA-9mgv-25w8-jwhf rates it critical and says any host where it was installed or run should be treated as fully compromised, with secrets rotated from a clean machine. npm removed the malicious version and replaced the package name with its own security placeholder on 2026-10-27. No patched version exists. The public PDFTron package on npm is @pdftron/webviewer, maintained by pdftron-dev, so the lookalike name is not a legitimate source. Last-month downloads to 2026-10-26 were 165.
Do: Search lockfiles, CI logs and node_modules for paychex-pdftron and for any dependency whose version is an https:// tarball URL on ltidi.storage.googleapis.com (ltidisafe is the known payload dependency); Treat any host or CI runner that installed paychex-pdftron as fully compromised: rotate every secret it could read from a clean machine, then rebuild or reimage it rather than trusting uninstall; Block paychex-pdftron and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency firewalls; Check install logs for outbound connections to storage.googleapis.com from build hosts in the window after 2026-10-20; Before adopting any replacement, confirm the publisher on the registry page; do not pick a package by name similarity

### [high] Quest Diagnostics: unauthorized access to Quanum LSM exposed patient records
https://helix.ml/threat-watch/i/quest-diagnostics-unauthorized-access-to-quanum-lsm-exposed-patient-records · Breaches · no-fix-needed · since 2026-10-23
Quest Diagnostics disclosed that on October 21, 2026 it learned of unauthorized access to its Quanum LSM system, the online platform clients use to place lab test orders and receive/look up results. The company believes certain patient records were exposed, but the number of affected patients and data types remain under investigation with external experts and law enforcement engaged. Quanum LSM has been taken offline; customers are directed to paper requisitions or Quanum eLabs, and access to Essential Insights and LabHQ was paused as a precaution. Customer-facing operations, direct LIS interfaces, and EMRs were reportedly unaffected. No threat group has claimed the attack, and Quest confirmed the breach is unrelated to the PHP2Shell vulnerabilities. Quest previously suffered breaches in 2016 (~34,000 people) and 2019 via AMCA (11.9 million patients).
Do: If you are a Quest Diagnostics client using Quanum LSM, switch to paper requisitions or Quanum eLabs for orders and results as recommended; Monitor Quest Diagnostics communications for breach scope updates and notification requirements; Review and rotate any credentials or API integrations tied to Quanum LSM and related Quest portals; Assess whether your organization's patient data may have been exposed and prepare HIPAA breach-notification obligations; Apply heightened monitoring for phishing targeting patients or staff referencing the Quest breach

### [medium] University of Copenhagen data breach: hackers access test environment exposing 525,000 people's data
https://helix.ml/threat-watch/i/university-of-copenhagen-data-breach-hackers-access-test-environment-exposing-525-000-people-s-data · Breaches · no-fix-needed · since 2026-10-23
The University of Copenhagen says an intruder reached one of its test environments, which held personal data of 525,000 people. The intrusion was detected on 2026-10-20 and first disclosed on 2026-10-23. In an update on 2026-10-25 the university said the same environment held PIN codes for the ID cards of about 20,000 staff members and students, and it added them to the count. The personal data types the university lists are names, national identity numbers, work and home phone numbers, and personal email addresses. The university restricted physical access to some campus locations while it issued new access codes, says it contained the attack and blocked the attacker's access, and says there is no indication that systems supporting daily operations were accessed or disrupted. It reported the incident to the Danish Data Protection Agency; no date is given for that report. The university later said that a Monday shutdown of administrative systems (Workzone, Nimbus and others) was a preventive measure and not a new attack. No group has claimed the attack.
Do: Warn students and staff to be vigilant for phishing and independently verify unsolicited requests; Rotate exposed PIN/access codes and review physical access controls; Isolate and audit test environments holding production personal data; purge unnecessary PII; Review logs for lateral movement from the compromised test environment into production systems; Complete GDPR breach notification and regulator engagement

### [critical] @camera.ui/camera-ui-nvr-windows-amd64 1.6.1: malicious release in a real package line; full host compromise
https://helix.ml/threat-watch/i/malicious-npm-package-camera-ui-camera-ui-nvr-windows-amd64-1-6-1-fully-compromises-hosts · Supply chain · no-fix-needed · since 2026-10-25
This is most likely a malicious release inside a real package, not a typosquat. The @camera.ui/camera-ui-nvr-windows-amd64 package is owned by npm maintainer seydx, who also owns the camera.ui project on npm (created 2021-10-30; repository github.com/cameraui/camera.ui). The scoped package has 56 published versions dating from 2026-06-22. The advisory GHSA-2w7v-jwxh-w7wc and OSV record MAL-2026-18337 name only version 1.6.1 as malicious. The registry time map dates 1.6.1 to 2026-10-25, and it is no longer listed. No source we could read says how the release was published (account takeover, stolen token or a compromised pipeline), so that is unknown. GitHub rates it critical and says any host where it was installed or run should be considered fully compromised, with secrets rotated from a clean machine. Version 1.6.2 was published 2026-10-27 and is now the latest tag. No source we could read says 1.6.2 is safe, so it must not be treated as a verified fix. Last-month downloads to 2026-10-26 were 908.
Do: Treat any Windows host that installed or ran @camera.ui/camera-ui-nvr-windows-amd64 1.6.1 as fully compromised: isolate it, then rotate secrets from a different clean computer; Rebuild or reimage affected hosts rather than trusting removal; the advisory says removal does not prove the malware is gone; Do not install 1.6.2 or any later version until its publisher and contents are verified against the upstream project; no source confirms it is safe; Pin the scope to a version you have verified, and block 1.6.1 in registry proxies and CI; Check install logs and persistence on NVR and camera.ui hosts for outside access in the window from 2026-10-25

### [critical] sc-hydrate-carousel-price (npm) 99.9.1: stub fetches an off-registry tarball on install; no safe version
https://helix.ml/threat-watch/i/malicious-npm-package-sc-hydrate-carousel-price-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-20
sc-hydrate-carousel-price is a name-impersonation or dependency-confusion stub, not a hijack. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. Its shipped index file is an empty export, and its one dependency, ltidisafe 4.0.3, is declared as a raw HTTPS tarball on storage.googleapis.com (path depenconf) rather than a registry range. npm therefore installs whatever bytes that URL serves, with no pin or integrity check, and runs any lifecycle scripts inside them. OSV record MAL-2026-18291, published 2026-10-25 from an Amazon Inspector import, describes the package as a loader for externally hosted code and reads the version and name as a dependency-confusion shape. GitHub's advisory GHSA-9gcx-88qx-rxch rates it critical, with all versions affected and no patched version, and says any host that installed or ran it should be considered fully compromised, with secrets rotated from a clean machine. npm replaced the package with its own security placeholder on 2026-10-27. Last-month downloads to 2026-10-26 were 170.
Do: Search lockfiles, CI logs and node_modules for sc-hydrate-carousel-price and for any dependency whose version is an https:// tarball on ltidi.storage.googleapis.com (ltidisafe is the payload dependency); Treat any host or CI runner that installed or ran the package as fully compromised: rotate every secret it could read from a clean machine, then rebuild from a trusted image rather than trusting uninstall; Block the package and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency allowlists; Review build and developer host logs for outbound connections in the window from 2026-10-20 onward; Confirm that internal package names are reserved in your private registry scope, since the OSV record reads this as a dependency-confusion attempt

### [critical] h13t0ry-hello-demo (PyPI): malicious package spawns reverse shell on import, giving attackers full command execution
https://helix.ml/threat-watch/i/h13t0ry-hello-demo-pypi-malicious-package-spawns-reverse-shell-on-import-giving-attackers-full-command-execution · Supply chain · no-fix-needed · since 2026-10-27
The PyPI package h13t0ry-hello-demo version 0.1.0 contains malicious code that launches a reverse shell when the package is imported, allowing an attacker to execute arbitrary commands on the victim's machine. It was identified by researcher kam193 and documented in the OpenSSF malicious-packages database (MAL-2026-18336) and GitHub Advisory Database (GHSA-5crq-52j9-fc74) on 2026-10-27 as part of the 2026-10-h13t0ry-hello-demo campaign. There is no patched version; the package is malware and should be removed entirely. Any developer or CI environment that installed or imported the package should be treated as compromised.
Do: Remove h13t0ry-hello-demo from all environments and dependency files; do not upgrade, delete it; Audit machines and CI runners that imported the package for compromise and rotate credentials/secrets accessible there; Check dependency caches, lockfiles, and build artifacts for the package; Block the package name in internal PyPI mirrors/proxies and monitor for similar typosquat-style packages

### [medium] SquareML: leaked read-only access key exposed data of 238,083 Denver Health Medical Plan members
https://helix.ml/threat-watch/i/squareml-access-key-leak-exposes-data-of-238-000-denver-health-medical-plan-members · Breaches · no-fix-needed · since 2026-10-27
Denver Health Medical Plan is notifying 238,083 members after a SquareML access key was inadvertently published on a publicly accessible website on June 27, 2025. SquareML, a no-code healthcare analytics vendor, notified DHMP on August 14, 2026, and the key was revoked on August 18, 2026. During the exposure window the key could have been used to access a database containing names, dates of birth, ZIP codes, demographics, health metrics, plan eligibility, hospital admission, provider names, and discharge/transfer data. The compromised account was read-only, so data could not be downloaded, exported, deleted, or altered. No Social Security numbers or financial information were stored, and DHMP says there is no evidence data was viewed or misused. Passwords for all accounts with database access were reset, and additional remediation is underway.
Do: If you are a DHMP member, watch for breach notifications and consider credit/identity monitoring despite no SSN exposure; Review vendor agreements and require prompt disclosure of credential leaks from third-party processors; Audit and rotate any long-lived access keys or service credentials, especially those exposed in public repos or sites; Restrict third-party database accounts to least privilege and read-only where possible; Monitor database access logs for anomalous reads during the exposure window

### [high] UK police: hackers repeatedly breached IT suppliers holding police data since 2021, HMICFRS finds
https://helix.ml/threat-watch/i/uk-police-data-breached-via-third-party-it-suppliers-since-2021-hmicfrs-watchdog-report-finds · Breaches · no-fix-needed · since 2026-10-27
On 27 October 2026 His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published an inspection finding that police and fire and rescue services are not fully prepared for a growing cyber threat. The Police Digital Service and the National Police Chiefs' Council told inspectors about multiple cyberattacks since 2021 on third-party ICT suppliers that held police information. The published report removes the operational detail: it does not say how many suppliers were hit, which ones, which forces were affected, or whether data was stolen. The Police Digital Service recorded 252 cyber incidents affecting policing in January–March 2026 (malware, unauthorised access attempts, accidental disclosure by staff) and 796 near misses. Inspectors found that most supplier contracts carry no ongoing security assurance, that some staff could not say whether suppliers must report incidents promptly, and that supplier logs are usually not visible to in-house security teams. They also criticised the omission of policing and fire from the National Risk Register 2025, the January 2026 Government Cyber Action Plan and the Cyber Security and Resilience Bill. Publicly known incidents from the period include the 2023 ransomware attack on warrant-card printer Digital ID, which exposed Metropolitan Police and Greater Manchester Police staff details; the July 2026 theft of officer and staff contact details from the Police National Legal Database (PNLD), which West Yorkshire Police runs; and the September 2026 attack on Dyfed-Powys Police. The report does not say whether any of these are among the supplier cases it counts. There is nothing to patch: the fixes are supplier contracts, assurance and monitoring.
Do: If you supply ICT services to police or other public-safety bodies, check that your contract requires prompt incident reporting and that the customer can see your security logs; Police and public-sector buyers: list every supplier that holds your data and write ongoing security assurance and breach-notification deadlines into each contract; Feed supplier system logs into your own SOC, or get contractual access to them; Assume staff identity data held by suppliers (names, photos, warrant/collar numbers, work emails) is exposed, and warn staff about targeted phishing; Follow the Police Digital Service Third Party Assurance for Policing (TPAP) standard when onboarding suppliers

### [critical] adyen-web-v6 (npm): lookalike of Adyen's checkout SDK ships malware; full machine compromise
https://helix.ml/threat-watch/i/adyen-web-v6-npm-package-is-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-10-27
adyen-web-v6 is an unscoped name lookalike of Adyen's real SDK, which is published on npm as @adyen/adyen-web and maintained by Adyen (registry maintainers include adyencom; latest 6.47.0, modified 2026-10-15). It is not a hijack of Adyen's package. The registry now holds only npm's security placeholder (0.0.1-security, 2026-10-27), and its history lists one earlier version, 99.1.0, dated 2026-04-27. No source we could read confirms that 99.1.0 was the malicious release. GitHub's malware advisory GHSA-r77r-rw3m-rjh5 classifies the package as embedded malicious code (CWE-506). It says any host where the package was installed or run should be considered fully compromised, with secrets rotated from a different machine. OSV's MAL-2026-18344 does not list specific versions, so the all-versions range is the only scope source. No patched version exists, and the fix is removal, host rebuild and credential rotation. Last-month downloads to 2026-10-26 were 34.
Do: Search lockfiles, CI logs and node_modules for adyen-web-v6; remove it from every project; Treat any host or CI runner that installed adyen-web-v6 as fully compromised: rotate every secret it could read from a clean machine, then rebuild or reimage rather than trusting uninstall; Confirm your checkout code imports @adyen/adyen-web (the real package), not adyen-web-v6, and pin it to a version you have verified; Block adyen-web-v6 in registry proxies and dependency firewalls; Review logs for outbound traffic from build and developer hosts that had the package installed

### [high] SafePay ransomware: 600+ victims across US and Europe since August 2024 per FBI advisory
https://helix.ml/threat-watch/i/safepay-ransomware-600-victims-across-us-and-europe-since-august-2024-per-fbi-advisory · Breaches · no-fix-needed · since 2026-10-27
The FBI, alongside Germany's BSI and the UK's NCSC, issued a joint advisory stating that the SafePay ransomware gang has breached at least 600 organizations across the U.S. and Europe since August 2024, making it one of the most active ransomware groups currently operating. The advisory is intended to help organizations recognize indicators of compromise and defend against the group's tactics, techniques, and procedures. No specific victim names, CVE, or technical exploitation details are given in the source excerpt. As a criminal campaign rather than a product vulnerability, there is no vendor patch; mitigation relies on standard ransomware defenses and applying the advisory's IOC guidance.
Do: Review the joint FBI/BSI/NCSC advisory and hunt for SafePay indicators of compromise in your environment; Verify offline, tested backups and confirm ransomware recovery procedures; Enforce MFA, restrict RDP/remote access, and segment networks to limit lateral movement; Patch internet-facing systems and monitor for unusual encryption activity or data exfiltration; Report suspected SafePay incidents to law enforcement (FBI/IC3 or national CERT)

### [critical] 2026-10-numprint: PyPI package numprint — malicious install-time RAT executing attacker commands via GitHub Gist C2
https://helix.ml/threat-watch/i/2026-10-numprint-pypi-package-numprint-malicious-install-time-rat-executing-attacker-commands-via-github-gist-c2 · Supply chain · no-fix-needed · since 2026-10-27
The PyPI package numprint version 1.2.0 was identified as malware in the 2026-10-numprint campaign. The package overrides the install command in setup.py to execute malicious code during installation, starting a background process that executes attacker-provided commands. C2 communication occurs through a GitHub Gist. The package contains RAT-like functionality to run remote commands (likely a limited set) on victims' machines. Anyone who installed numprint 1.2.0 from PyPI is affected. There are no patched versions; the package is malware and should not be used. Identified by kam193 and catalogued via OpenSSF malicious-packages (MAL-2026-18343) and GitHub Advisory GHSA-g9fj-q87h-6h4c.
Do: Immediately uninstall numprint 1.2.0 from all environments; Audit systems where numprint was installed for compromise, persistence, and C2 traffic to GitHub Gist endpoints; Rotate credentials and secrets on affected machines; Block/remove the package from internal PyPI mirrors and dependency allowlists; Review CI/CD and developer workstations for install-time execution of this package

### [high] Discover-Tech ad-network spyware: governments deliver zero-click spyware via malicious online ads
https://helix.ml/threat-watch/i/discover-tech-ad-network-spyware-governments-deliver-zero-click-spyware-via-malicious-online-ads · Breaches · no-fix-needed · since 2026-10-27
Citizen Lab reported that government spyware makers, including Israeli company Discover-Tech, are abusing global advertising networks to deliver zero-click spyware. Malicious online adverts served through ad networks are used to target and hack victims' devices without any user interaction, a novel delivery vector for commercial surveillance tools. Targets are individuals selected by government clients; the report was published Thursday (2026-10-22) by the University of Toronto lab. No CVE or technical fix is stated; mitigation relies on ad-network abuse detection and device-level protections rather than a vendor patch.
Do: Harden devices against drive-by/zero-click compromise: enable OS security updates, lockdown modes and mobile MDM controls for at-risk staff; Consider network-level ad and tracker blocking for high-risk users; Monitor for indicators of compromise published by Citizen Lab; Review exposure of staff in high-risk roles (journalists, activists, officials) to targeted surveillance; Follow Citizen Lab and vendor advisories for further technical detail

### [medium] DMDC data breach — Pentagon sued by Marines over PII leak enabling scams
https://helix.ml/threat-watch/i/dmdc-data-breach-pentagon-sued-by-marines-over-pii-leak-enabling-scams · Breaches · no-fix-needed · since 2026-10-27
Two Marines filed a class-action lawsuit in federal court in the District of Columbia against the Pentagon over a data breach at the Defense Manpower Data Center (DMDC). The complaint alleges the Pentagon ignored known cybersecurity flaws before the breach, allowing scammers to obtain and use the plaintiffs' personally identifiable information (PII). The suit claims the leaked PII was subsequently used by scammers, affecting Marine veterans whose data was held in DMDC systems. No technical details, breach date, or number of affected individuals are provided in the source. As a breach incident, no vendor patch applies; remediation centers on notification, monitoring, and fraud protection for affected personnel.
Do: Marines and DoD personnel whose data is in DMDC: watch for phishing/scams using your PII and consider credit/fraud monitoring; DoD: review DMDC security findings cited in the lawsuit and remediate ignored cybersecurity flaws; Monitor for follow-on identity-theft activity tied to leaked PII

### [high] iPhone malware drive-by campaign: crypto thieves serve malware via hundreds of infected websites and malicious ads
https://helix.ml/threat-watch/i/iphone-malware-drive-by-campaign-crypto-thieves-serve-malware-via-hundreds-of-infected-websites-and-malicious-ads · Breaches · no-fix-needed · since 2026-10-27
Researchers told Forbes that crypto thieves are targeting iPhone users at scale with a drive-by cyberattack that requires only viewing an ad or visiting an infected webpage — no user interaction beyond page load. Hundreds of websites have been compromised to serve the malware, and in at least one case a malware-laden ad was served. The attack appears aimed at stealing cryptocurrency from iPhone users. No CVE or named vulnerability is given; the compromise of the websites themselves is the vector, so remediation rests on site owners cleaning infections and users avoiding exposure rather than a vendor patch.
Do: Audit and clean any websites you operate for injected malicious scripts or ad code; Restrict and vet third-party ad networks and scripts served to visitors; Consider blocking or sandboxing untrusted web content for iOS users in your environment; Monitor for signs of compromise on iOS devices, especially unusual crypto-wallet activity; Keep iOS devices updated to the latest version

### [high] Conduent $80M settlement — 62.2M-record healthcare data breach class action
https://helix.ml/threat-watch/i/conduent-80m-settlement-62-2m-record-healthcare-data-breach-class-action · Breaches · no-fix-needed · since 2026-10-27
Business services provider Conduent has agreed to pay $80 million to settle class action litigation over what is reported as the third-largest healthcare data breach on record, exposing data on approximately 62.2 million people. The settlement was signed on October 16, 2026, with plaintiffs in the U.S. District Court for the District of New Jersey. The sources do not state the breach date, attack vector, or threat actor. Affected individuals face elevated risk of identity theft and fraud; the settlement provides compensation to class members. No vendor patch applies; remediation is legal and operational rather than technical.
Do: If you or your organisation may be a class member, check settlement claim deadlines and file claims; Monitor for identity theft and fraud; consider credit freezes or monitoring for affected individuals; Review vendor risk posture for business-process outsourcers handling healthcare data; Ensure breach-notification and downstream-contract obligations with Conduent-like vendors are current

### [high] Malicious Firefox wallet impersonators (Phantom/Jupiter/Bitget) — steal recovery phrases and private keys via bonto[.]io C2
https://helix.ml/threat-watch/i/malicious-firefox-wallet-impersonators-phantom-jupiter-bitget-steal-recovery-phrases-and-private-keys-via-bonto-io-c2 · Supply chain · no-fix-needed · since 2026-10-27
Socket's Threat Research Team identified malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets using Unicode homoglyph names and genuine branding. The signed packages contain always-on stealers that exfiltrate recovery phrases and private keys to brand-named subdomains of bonto[.]io (at least five provisioned, including coinbase and exodus). The Phantom impersonator additionally bundles a loader that fetches a second-stage stealer from phantom[.]bonto[.]io/config and executes it in the main world of every page, allowing payload swapping after review. All three listings were live on Firefox Add-ons during analysis and removed as of publication. Users who installed the extensions and entered wallet secrets are affected; no CVE applies.
Do: Remove any of these extensions from Firefox immediately and treat all crypto wallet secrets entered while installed as compromised; Transfer affected wallet funds to new wallets with fresh recovery phrases and rotate private keys; Audit installed Firefox extensions for homoglyph-named wallet impersonators and review extension permissions; Block bonto[.]io and its subdomains at network egress; Monitor for drainer-related transactions from affected wallets

### [medium] Covered California: agent data exposed via phishing attack on spreadsheets (no CVE)
https://helix.ml/threat-watch/i/covered-california-agent-data-exposed-via-phishing-attack-on-spreadsheets-no-cve · Breaches · no-fix-needed · since 2026-10-27
An attacker used phishing to gain unauthorized access to spreadsheets containing Covered California agent information on May 13, 2026, according to a sample breach notice letter posted on the California attorney general's website on October 16, 2026. Affected agents were notified that their information, along with that of other agents, was disclosed as a result of the incident. The breach notice was reported by DataBreaches.net on October 27, 2026. No details on the number of affected agents, the specific data elements exposed, or whether the attacker has been identified have been disclosed. As a phishing-driven credential compromise, remediation centers on credential resets, access review, and phishing-resistant MFA rather than a software patch.
Do: Review and reset compromised agent account credentials and enforce phishing-resistant MFA; Determine scope of exposed agent data and complete regulatory notification obligations; Provide credit/identity monitoring where appropriate to affected agents; Train staff on phishing indicators and verify data-sharing requests out-of-band

### [high] Bajaj Hospital ransomware attack: all 9 servers encrypted, sensitive patient data stolen
https://helix.ml/threat-watch/i/bajaj-hospital-ransomware-attack-all-9-servers-encrypted-sensitive-patient-data-stolen · Breaches · no-fix-needed · since 2026-10-27
Hackers attacked the digital systems of Kamalnayan Bajaj Hospital around 3 am, breaching all nine of the hospital's servers and encrypting their entire data in what appears to be a ransomware extortion attempt. Sensitive data was reportedly stolen in addition to the encryption, putting patient information and hospital operations at risk. The attack sent shockwaves through the city and disrupted the hospital's digital services. No ransomware group has been named in reporting, and no CVE applies; this is a breach/ransomware incident rather than a software vulnerability. Remediation depends on the hospital's incident response, restoration from backups, and law enforcement involvement; no vendor patch is applicable.
Do: Isolate affected servers and preserve forensic evidence before any rebuilding; Determine the ransomware strain and check for a free decryptor (e.g. No More Ransom); Restore systems from clean, offline backups after verifying no persistence remains; Assess scope of stolen patient data and prepare breach notifications per applicable law; Harden remote access, enforce MFA, patch exposed services, and segment hospital networks; Report the incident to law enforcement/CERT-In and engage IR specialists

### [medium] Ohio Auditor web server cyberattack — state server taken down amid possible foreign state actor involvement
https://helix.ml/threat-watch/i/ohio-auditor-web-server-cyberattack-state-server-taken-down-amid-possible-foreign-state-actor-involvement · Breaches · no-fix-needed · since 2026-10-27
Ohio Auditor Keith Faber announced that his office's web server was attacked by what he described as overseas cybercriminals and potentially foreign state actors, prompting the state to temporarily take the server offline. Faber stated there is no reason to believe Ohioans' personal financial information is at risk as a result of the attack. The attackers' identity and exact method remain unclear, and no data exposure has been confirmed. The server was taken down as a containment measure while the incident is investigated. Organizations running public-facing government web servers should review logs for similar probing, ensure systems are patched, and monitor for follow-on activity.
Do: Review web server logs for indicators of the attack and related scanning; Verify all internet-facing services are fully patched and hardened; Monitor for follow-on intrusion or data-exfiltration activity; Confirm no sensitive data was exposed before restoring service

### [medium] Cyberattack on Italy's Chamber of Deputies email accounts, including account assigned to PM Meloni
https://helix.ml/threat-watch/i/cyberattack-on-italy-s-chamber-of-deputies-email-accounts-including-account-assigned-to-pm-meloni · Breaches · no-fix-needed · since 2026-10-27
Italy's Chamber of Deputies confirmed a cyberattack targeting parliamentary email accounts, including one assigned to Prime Minister Giorgia Meloni (not her government account), former Justice undersecretary Andrea Delmastro, and lawmaker Paolo Formentini. Security measures were activated with the National Cybersecurity Agency (ACN). The Chamber said the incident had no emergency implications and noted intensified attacks on other Italian, European and international institutions, following an October 8 pro-Russian-linked DDoS attack on the Foreign Ministry. No technical details on access level or data exfiltration have been disclosed; the incident is viewed in the context of hybrid warfare risks, where compromised political correspondence could enable intelligence gathering, further intrusions, or influence campaigns. Investigation is ongoing.
Do: Review and reset credentials for affected and at-risk parliamentary accounts; enforce MFA; Audit email access logs to determine whether accounts were accessed and data exfiltrated; Harden email security (phishing-resistant authentication, monitoring for lateral movement and impersonation); Prepare transparent public communications distinguishing attempted vs confirmed compromise; Increase monitoring amid elevated cyber pressure on Italian and European institutions

### [medium] FEC electronic filing system outage after hacking attempts ahead of November 3 elections
https://helix.ml/threat-watch/i/fec-electronic-filing-system-outage-after-hacking-attempts-ahead-of-november-3-elections · Breaches · no-fix-needed · since 2026-10-27
Reuters reports, citing an internal email, that the US Federal Election Commission's website was targeted by a hacker or hackers, disrupting the agency's electronic filing system roughly a week before the November 3 elections. The FEC confirmed its electronic filing system was offline. The attackers' identity, methods, and whether any data was accessed have not been disclosed. The outage affects filers — campaigns and committees that submit reports electronically — during a peak pre-election filing period. No CVE or patch applies; this is an intrusion/attack incident under investigation.
Do: Monitor FEC status channels for restoration of the e-filing system and alternative filing instructions; Prepare contingency plans for paper or delayed filings if the outage persists through the pre-election deadline; Harden public-facing web infrastructure and review logs for related intrusion attempts; Watch for phishing or disinformation exploiting the outage

### [critical] MLflow third-party scorer deserialization RCE — unauthenticated code execution on MLflow servers (CVE-2026-116692)
https://helix.ml/threat-watch/i/mlflow-third-party-scorer-deserialization-rce-unauthenticated-code-execution-on-mlflow-servers-cve-2026-116692 · Supply chain · patched · since 2026-10-27 · CVE-2026-116692
MLflow 3.12.0 introduced deserialization of third-party scorers that imports a request-controlled Python module under one of four allowed package prefixes (mlflow.genai.scorers.ragas/deepeval/trulens/phoenix) and instantiates a request-controlled class. An unauthenticated HTTP caller can chain this with MLflow's experiment, run, and artifact-upload endpoints: create an experiment whose artifact location points inside the installed MLflow package tree, upload a Python module as a run artifact, then trigger import and constructor execution via /ajax-api/3.0/mlflow/scorer/invoke. On the default no-auth server using the official v3.14.0 image (running as uid 0), this yields arbitrary Python code execution with server-process privileges. A harmless public PoC writes a marker file. Fixed in MLflow 3.17.0.
Fixed: mlflow 3.17.0
Do: Upgrade MLflow to 3.17.0 or later immediately; If upgrade is delayed, require authentication on MLflow servers and restrict network exposure; Restrict write permissions on the installed Python package tree and run MLflow as a non-root user; Audit servers for unexpected modules or artifacts under mlflow/genai/scorers/ package directories; Review artifact-location settings and block experiments pointing into site-packages

### [critical] agentenact (npm): malicious package 0.2.0 fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/agentenact-npm-malicious-package-0-2-0-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-10-27
GitHub published a malware advisory (GHSA-7p7m-8jmq-qp93) for the npm package agentenact, version 0.2.0, on 2026-10-27. The package contains embedded malicious code (CWE-506) and any computer where it is installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the advisory recommends removal but warns removal may not eliminate all malicious software. All secrets and keys stored on affected machines should be rotated immediately from a different, uncompromised computer. No source code repository is known for the package.
Do: Treat any machine with agentenact 0.2.0 installed as fully compromised; Rotate all secrets and keys stored on affected machines immediately, from a different computer; Remove the package and rebuild/reimage affected systems, as removal may not eliminate all malicious software; Audit dependency trees and CI environments for the package

### [critical] Malicious npm packages csec-form-validator, csec-crypto-toolkit (and ccsec- typosquat variants) — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-csec-form-validator-csec-crypto-toolkit-and-ccsec-typosquat-variants-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-27
On 2026-10-27 GitHub published four malware advisories (GHSA-wh86-6qm8-xgw2, GHSA-v383-2358-576w, GHSA-r889-j2qv-2jv6, GHSA-2732-c6cp-rx5v) covering four npm packages: csec-form-validator, csec-crypto-toolkit, and the near-identical typosquat-style names ccsec-form-validator and ccsec-crypto-toolkit. All versions (>= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code, indicating the packages were published maliciously rather than hijacked. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential and secret theft with attacker control of the host. The ccsec- variants suggest a coordinated typosquatting campaign against the csec- names. Removal alone is not guaranteed to eliminate the malware.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages and rebuild/reimage affected systems; do not assume removal fully cleans the host; Audit dependency lockfiles, CI/CD environments and developer workstations for any of the four package names and block them in registries/proxies; Review access and network logs for signs of exfiltration or attacker activity since installation; Notify incident response and consider the affected hosts untrusted until rebuilt

### [critical] Chrome: stable update fixes 353 security flaws incl. critical memory corruption (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280)
https://helix.ml/threat-watch/i/chrome-stable-update-fixes-353-security-flaws-incl-critical-memory-corruption-cve-2026-113341-cve-2026-113279-cve-2026-1 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-106179, CVE-2026-106180, CVE-2026-106182, CVE-2026-106183, CVE-2026-106185, CVE-2026-106186, CVE-2026-106187, CVE-2026-106188, CVE-2026-106189, CVE-2026-106191, CVE-2026-106193, CVE-2026-106194, CVE-2026-106195, CVE-2026-106196, CVE-2026-106197, CVE-2026-106198, CVE-2026-106199, CVE-2026-106308, CVE-2026-106309, CVE-2026-106310, CVE-2026-106311, CVE-2026-106312, CVE-2026-106314, CVE-2026-106315, CVE-2026-106316, CVE-2026-106318, CVE-2026-106321, CVE-2026-106322, CVE-2026-106324, CVE-2026-106325, CVE-2026-106327, CVE-2026-106328, CVE-2026-106329, CVE-2026-106330, CVE-2026-106331, CVE-2026-106332, CVE-2026-106363, CVE-2026-106364, CVE-2026-106365, CVE-2026-106369, CVE-2026-106370, CVE-2026-106371, CVE-2026-106373, CVE-2026-106374, CVE-2026-106375, CVE-2026-106376, CVE-2026-106377, CVE-2026-106378, CVE-2026-106379, CVE-2026-106381, CVE-2026-106382, CVE-2026-106383, CVE-2026-106384, CVE-2026-106385, CVE-2026-110136, CVE-2026-110171, CVE-2026-110172, CVE-2026-112992, CVE-2026-112993, CVE-2026-112994, CVE-2026-112995, CVE-2026-112996, CVE-2026-112997, CVE-2026-112998, CVE-2026-112999, CVE-2026-113000, CVE-2026-113001, CVE-2026-113002, CVE-2026-113003, CVE-2026-113004, CVE-2026-113005, CVE-2026-113006, CVE-2026-113007, CVE-2026-113008, CVE-2026-113009, CVE-2026-113010, CVE-2026-113011
On 2026-10-20 Google promoted Chrome 156 to the stable channel for Windows, Mac and Linux, rolling out over coming days/weeks. Versions 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) contain 353 security fixes, including several critical memory corruption vulnerabilities in Skia, Accessibility, and CSS (CVE-2026-113341, CVE-2026-113279, CVE-2026-113072, CVE-2026-113280), reported by Google and Xinyang Ge in early October 2026. Bug details and links are restricted until a majority of users are updated. No in-the-wild exploitation is mentioned. All users of Chrome on desktop platforms are affected until updated; the fix is delivered in the 156 stable release.
Fixed: 156.0.8078.47 (Linux); 156.0.8078.47/.48 (Windows/Mac)
Do: Update Chrome to 156.0.8078.47/.48 or later on all managed Windows, Mac and Linux endpoints as soon as the rollout reaches your channel; Force browser auto-update or push the update via enterprise policy (Update policies / MDM) and verify versions in your fleet; If you manage Chromium-based browsers (Edge, Brave, etc.), track their rebuilds of the same underlying fixes and patch accordingly; Restrict browsing of untrusted content via other controls until fleet updates complete

### [high] Node.js: October 2026 security releases fix DNS truncation, TLS hostname bypasses, Brotli RCE and HTTP keep-alive flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074)
https://helix.ml/threat-watch/i/node-js-october-2026-security-releases-fix-dns-truncation-tls-hostname-bypasses-brotli-rce-and-http-keep-alive-flaws-cve · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106070, CVE-2026-106071, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497, CVE-2026-48618, CVE-2026-48930, CVE-2026-48931
The Node.js Project released security updates for the 26.x, 24.x and 22.x lines on 2026-10-21 addressing seven vulnerabilities. High-severity issues include dns.resolve*() silently truncating hostnames at NUL bytes (bypassing allowlist validation), TLS hostname verification bypasses via fullwidth-digit IP spellings and non-canonical IPv4 literals like leading-zero octets, and a Brotli decoder out-of-bounds write in node:zlib that can enable remote code execution. Medium issues cover HTTP keep-alive socket response confusion, DNS SANs authenticating IP endpoints, and entropy caches for crypto.randomUUID()/randomInt() being baked into startup snapshots, causing repeated values across processes. Dependency updates include c-ares, OpenSSL, SQLite, Undici and ca-certificates. All users on affected lines should upgrade promptly.
Do: Upgrade Node.js deployments on 26.x, 24.x or 22.x to the October 2026 security releases immediately, prioritising internet-facing services using TLS hostname verification or node:zlib Brotli decompression; Rebuild any single executable applications or --build-snapshot artifacts created with useSnapshot so entropy caches are not baked in, and regenerate any UUIDs/randomInt values issued from snapshot-built processes; Audit applications that validate hostnames against allowlists then resolve via dns.resolve*() for NUL-byte truncation exposure; Rebuild container images and dependencies that bundle affected Node.js versions and redeploy

### [critical] Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48356)
https://helix.ml/threat-watch/i/adobe-commerce-and-magento-cve-2026-48356 · Vulnerabilities · unknown · since 2026-10-27 · CVE-2026-48356
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on Oct 27, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 10, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] pydicom: NaN/inf DICOM values let one upload crash MONAILabel and corrupt inference (CVE-2026-48705)
https://helix.ml/threat-watch/i/pydicom-ds-is-nan-inf-validation-bypass-monailabel-crash-silent-inference-corruption-cve-2026-48705 · Vulnerabilities · partial · since 2026-10-27 · CVE-2026-48705
A DICOM file with NaN or inf in its spacing or position fields passes pydicom's DS and IS checks, because pydicom accepts those values silently in its default validation mode. MONAI's PydicomReader then builds an affine matrix from them without finite-value checks. The result is that a single unauthenticated upload to MONAILabel's default REST datastore endpoint (about 132 KB) makes inference return HTTP 500 after roughly 16 seconds of wasted compute, and the file stays in the datastore so later requests keep failing. Where the writer does not crash, the output can be a geometrically wrong segmentation returned with HTTP 200. The advisory includes a proof of concept and reports 17 of 17 test vectors against MONAI 1.5.2 and pydicom 3.0.2. MONAI 1.6.1, uploaded to PyPI on 2026-09-27, fixes the MONAI side. pydicom 3.0.2 is still the latest PyPI release, so the pydicom side is unfixed. No known in-the-wild exploitation.
Fixed: monai 1.6.1 (PyPI upload 2026-09-27)
Do: Upgrade MONAI to 1.6.1 or later immediately; Restrict network access to MONAILabel port 8000 and enable authentication on the REST API; Purge/audit datastore entries for DICOM files with NaN/inf in PixelSpacing or ImagePositionPatient (they permanently crash inference); Add input validation on DICOM spatial metadata before ingestion if running custom pipelines; Monitor for HTTP 500 inference errors and unexpected datastore uploads; Track pydicom for a fix to DS/IS validation; consider RAISE validation mode as a mitigation

### [critical] better-auth: OAuth state accepted as a Magic Link token enables account takeover by email (CVE-2026-114607)
https://helix.ml/threat-watch/i/better-auth-oauth-state-usable-as-magic-link-token-to-take-over-any-account-by-email-address-cve-2026-114607 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-114607
In better-auth from 1.4.0-beta.18 up to 1.7.7, the value that an OAuth sign-in creates as its state can be used as a Magic Link token. An unauthenticated attacker who knows a victim's email address can start an OAuth sign-in for that address, reuse the state value to complete a Magic Link sign-in, and receive a full session for the account without ever reading that mailbox. The attacker can also create an account that is wrongly marked as email verified when the address is not yet registered and Magic Link sign-up is enabled. The bug needs three conditions: Magic Link enabled with the default plain token storage (or hashed tokens with hashed identifiers), at least one social or Generic OAuth provider, and database-backed OAuth state, which is the default. Fixed in 1.7.7. Upgrade every Better Auth adapter and plugin together, and move shared verification storage in the same cutover. Until then, the advisory's workarounds are cookie-backed OAuth state, hashed Magic Link tokens with plain identifiers, or turning off Magic Link or OAuth sign-in. No known in-the-wild exploitation.
Fixed: better-auth 1.7.7 (npm publish 2026-09-30)
Do: Upgrade better-auth and all Better Auth adapters, plugins, and integrations to 1.7.7 together; upgrade servers sharing verification storage in the same cutover; Until upgraded, set account.storeStateStrategy to "cookie" (with a dedicated OAuth Proxy secret if using OAuth Proxy), or set Magic Link storeToken to "hashed" with verification.storeIdentifier unset/plain, or disable Magic Link or OAuth sign-in; Request new Magic Links and restart pending OAuth/SAML sign-ins after upgrading; pre-upgrade links and state cannot complete; Update custom verification.storeIdentifier.overrides rules to match the magic-link: and auth-state: prefixes; Audit accounts for falsely verified emails and review permissions granted based on verified email addresses or domains

### [critical] Authlib: unsigned JWS JSON accepted as verified when the signatures array is empty (CVE-2026-96760)
https://helix.ml/threat-watch/i/authlib-jws-empty-signatures-bypass-authlib-deserialize-json-accepts-unsigned-payloads-as-verified-cve-2026-96760 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-96760
In Authlib before 1.9.0, JsonWebSignature.deserialize_json() reports success before it checks anything. An attacker can submit a JWS JSON object with an empty signatures array and get the payload back as verified, with no key used, even when the caller supplies the right key. Any service that trusts this call on attacker-supplied input will accept forged identity or authorisation claims, which makes it an unauthenticated authentication bypass. The advisory includes a reproduction on Authlib 1.8.0 and notes that joserfc rejects the same input. Fixed in Authlib 1.9.0 (PyPI upload 2026-10-14), which rejects empty signatures arrays. The advisory reports no in-the-wild exploitation.
Fixed: authlib 1.9.0 (PyPI upload 2026-10-14)
Do: Upgrade authlib to 1.9.0 or later immediately; Audit code for use of JsonWebSignature.deserialize_json() on untrusted input and treat any such path as bypassable until patched; If upgrade is delayed, reject JWS JSON objects with empty or missing signatures arrays before passing to authlib, or switch to joserfc; Review logs for tokens/requests with empty signatures arrays that may have been accepted; Rotate or re-evaluate trust in any authorisation decisions made via JWS JSON verification on affected versions

### [critical] Agno: eval() on FunctionCall field_type runs arbitrary Python code (CVE-2026-35002)
https://helix.ml/threat-watch/i/agno-eval-code-injection-in-functioncall-field-type-arbitrary-python-code-execution-cve-2026-35002 · Vulnerabilities · patched · since 2026-10-27 · CVE-2026-35002
Agno, the Python agent framework, passed the field_type value of a FunctionCall input field to Python's eval(). Anyone who can influence that value, through an API, a web UI, or untrusted tool or model output, can run arbitrary Python inside the Agno process. Every deployment that feeds user-influenced FunctionCall inputs into Agno is exposed. The fix in Agno 2.3.24 replaces eval() with a fixed dictionary lookup and checks field_type against known keys or resolved type objects. There is no safe workaround besides keeping untrusted input away from that field. 2.3.24 was uploaded to PyPI on 2026-01-08, months before the advisory. NVD published the CVE on 2026-04-02 and the GHSA on 2026-10-27. EPSS is 0.842 percent as of 2026-10-27. No in-the-wild exploitation is reported.
Fixed: agno 2.3.24 (PyPI upload 2026-01-08)
Do: Upgrade agno to 2.3.24 or later. The PyPI latest release (3.1.10 at check time) includes the fix; the advisory's 2.6.x reference is out of date.; If upgrade is delayed, ensure no untrusted input can reach the field_type parameter of FunctionCall input fields; Audit deployments that expose Agno via APIs, web UIs, or untrusted tool/model output for exposure; Review logs for signs of exploitation of FunctionCall field_type values

### [critical] PHP (PHP2Shell): Two critical RCE flaws in PHP under active exploitation (CVE-2026-109618, CVE-2026-109619)
https://helix.ml/threat-watch/i/php-php2shell-two-critical-rce-flaws-in-php-under-active-exploitation-cve-2026-109618-cve-2026-109619 · Vulnerabilities · partial · since 2026-10-17 · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
On 2026-10-21 the PHP Foundation released emergency updates for two critical RCE vulnerabilities, CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), collectively tracked as PHP2Shell (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Attacks against the flaws are ongoing; Wordfence, which protects over 5 million WordPress sites, reports no confirmed compromises yet, suggesting complex exploitation. Cisco issued a Critical advisory listing affected products (e.g., Ultra-Reliable Wireless Backhaul, Expressway, Duo Access Gateway) with fixes pending or scheduled (e.g., URWB 27.1.1 in Feb 2027, Expressway 15.5.21), workarounds in bug trackers, and many products confirmed not vulnerable. Community backported patches exist for EOL PHP 5.4-5.6. All organisations running PHP should patch immediately.
Fixed: PHP security release of 2026-10-21 (per PHP Foundation); Cisco URWB 27.1.1 (Feb 2027); Expressway 15.5.21 (TBD); Duo Access Gateway 3.2.0
Do: Update PHP to the patched releases published by the PHP Foundation on 2026-10-21; if patching is delayed, apply mitigations/workarounds and restrict exposure of PHP-facing services; Check vendor advisories for embedded PHP (Cisco bug IDs CSCwx37073, CSCwx37062; Splunk advisory) and schedule the vendor fixed releases; If running EOL PHP 5.4-5.6, apply the community backported patch or migrate to a supported PHP version; Monitor logs for exploitation attempts and confirm no signs of compromise; continue monitoring as attack activity is ongoing

### [critical] HPE ArubaOS: 72 vulnerabilities patched, including eight max-severity unauthenticated RCE and auth bypass flaws (CVE-2026-79844 through CVE-2026-79851)
https://helix.ml/threat-watch/i/hpe-arubaos-72-vulnerabilities-patched-including-eight-max-severity-unauthenticated-rce-and-auth-bypass-flaws-cve-2026-7 · Vulnerabilities · patched · since 2026-10-23 · CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851
HPE released security updates on 2026-10-23 fixing 72 vulnerabilities in ArubaOS, the OS powering Aruba enterprise wireless infrastructure (controllers, gateways, access points, mobility conductors). Eight are maximum-severity, remotely exploitable without privileges via low-complexity attacks requiring no user interaction: authentication bypasses leading to RCE (CVE-2026-79844, CVE-2026-79850), PAPI protocol auth bypass (CVE-2026-79845), unauthenticated command injection (CVE-2026-79846), buffer overflows leading to RCE (CVE-2026-79847, CVE-2026-79851), and SQL injections leading to RCE (CVE-2026-79848, CVE-2026-79849). Multiple AOS-8 and AOS-10 versions are affected. HPE says no public exploit code or in-the-wild exploitation is known. Patches are available; HPE urges immediate patching and restricting management interfaces.
Do: Patch affected AOS-8 and AOS-10 devices immediately, prioritising the eight maximum-severity CVEs; Until patched, restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and enforce layer 3+ firewall policies; Enable accounting controls for logging and tracking user activity on management interfaces; Check for signs of compromise on internet-exposed or previously unmanaged Aruba devices; Review HPE's advisory for full affected-version lists and any additional mitigations

### [high] ChromeOS / ChromeOS Flex: Stable channel update fixes critical and high kernel/browser vulnerabilities (CVE-2026-106200)
https://helix.ml/threat-watch/i/chromeos-chromeos-flex-stable-channel-update-fixes-critical-and-high-kernel-browser-vulnerabilities-cve-2026-106200 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-102304, CVE-2026-102306, CVE-2026-102308, CVE-2026-102316, CVE-2026-102319, CVE-2026-102324, CVE-2026-103622, CVE-2026-103623, CVE-2026-103629, CVE-2026-106181, CVE-2026-106184, CVE-2026-106190, CVE-2026-106200, CVE-2026-106201, CVE-2026-106202, CVE-2026-106203, CVE-2026-106204, CVE-2026-106205, CVE-2026-106207, CVE-2026-106208, CVE-2026-106210, CVE-2026-106211, CVE-2026-106212, CVE-2026-106213, CVE-2026-106214, CVE-2026-106215, CVE-2026-106216, CVE-2026-106217, CVE-2026-106220, CVE-2026-106222, CVE-2026-106224, CVE-2026-106225, CVE-2026-106226, CVE-2026-106227, CVE-2026-106228, CVE-2026-106229, CVE-2026-106230, CVE-2026-106231, CVE-2026-106232, CVE-2026-106233, CVE-2026-106234, CVE-2026-106235, CVE-2026-106236, CVE-2026-106237, CVE-2026-106238, CVE-2026-106239, CVE-2026-106240, CVE-2026-106241, CVE-2026-106242, CVE-2026-106243, CVE-2026-106244, CVE-2026-106245, CVE-2026-106246, CVE-2026-106247, CVE-2026-106248, CVE-2026-106249, CVE-2026-106250, CVE-2026-106251, CVE-2026-106252, CVE-2026-106255, CVE-2026-106257, CVE-2026-106258, CVE-2026-106263, CVE-2026-106264, CVE-2026-106265, CVE-2026-106266, CVE-2026-106267, CVE-2026-106268, CVE-2026-106269, CVE-2026-106270, CVE-2026-106271, CVE-2026-106273, CVE-2026-106274, CVE-2026-106275, CVE-2026-106277, CVE-2026-106318, CVE-2026-106329, CVE-2026-106347, CVE-2026-106358, CVE-2026-106383, CVE-2026-106421, CVE-2026-106423, CVE-2026-110136, CVE-2026-110137, CVE-2026-110138, CVE-2026-110141, CVE-2026-110142, CVE-2026-110147, CVE-2026-110148, CVE-2026-110151, CVE-2026-110154, CVE-2026-110157, CVE-2026-110161, CVE-2026-110162, CVE-2026-110163, CVE-2026-110166, CVE-2026-110170, CVE-2026-110171, CVE-2026-110172, CVE-2026-110913
Google rolled out ChromeOS 16836.19.0 (browser 156.0.8078.42) to the Stable channel on 2026-10-20/21, fixing multiple vulnerabilities. These include a critical CVE (ID truncated in source), a high use-after-free in Track (CVE-2026-106200), a high arc-keymaster fall-off-end UB allowing guest-to-host wild indirect calls, a high mali_kbase double-free of dma_buf_attachment enabling kernel memory corruption, and a high mali page-migration UAF (kbase_vmap_phy_pages) allowing unprivileged kernel memory corruption on mt8196, plus a medium fix for compromised 3rd-party CA certificates affecting TLS. Android and Chrome browser security fixes are also included. No in-the-wild exploitation is reported. All ChromeOS and ChromeOS Flex devices on Stable should receive the update automatically.
Fixed: ChromeOS 16836.19.0 (browser 156.0.8078.42)
Do: Ensure managed ChromeOS/ChromeOS Flex devices have updated to version 16836.19.0 (browser 156.0.8078.42) or later; Verify fleet update status via the Google Admin console and force reboots where updates are pending; Review whether any devices use affected MediaTek mt8196 hardware and prioritize them; Confirm TLS trust chains are unaffected by the compromised 3rd-party CA certificate issue; Monitor Chrome Releases for follow-up stable or extended stable updates

### [critical] Wasmtime: two critical Cranelift sandbox-escape flaws let malicious Wasm modules break out (CVE-2026-115889, CVE-2026-115893)
https://helix.ml/threat-watch/i/wasmtime-cranelift-bit-packing-overflow-enables-sandbox-escape-via-crafted-wasm-module-cve-2026-115889 · Vulnerabilities · patched · since 2026-10-19 · CVE-2026-115889, CVE-2026-115893
Wasmtime maintainers disclosed two critical Cranelift sandbox-escape flaws, both CVSS 9.9, fixed October 19-20, 2026. CVE-2026-115889 (all architectures): Cranelift packed SSA value indices into 24-bit fields that silently overflow in release builds, causing miscompilation and type confusion exploitable via a large or crafted Wasm function; fixed in 36.0.19 and 43.0.0. CVE-2026-115893 (ARM64 only): out-of-range br_table indexes used a branch with ~1 MiB reach, so jump tables with >~256,000 targets pointed to the wrong location, allowing arbitrary code jumps; present since 2020 ARM64 support; fixed in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Only the 36, 48, 49 and 50 release lines are supported; 24.x LTS and other lines got no fix. Because Wasmtime is embedded as a library, each dependent program must be rebuilt. No public exploitation reported; tracked as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.
Fixed: 36.0.19; 43.0.0 (CVE-2026-115889 only); 48.0.7; 49.0.4; 50.0.0
Do: Upgrade Wasmtime to a fixed release for your line immediately if you run untrusted Wasm modules: 36.0.19, 48.0.7, 49.0.4, or 50.0.0; unsupported lines (incl. 24.x LTS) must migrate to one of these; Rebuild every application or service that embeds Wasmtime as a library (e.g. Fastly Compute-style platforms, Spin serverless apps) against a fixed version — updating the CLI alone is insufficient; ARM64/aarch64 hosts: ensure both flaws are covered — 36.0.19 or 50.0.0; note 43.0.0-47.x and 48.0.0-48.0.6 remain affected by CVE-2026-115893; If upgrading is not immediately possible, restrict or sandbox which Wasm modules are executed and avoid compiling untrusted module bodies; no workarounds are listed in the advisories; Audit Cargo.lock files with cargo-audit (RUSTSEC-2026-0380, RUSTSEC-2026-0379); note Dependabot may not alert for CVE-2026-115893 as GitHub lacks a reviewed advisory entry; Monitor for suspicious Wasm module workloads or crashes that could indicate exploitation attempts

### [critical] OVHcloud CLI: GitHub release binaries swapped with GlassWorm credential stealer (no CVE)
https://helix.ml/threat-watch/i/ovhcloud-cli-github-release-binaries-swapped-with-glassworm-credential-stealer-no-cve · Supply chain · no-fix-needed · since 2026-10-19
On 2026-10-19 (12:47–14:21 UTC), an attacker using contributor account HassenBF replaced release binaries on ovh/ovhcloud-cli v0.11.0–v0.15.0 with a locally built credential stealer (GlassWorm loader), also replacing checksums.txt; no tags, CI, or source were touched. Initial access traced to a malicious VS Code extension (color-picker-universal) installed on a developer's personal MacBook in Oct 2025, with stolen keys used for uploads. The stealer targets AI-agent credential stores, cloud CLIs, Docker/Kubernetes configs, SSH keys, and more, staging in /tmp/envchecker-*. A customer's pinned-SHA256 CI check detected it within 94 minutes. OVHcloud deleted the assets and shipped clean, attested v0.16.0 (advisory GHSA-862f-55f5-vmvw). Homebrew, go install, and source builds were not exposed.
Fixed: v0.16.0
Do: If you downloaded or ran any ovhcloud binary from GitHub releases between 12:47–14:21 UTC on 2026-10-19, treat the host as fully compromised and assume exfiltration succeeded; Rotate every secret the machine could read (cloud CLIs, AI-agent credentials, Docker/K8s configs, SSH keys, NPM, .netrc, .gitconfig) from a different machine; Check for /tmp/envchecker-* staging directories on potentially affected hosts; Reinstall from the clean v0.16.0 and verify with gh release verify-asset v0.16.0 ovhcloud-cli_Linux_x86_64.tar.gz; Note that updating or reinstalling the CLI alone revokes nothing; secret rotation is required

### [critical] TeamUpdraft (UpdraftPlus/UpdraftCentral): website breach exposed connection keys used to install backdoor plugins on WordPress sites (no CVE)
https://helix.ml/threat-watch/i/teamupdraft-updraftplus-updraftcentral-website-breach-exposed-connection-keys-used-to-install-backdoor-plugins-on-wordpr · Breaches · patched · since 2026-10-17
Unknown attackers breached teamupdraft.com over the weekend of Oct 17-18, 2026, accessing the customer database including hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. Patchstack observed the attacker using valid UpdraftCentral dashboard keys to send signed plugin.upload_plugin commands that installed backdoor plugins on connected WordPress sites, creating rogue admin/editor accounts (e.g. 'data-ops43') persisting even after plugin removal. TeamUpdraft disconnected all pre-Oct 18 connections, reset keys and credentials, released UpdraftPlus 1.26.13/2.26.13, reported to the ICO, and advises users to rotate passwords, 2FA, and storage keys. The UpdraftPlus plugin itself and self-hosted UpdraftCentral are not affected.
Fixed: UpdraftPlus 1.26.13 (free) / 2.26.13 (Premium)
Do: Log in to each site's WordPress dashboard directly (not via UpdraftCentral), update UpdraftPlus to 1.26.12+/2.26.12+, and delete the UpdraftCentral connection key under Settings > UpdraftPlus > Advanced Tools; Check Users and Plugins (including Must-Use) for unknown admin accounts or rogue plugins (e.g. Site Health Cache, Query Shelf, Wp Forge; accounts like system_team850, web.tech988) and remove them; change all admin passwords; Check for the backdoor user 'data-ops43' / 'Site Tools' and IOCs (IPs 43.250.53.42, 2a09:bac5:4e21:); if found, restore from a pre-Oct 17 backup; Change teamupdraft.com password and reset 2FA; change reused passwords elsewhere; re-authorise remote storage and rotate storage access keys; UpdraftVault users: reconnect sites with new credentials; UpdraftClone users: copy new client keys from My Account > UpdraftClone > Key Management; beware phishing emails posing as TeamUpdraft

### [high] Bullhorn: Cyberattack forced recruitment platform offline with possible data theft (no CVE)
https://helix.ml/threat-watch/i/bullhorn-cyberattack-forced-recruitment-platform-offline-with-possible-data-theft-no-cve · Breaches · no-fix-needed · since 2026-10-16
Bullhorn, a US-based staffing/recruitment software provider serving over 10,000 customers, suffered a cyber incident first flagged on 2026-10-16 via job-posting failures to Indeed, escalating to a full outage on 2026-10-17. The company disabled access to contain the activity and engaged CrowdStrike to investigate and restore services. Systems returned online in the UK, US, and Australia from Monday, but SSO issues, password resets, and degraded performance persisted across products including Talent Platform, Onboarding365, and Time & Expense. Recruitment agencies lost access to candidate records, applications, placements, and payroll systems. A forensic investigation has not yet determined whether customer data was exfiltrated; attackers and ransomware involvement remain unidentified. Bullhorn has forced password resets for non-SSO users and instructed API customers to rotate credentials.
Do: Rotate API integration credentials immediately if you use Bullhorn APIs; Complete forced password resets and verify MFA is enabled on all accounts; Beware phishing posing as Bullhorn staff requesting passwords, MFA codes, or tokens; verify via official channels; Monitor Bullhorn's status page and incident communications for data-breach notifications; Review access logs and watch for anomalous activity in downstream systems fed by Bullhorn data; Prepare contingency workflows for candidate records and payroll in case of renewed disruption

### [critical] npm malware wave: @eforms/forms-api, jshelperdependenceny, @iobandamwer/cache-helper — malicious packages fully compromise hosts
https://helix.ml/threat-watch/i/npm-malware-wave-eforms-forms-api-jshelperdependenceny-iobandamwer-cache-helper-malicious-packages-fully-compromise-host · Supply chain · no-fix-needed · since 2026-10-19
GitHub published three malware advisories on 2026-10-26 (GHSA-39p9-96vf-fxjh, GHSA-2gxp-q3vq-594r, GHSA-j83w-xhgf-7m58) for npm packages @eforms/forms-api, jshelperdependenceny and @iobandamwer/cache-helper, all now replaced by npm security placeholders. The malicious versions named by OSV are @eforms/forms-api 1.99.0, 1.99.1, 2.0.0-SNAPSHOT, 2.0.99, 2.99.0, 2.99.1 and 99.0.0 (all published 2026-10-25); jshelperdependenceny 0.0.0-stage, 1.0.0 (published 2026-10-19, the earliest publish in this set) and 99.0.0 (2026-10-24); and @iobandamwer/cache-helper 1.0.2 through 1.1.3 (published 2026-10-24 to 2026-10-26). GitHub classes every version as affected and no safe version exists. Any machine that installed or ran these packages should be treated as fully compromised: rotate secrets and keys from a clean machine, and do not rely on uninstalling to remove what the package left behind. Nothing in the sources reports a fix or a CVE. The @iobandamwer npm scope also appears in a separate Threat Watch record (native-helper), so the two should be read together, though they are not the same advisory set.
Do: Check lockfiles and installed node_modules for the three packages and remove them from all machines and CI runners; Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored there, from a clean computer; Rebuild affected environments from trusted images and audit for persistence beyond the npm package; Block the package names in npm/registry policy and review dependency install history for exposure

### [critical] dsh-native (npm) — malicious package version 1.4.1 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/dsh-native-npm-malicious-package-version-1-4-1-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-22
GitHub published a malware advisory on 2026-10-26 (GHSA-x94m-hxm5-m298) for dsh-native version 1.4.1, the only version of the package that was ever published with real content. The registry shows 1.4.1 went up on 2026-10-22 at 08:06 UTC, one day after the package's 0.0.0-stage entry, and it has since been removed from the registry without a security placeholder, so the package now carries no installable version. OSV's malware record MAL-2026-18315 names 1.4.1 as the malicious version. npm download counts show 312 installs on 2026-10-22 and 110 on 2026-10-26, which suggests the release was pulled in quickly. GitHub classes the package as containing embedded malicious code and says any computer that installed or ran it should be considered fully compromised, with control potentially handed to an outside party; secrets and keys on those machines should be rotated from a clean machine, and removing the package may not remove the follow-on malware. No fix, CVE or public writeup for this package was found.
Do: Rotate all secrets, keys, and credentials stored on machines where dsh-native 1.4.1 was installed, using a clean computer; Remove dsh-native 1.4.1 from all projects, lockfiles, and CI caches; Rebuild or wipe affected machines and audit for persistence mechanisms and follow-on malware; Review npm install logs and CI history to identify when and where the package was pulled; Block the package in dependency firewalls/registries and audit dependencies for similar typosquat or compromised packages

### [critical] numbors npm package 1.6.1 is malware — full machine compromise; rotate secrets
https://helix.ml/threat-watch/i/numbors-npm-package-1-6-1-is-malware-full-machine-compromise-rotate-secrets · Supply chain · no-fix-needed · since 2026-10-20
GitHub's malware database published GHSA-682c-pwqm-7gxv on 2026-10-26 flagging version 1.6.1 of the npm package numbors as embedded malicious code, with no patched version. Anyone who installed or ran 1.6.1 should treat that machine as fully compromised, rotate every secret reachable from it from a clean machine, and rebuild the host, because removing the package may not remove what it installed. The package's 1.6.1 was published on 2026-10-20. Its metadata was last modified at 02:39 UTC on 2026-10-26, the same time the advisory was published, and 1.6.1 no longer appears in the registry's version list, which suggests it was withdrawn then. No write-up of the payload's behaviour has been published that we could find.
Do: Search lockfiles, global installs and CI caches for numbors 1.6.1 (for example npm ls numbors) and remove it; Treat any machine or runner that installed or ran numbors 1.6.1 as fully compromised: rotate all secrets, keys and tokens from a clean machine and rebuild the host; Do not rely on 1.6.0 as safe on this evidence: it is not flagged, but it is unverified and was published by the same package; Audit CI/CD runners and developer machines that installed the package for persistence and outbound connections since 2026-10-20; Block the numbors package name in dependency policy until the publisher is vetted

### [critical] Dependency-confusion beacon malware: wiseke npm packages (@greenlake, @sxm-web, @drone-js-ext, @ppa-web-components) — postinstall exfiltrates hostname/paths to 185.158.107.175
https://helix.ml/threat-watch/i/dependency-confusion-beacon-malware-wiseke-npm-packages-greenlake-sxm-web-drone-js-ext-ppa-web-components-postinstall-ex · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-26 GitHub advisories (GHSA-pfqf-544g-rvp9 and others) flagged 14 dependency-confusion packages published by npm user wiseke under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 and 2026-10-25. Each package poses as a 'compatibility shim' for an 'authorized dependency-confusion test', uses inflated version numbers to win resolution, and runs beacon.cjs via a postinstall script (also on import). It POSTs hostname, install path and cwd over plain HTTP to http://185.158.107.175:8787/_ah/dc, while exporting a no-op Proxy so builds keep running. index.js is byte-identical to ph-common (MAL-2026-1809). No patched versions exist; affected orgs are those whose internal scope names match these packages.
Do: Audit lockfiles and CI logs for any @greenlake/*, @sxm-web/*, @drone-js-ext/* or @ppa-web-components/* installs since 2026-10-23 and remove/quarantine them; Check egress and proxy logs for connections to 185.158.107.175:8787 (path /_ah/dc) and treat hits as confirmed compromise of the build host; Rebuild affected projects from clean caches and rotate any secrets accessible to CI runners on those hosts; Block the C2 IP at the firewall and disable install scripts (npm config set ignore-scripts true) in CI; Register/claim these internal scopes on npm and enable dependency-confusion protections

### [critical] Malicious npm packages: harlow-css-mixer, birch-css-utils, postcss-semantic-themes — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-harlow-css-mixer-birch-css-utils-postcss-semantic-themes-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-25
Three npm packages were flagged by GitHub on 2026-10-26. Two of them, birch-css-utils and postcss-semantic-themes, are described by OSV as zero-runtime CSS theme kits that carry obfuscated JavaScript. birch-css-utils and postcss-semantic-themes were published on 2026-10-25, and their OSV records name the malicious versions as birch-css-utils 1.2.2 and 1.3.0 and postcss-semantic-themes 1.0.0 and 1.0.1. The analysis describes a shared design: birch-css-utils asks users to install it as a Tailwind alias (tailwindcss@npm:birch-css-utils), and its tarball carries about 760 KB of obfuscated JavaScript in modules named build-cache, cache-sweep and cache-warm. postcss-semantic-themes runs a chain of obfuscated modules on require or import, with XOR- and base64-encoded blobs. harlow-css-mixer has only the generic GitHub advisory text, and no version history survives, so its malicious versions could not be confirmed. npm replaced all three names with placeholders on 2026-10-26, and no safe version exists. Any machine that installed one should be treated as fully compromised: rebuild it and rotate its secrets from a clean machine.
Do: Treat every machine that installed any of the three packages as fully compromised; rebuild and rotate secrets from a clean machine; Remove the packages from projects and lockfiles, and search for the Tailwind alias form (tailwindcss@npm:birch-css-utils) in package.json and lockfiles, which npm can hide behind a legitimate package name; Review install scripts and build caches for build-cache, cache-sweep and cache-warm .mjs files in node_modules and CI caches; Block the three names in the internal proxy and dependency scanning

### [critical] @capsense npm packages (@capsense/core-ui, @capsense/ccx-welcome-page) — malicious packages fully compromise installed machines
https://helix.ml/threat-watch/i/capsense-npm-packages-capsense-core-ui-capsense-ccx-welcome-page-malicious-packages-fully-compromise-installed-machines · Supply chain · no-fix-needed · since 2026-10-25
GitHub published two malware advisories on 2026-10-26 (GHSA-c2qc-c78r-386v and GHSA-phgq-4c2g-6xpx) for @capsense/core-ui and @capsense/ccx-welcome-page, both replaced by npm security placeholders at 16:19–16:21 UTC the same day. The malicious versions named by OSV are 99.99.99 and 99.99.100 of each package, published 2026-10-25 between 17:28 and 17:35 UTC; OSV imported the detections at 18:19 and 19:13 UTC the same evening. GitHub classes every version as affected, no safe version exists, and the npm metadata shows no fixed release. Any machine that installed or ran either package should be treated as fully compromised: rotate secrets and keys from a clean machine, and do not assume uninstalling removed what the package dropped. The @capsense scope is held by npm now, so it is not confirmed that it belongs to any real company; treat the 'vendor' as unknown until a verified owner is found. No writeup for these packages was found.
Do: Immediately rotate all secrets, keys, tokens and credentials stored on any machine where these packages were installed, using a clean, uncompromised computer; Remove both packages from all projects and lockfiles and audit for transitive dependencies on them; Rebuild affected systems from trusted images; do not assume uninstalling the package removed the malware; Review CI/CD and developer machines that ran installs or builds for persistence and indicators of compromise; Block the @capsense scope in npm installs and dependency firewall policies

### [critical] Malicious npm packages: path-stream-utils-testmetest and @iobandamwer/native-helper — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-packages-path-stream-utils-testmetest-and-iobandamwer-native-helper-full-system-compromise-on-install-no-c · Supply chain · no-fix-needed · since 2026-10-25
GitHub published two malware advisories on 2026-10-26 (GHSA-7pvr-f92m-6fwg and GHSA-g457-v22r-g8j3) for the npm packages path-stream-utils-testmetest and @iobandamwer/native-helper, both replaced by npm security placeholders at 16:28 UTC the same day. The first malicious publishes are dated in the registry to 2026-10-25 (path-stream-utils-testmetest 0.0.1 at 23:05 UTC, @iobandamwer/native-helper 0.0.1 at 23:21 UTC), so the attack began the day before the advisory. OSV names path-stream-utils-testmetest 0.0.1 through 0.0.4 and @iobandamwer/native-helper 0.0.1 and 0.0.2 as malicious. GitHub classes every version as affected, no safe version exists, and no fix or CVE is reported. Any machine that installed or ran either package should be treated as fully compromised: rotate secrets and keys from a clean machine, and do not assume uninstalling removed what was dropped. The @iobandamwer scope also appears in a second Threat Watch record for @iobandamwer/cache-helper, and the -testmetest name suffix also appears on other packages from different publishers; the sources do not show a single shared event for these.
Do: Check dependency trees and lockfiles for path-stream-utils-testmetest and @iobandamwer/native-helper; quarantine and rebuild any machine where they were installed; Rotate all secrets, tokens, SSH keys, and credentials stored on affected machines, using a clean computer; Remove the packages and reimage/rebuild affected systems rather than trusting cleanup; Audit npm install logs and CI runners for exposure; block the package names in registry proxies and dependency firewalls; Review for signs of compromise (unusual processes, outbound connections, credential use) on affected hosts

### [high] GitHub: stolen tokens planted secret-dumping workflows in 13,500+ branches across 850+ accounts (Gheist)
https://helix.ml/threat-watch/i/gheist-github-actions-token-abuse-stolen-tokens-plant-secret-harvesting-workflows-across-850-accounts · Supply chain · no-fix-needed · since 2026-10-25
Wiz Research (Rami McCarthy and Hila Ramati) published on 2026-10-25 an account of a campaign it calls Gheist, which it has tracked since 2026-09-15. Operators used stolen GitHub tokens to push a workflow file named sync-check.yml onto branches named ci-sync- plus six characters, in every repository those tokens could reach. The workflow prints the environment and a JSON dump of all secrets through base32 into its own run log, the operator downloads that log through the GitHub API, and the run is deleted seconds later, so no attacker domain exists to block. Wiz counts more than 13,500 planted branches and more than 850 compromised accounts, with victims ranging from personal projects to enterprise private repositories; roughly two-thirds of the implicated accounts are no longer available on GitHub. GitHub's approval hold for workflow runs in public repositories, in effect since 2026-07-28, stopped the payloads there, but it does not cover private repositories or GitHub Enterprise Server, where Wiz saw the payloads run. In one enterprise, hours after the planting, cloud credentials from the same organization were used to enumerate AWS Secrets Manager. The fix is credential hygiene: revoke and rotate tokens and every secret the affected repositories could reach, and harden workflows and runners.
Do: Revoke and rotate long-lived GitHub tokens (PATs, fine-grained and service-account tokens), prioritising those with write access; move automation to short-lived, scoped credentials (GitHub Apps or short-lived fine-grained tokens); Hunt: search repositories for branches matching ci-sync- plus six lowercase letters or digits and a commit titled 'ci: sync config' that adds .github/workflows/sync-check.yml; Hunt: review GitHub audit logs for short-lived runs that were deleted soon after creation and for the gheist user agent; review cloud logs for OIDC role assumptions from ci-sync- branches; Hunt: on self-hosted runners, look for .gdmp_* files; treat any self-hosted runner that executed a ci-sync branch as compromised; Respond: rotate every secret available to affected repositories, including cloud credentials such as AWS Secrets Manager secrets; revoke the tokens that pushed the commits; check account owners' devices for infostealers; Harden: require reviewers on production environments, scope OIDC trust to protected branches, run self-hosted runners as ephemeral hosts, and enforce MFA on developer accounts

### [critical] PyPI donutautosellsrc: claudeopuseni, claudeopusenifile, claudeopusfile run staged infostealer (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquat-infostealer-campaign-donutautosellsrc-claudeopuseni-claudeopusenifile-dictmerge-lite-malicious-packages-s · Supply chain · no-fix-needed · since 2026-10-26
Three malicious PyPI packages in the donutautosellsrc campaign, claudeopuseni (0.1.0, 0.1.1), claudeopusenifile (0.1.3) and claudeopusfile (0.1.1, 0.1.2), carry a staged infostealer that is hidden in obfuscated code. They are malware with no fixed version. OpenSSF's analysis (kam193) says install-time obfuscated code fetches a payload hidden in an image. The payload is a Python application with a native extension that holds an infostealer, which sends collected data to a C2 server whose address is read from Polygon blockchain transaction history. Per the Amazon Inspector entries, claudeopuseni runs its payload on import, not at install. It checks whether it runs in a sandbox and whether a real user profile exists, and it can fall back to a payload embedded in the package. claudeopusfile runs from its setup.py during pip install. Anyone who installed these versions should treat the host and its credentials as compromised, remove the packages and rebuild.
Do: Uninstall claudeopuseni, claudeopusenifile and claudeopusfile and block them in your package index or proxy. No fixed version exists.; Treat every host that installed or imported them as compromised. Rotate credentials, SSH keys, API tokens and saved browser passwords from that host.; Rebuild affected machines from trusted images. Look for persistence and for downloaded executables.; Hunt for indicators: outbound connections to thisisafalsepositive.st, the Polygon address 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a, and VirusTotal hash d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e.; Audit lockfiles, CI caches and install logs for these packages and for other packages from the same campaign.

### [critical] @worca/app npm: malicious 1.14.0-rc.2 and 1.14.0-rc.4 fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/worca-app-npm-package-malicious-code-in-1-14-0-rc-2-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-26
GitHub's malware advisory database flagged two prerelease builds of the @worca/app npm package, 1.14.0-rc.2 and 1.14.0-rc.4, as embedded malicious code. Anyone who installed or ran either build should treat that machine as fully compromised and rotate every secret it could reach from a clean machine, because removing the package does not undo what it may have done. Both builds were published by the project's own GitHub Actions release workflow through npm trusted publishing, with signed provenance, after tags were pushed under the maintainer's GitHub account. Our metadata review found nothing that shows the npm publishing path itself was abused, but it cannot tell a compromised maintainer GitHub identity apart from malicious code that entered the development branch and was released as designed. The stable 1.14.0 release, cut about 2.5 hours after rc.4 from a commit whose only change is the version string in package.json and package-lock.json, is not flagged, yet it carries the same source tree and dependency lockfile as rc.4, so it cannot be called safe on this evidence. Both prerelease builds had dropped out of the npm registry's version list by 10:42 UTC on 2026-10-26. The last release before the flagged builds is 1.13.1.
Do: Remove @worca/app 1.14.0-rc.2 and 1.14.0-rc.4 from projects, lockfiles and CI caches; Treat any machine that installed or ran either build as fully compromised: rotate secrets from a clean machine and rebuild the host; Pin @worca/app to 1.13.1 or earlier until 1.14.0 has been verified; do not upgrade on the strength of this record; Verify 1.14.0 by comparing the published tarball with git archive of commit dbd969eb4c in an isolated environment, and check its Sigstore provenance; Audit the maintainer's GitHub account for unexpected pushes, tags, sessions and tokens around 05:50 to 11:00 UTC on 2026-10-26

### [high] Codex, Claude Code: planted AGENTS.md in Downloads makes agents install malicious npm package function-color
https://helix.ml/threat-watch/i/malfex-ai-coding-agents-codex-claude-code-planted-agents-md-in-downloads-tricks-agent-into-installing-malicious-npm-pack · Supply chain · no-fix-needed · since 2026-10-26
Forever Security (researchers Gal Weizman and Omer Samet) published research on 2026-10-26 showing that a website can save an AGENTS.md or CLAUDE.md file into a user's Downloads folder without a prompt, and that a coding agent opened in that folder follows the file's instructions. In the researchers' tests, Codex ran the malicious npm package function-color in more than 90% of attempts and changed its own settings in a way that applies machine-wide. Claude Code followed through about half the time; the planted file had it save a settings change routing requests to an attacker-controlled server, and a replayed login token then gave account takeover. Forever says about half of its customers run a coding agent in Downloads. OSV's malware record for function-color (versions 1.0.0 and 1.7.3, GHSA-m6cg-6crx-mggv) dates from 2026-10-07, and npm has since removed the package. There is no vendor patch: the researchers say there is nothing for OpenAI or Anthropic to patch, so the mitigation is behavioural. Keep agents out of Downloads, read instruction files you did not write, check agent settings for servers or addresses you did not add, keep approval prompts and sandboxes on, and treat any planted file as a token leak.
Do: Developers: do not start Codex, Claude Code or any other coding agent in ~/Downloads or in a freshly downloaded folder; Developers: read any AGENTS.md or CLAUDE.md you did not write, including in repositories you have just copied, before letting an agent run; Developers: check agent settings files for MCP servers, gateways or base URLs you did not add; Codex settings apply machine-wide; Developers: keep approval prompts and sandboxes enabled and treat any instruction to disable them as hostile; Developers: if a planted file is found, assume the login token leaked and rotate it; treat any machine where function-color was installed as compromised; Fleet or IT admins (recommended, not stated in the source): sweep managed machines for function-color and for unexpected instruction files in Downloads, and apply the same no-agents-in-Downloads rule by policy

### [critical] PyPI malware: changes-lxc-wrapper & zagents-framework exfiltrate host info on install/import (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquat-malware-changes-lxc-wrapper-zagents-framework-exfiltrate-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-10-26
Two malicious PyPI packages, changes-lxc-wrapper (versions 0.0.0, 0.1.0) and zagents-framework (versions 6.25.30.10b5, 99.25.30.10b5), were published to the GitHub Advisory Database on 2026-10-26 as embedded malware (CWE-506). Installing either package or importing the module exfiltrates basic host information such as IP address and username; the packages have no other purpose. Both override the install command in setup.py to execute malicious code during installation, meaning even a pip install without importing triggers the exfiltration. Classified under the GENERIC-standard-pypi-install-pentest campaign as PROBABLY_PENTEST with limited risk. No patched versions exist; the packages should be treated as malware and removed.
Do: Check environments and dependency lockfiles for changes-lxc-wrapper or zagents-framework and uninstall them immediately; Treat any host where they were installed or imported as having leaked IP/username data; review for follow-on targeting; Rotate credentials if the affected host is shared or CI infrastructure; Block the package names in PyPI proxies/mirrors and internal artifact repositories; Audit setup.py-based installs and prefer hash-pinned dependencies from trusted sources

### [critical] netweavex (PyPI): NetworkX typosquat runs obfuscated code on import and fetches a remote script (no CVE)
https://helix.ml/threat-watch/i/netweavex-typosquat-malware-pypi-malicious-clone-downloads-remote-code-on-import-no-cve · Supply chain · no-fix-needed · since 2026-10-26
The PyPI package netweavex, versions 1.1.0, 1.1.1 and 1.1.2, is malware and a typosquat of NetworkX, the graph library published on PyPI as networkx. It copies NetworkX's public API and README examples, including the 'import netweavex as nx' idiom. Importing it runs obfuscated code. OpenSSF's Amazon Inspector analysis says the code reverses, base64-decodes and zlib-decompresses a string literal and passes the result to exec(), so attacker bytecode runs at import. A second analysis (kam193) says the import also fetches a script from the GitHub repository jerryjohnston91/helper-library. That script was only a placeholder when examined. Both sources classify the package as malicious, and no fixed version exists. Remove netweavex, audit any host where it was imported, rotate its credentials, and install networkx if the code needs NetworkX.
Do: Remove netweavex immediately. Do not use any version.; Audit environments and CI for netweavex 1.1.0 to 1.1.2 and rebuild the systems where it was imported.; Rotate credentials and secrets on machines where the package was imported.; If the code needs NetworkX, install networkx from PyPI and verify the name before installing. Check for typosquats.; Block the package name and the GitHub repository jerryjohnston91/helper-library in dependency firewalls and proxies.

### [critical] Malicious npm package ctf-agent 0.1.0 — installed machines must be treated as compromised (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-ctf-agent-0-1-0-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-26
The npm package ctf-agent published a 0.1.0 release on 2026-10-26 that GitHub flagged as malware, GHSA-2j3v-rjgw-5wgg, the same day. Unlike the other records in this set, the name had an earlier release history: versions 1.2.0 through 1.3.7 were published between 2026-09-06 and 2026-09-11 under the same maintainer account. The new 0.1.0 is numbered lower than those earlier versions, and the packument now lists only a 0.0.0-stage version. That points to a name takeover or re-creation after the earlier versions were removed, but the registry alone does not show which. No payload description is in any source I read. Any machine that installed 0.1.0 should be treated as compromised, with secrets rotated from a clean machine. No safe version exists.
Do: Treat any machine that installed ctf-agent 0.1.0 as fully compromised; rebuild and rotate secrets from a clean machine; Remove ctf-agent from projects and lockfiles; check whether 1.x versions were in use before 2026-10-26 and treat them as unverified; Check for maintainer or ownership changes on the ctf-agent name before trusting any future release; Block ctf-agent 0.1.0 in the internal proxy and dependency scanning

### [critical] Fortinet: critical/high fixes in FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator (Nov 10)
https://helix.ml/threat-watch/i/fortios-fortimanager-fortianalyzer-fortimail-fortiauthenticator-critical-high-severity-flaws-found-with-ai-assistance-de · Vulnerabilities · patched · since 2026-10-26
On 2026-10-21 Fortinet's CISO Collective post said its upcoming security hardening releases would include critical and high-severity fixes. The updates shipped on 2026-10-22 for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, and the fixed builds are listed in fixedVersions. Canadian Centre for Cyber Security advisory AV26-1081 (dated 2026-10-23; affected status as of 2026-10-21) gives the same branch thresholds. Fortinet has published no CVE, FG-IR or CVSS identifiers for these fixes; its PSIRT page says the public advisories will appear at the next Patch Tuesday, 2026-11-10. Help Net Security (2026-10-26) reports the flaws were uncovered with the help of AI models and validated by humans: Fortinet first tested products without source code and then ran source-code testing, which produced most findings. Of more than 100 tests across 30 product families, about 40% were real vulnerabilities, 30% false positives and 30% hardening improvements that are not exploitable flaws. Fortinet says some may be remotely exploitable without authentication and warns that AI can chain lower-severity flaws into an exploitable one. Fortinet and the national CERTs checked report no exploitation of these fixes as of 2026-10-23, and CISA KEV has no entry. This release does not address PHP2Shell, which Fortinet says does not affect these products. Upgrade internet-facing devices first, restrict admin access to trusted addresses, keep FortiManager off the internet, and enforce MFA on admin accounts until the builds are in place.
Fixed: FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14 (or above); FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13 (or above); FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13 (or above); FortiMail 8.0.2, 7.6.7, 7.4.9 (or above); 7.2 users move to 7.4 or later; FortiAuthenticator 8.0.4, 6.6.11 (or above)
Do: Upgrade internet-facing FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator devices to the fixed builds in fixedVersions first; Upgrade the remaining deployments before the 2026-11-10 public advisories; Restrict admin access to trusted IP addresses, keep FortiManager off the internet, use unique strong admin credentials, and enforce MFA for admin accounts until patched; Watch for exploitation after the 2026-11-10 advisories are published; the researchers say attackers will not wait for that date

### [critical] w-mousekey npm malware — package fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/w-mousekey-npm-malware-package-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-10-25
GitHub's malware advisory database published GHSA-gmhr-j769-j6qf on 2026-10-25 flagging npm package w-mousekey version 1.0.42 as embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. No patched versions exist and no known source code is available; the package has roughly 1,139 downloads per month. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer or CI environment that installed w-mousekey 1.0.42 must treat secrets and keys on that machine as stolen and rotate them from a clean computer.
Do: Rotate all secrets, keys, and credentials stored on any machine that installed w-mousekey 1.0.42, using a different clean computer; Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system; Audit dependency lockfiles and CI caches for w-mousekey and block the package in registries/proxies; Review access logs and monitor for suspicious activity from affected hosts

### [critical] Malicious npm package event-bus-lite-testmetest — obfuscated installer decrypts and runs hidden Bun payload
https://helix.ml/threat-watch/i/malicious-npm-package-event-bus-lite-testmetest-obfuscated-installer-decrypts-and-runs-hidden-bun-payload · Supply chain · no-fix-needed · since 2026-10-22
The npm package event-bus-lite-testmetest@0.0.6 is malicious code, flagged by Amazon Inspector and OpenSSF. Its binding.gyp uses a GYP <!(...) command expansion to run node index.js during the automatic node-gyp rebuild triggered by npm install. index.js is multi-layer obfuscated (Caesar-shifted char-code array passed to eval), reads a bundled ~312 KB high-entropy lib_native.dat, brotli-decompresses and AES-128-GCM-decrypts it with hardcoded key/IV/AAD, writes the plaintext to a mkdtempSync('.b-') temp directory, and spawns the Bun runtime to execute the decrypted payload — bypassing Node-only analysis. The payload's contents are not inspectable from the shipped artifact. Only version 0.0.6 is affected; no fixed version exists and the package should be treated as compromised. Anyone who installed it should assume arbitrary code execution on their machine.
Do: Remove event-bus-lite-testmetest@0.0.6 from all dependencies and lockfiles; Audit install logs and CI for installs of this package; rebuild affected machines/containers from trusted images; Rotate credentials, tokens, and secrets accessible from affected environments; Check for temp directories matching '.b-*' and any spawned Bun processes as indicators of compromise; Block the package name in npm/registry allowlists and add the payload sha256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73 to detection

### [high] zagents-message-bus (PyPI): malicious package exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/zagents-message-bus-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-10-25
GitHub Advisory Database published GHSA-2hr3-wchh-6g2q on 2026-10-25 flagging the PyPI package zagents-message-bus as malicious. Installing the package or importing the module exfiltrates basic host information (e.g., IP address, username); the package has no legitimate purpose. It overrides the install command in setup.py to execute malicious code during installation. Affected versions are 1.0.5, 1.0.10, 99.99.99, and 99.99.100, with no patched versions available. Categorized as PROBABLY_PENTEST under the GENERIC-standard-pypi-install-pentest campaign with limited risk. Anyone who installed or imported the package should treat the host as potentially compromised and remove the package.
Do: Remove zagents-message-bus from all environments and dependency files; Audit systems where it was installed/imported for exfiltration of host data (IP, username) and signs of further compromise; Rotate credentials used on affected hosts and review network logs for outbound connections around install time; Block the package name in internal PyPI mirrors/dependency scanning; Check CI pipelines and lockfiles for historical use of the package

### [critical] nebulallm typosquatting malware: malicious PyPI package executes remote DLL during pip install
https://helix.ml/threat-watch/i/nebulallm-typosquatting-malware-malicious-pypi-package-executes-remote-dll-during-pip-install · Supply chain · no-fix-needed · since 2026-10-25
The PyPI package nebulallm version 1.4.3 is malicious malware, published to the GitHub Advisory Database on 2026-10-25 as GHSA-mvgr-2gjf-h99c (CWE-506, Embedded Malicious Code). It is a typosquat that overrides the install command in setup.py so malicious code runs during pip install. On installation it downloads a JScript script, which in turn downloads and executes a malicious remote DLL/executable; the campaign is categorized as MALICIOUS with infostealer-like intent. Anyone who pip-installed nebulallm 1.4.3 has executed attacker code on their machine. There are no patched versions — the package itself is the malware — so remediation is removal, host forensics, and credential rotation. Credit: OpenSSF malicious-packages, analysis by kam193.
Do: Immediately uninstall nebulallm and purge it from requirements/lockfiles and CI caches; Treat any machine or CI runner that installed it as compromised: rotate credentials, tokens, and keys accessible to that environment; Hunt for the downloaded JScript/DLL artifacts and review endpoint telemetry for follow-on activity; Block the package name in PyPI proxies/mirrors and audit for typosquats of similarly named LLM packages

### [critical] npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware
https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware · Supply chain · no-fix-needed · since 2026-10-25
On 2026-10-25 GitHub published four malware advisories (GHSA-fr38-45mf-vcqf, GHSA-5pw8-3xv5-6cmg, GHSA-4fw4-xm5r-mh69, GHSA-9w8h-674f-4x2j) covering npm packages appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search and appit-cordova-admob. All versions (>= 0) are affected, CWE-506 embedded malicious code, no patched versions exist. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential/key theft and remote control by an outside party. The names mimic legitimate Cordova/Ionic plugins, suggesting a typosquatting or account-compromise campaign targeting Ionic/Cordova developers. No exploitation details or fixed versions are available; removal alone may not eliminate the compromise.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages from all projects and lockfiles and rebuild from a clean environment; Audit build machines and developer workstations for persistence, unexpected processes and network connections; Check CI/CD pipelines and published app artifacts for inclusion of these packages and re-sign/rebuild affected apps; Block these package names in npm dependency policies and review dependency trees for similar typosquats

### [medium] fontus PyPI malware: fingerprinting/exfiltration package (no CVE)
https://helix.ml/threat-watch/i/fontus-pypi-malware-fingerprinting-exfiltration-package-no-cve · Supply chain · no-fix-needed · since 2026-10-25
OpenSSF and GitHub advisory GHSA-g5mh-f2v3-6p25 (published 2026-10-25) flag the PyPI package 'fontus' as malicious. Versions 0.0.1–0.0.3 contain code that performs system fingerprinting, exfiltrating basic information such as IP address, username, and the list of available fonts, with no other functionality. The campaign is categorized PROBABLY_PENTEST with limited risk, and CWE-506 (embedded malicious code) is noted. No patched versions exist; the package is malware and should not be used. Anyone who installed fontus should treat the exfiltrated data as leaked and remove the package.
Do: Remove/uninstall fontus from all environments and block it in dependency policies; Audit install logs and CI for any use of fontus; Rotate credentials or tokens if installs ran on sensitive hosts; Assess what host data (IP, username, fonts) may have been exfiltrated and whether it creates risk; Add the package and its hashes to internal blocklists/SCA denylists

### [critical] Dependency-confusion npm malware: @drone-js-ext & @fmr-ap153177/@futurae-public stubs beacon hosts / pull off-registry tarballs
https://helix.ml/threat-watch/i/dependency-confusion-npm-malware-drone-js-ext-fmr-ap153177-futurae-public-stubs-beacon-hosts-pull-off-registry-tarballs · Supply chain · no-fix-needed · since 2026-10-25
Four malicious npm packages published as dependency-confusion lures were flagged on 2026-10-25. @drone-js-ext/core and @drone-js-ext/vip-badge (both v99.0.1) ship a beacon.cjs that collects hostname, install path, cwd and Node version and POSTs it in cleartext to a hardcoded bare-IP endpoint (http://185.158.107.175:8787/_ah/dc), firing on npm install (postinstall) and at require() time; the rest of each package is a no-op Proxy stub. @fmr-ap153177/apex-kit-icons and @futurae-public/adaptive-js (both v99.9.1) declare their sole dependency 'ltidisafe' as a direct HTTPS tarball URL on a Google Cloud Storage bucket with no version pin or integrity hash, giving whoever controls the bucket code execution on every installer. Any developer or CI system resolving these names instead of internal packages is affected. No patched versions exist; the packages are malware and should be removed.
Do: Audit lockfiles and CI logs for any of the four package names/versions and for connections to 185.158.107.175:8787 or ltidi.storage.googleapis.com; treat any hit as a host-compromise indicator; Remove the packages and rebuild affected environments from clean images; Block the beacon IP and the ltidi.storage.googleapis.com tarball URL at egress firewalls; Enforce registry-only resolution: disallow HTTPS tarball dependencies, pin internal scopes in .npmrc, and use scoped registry mappings to defeat dependency confusion; Disable or gate npm lifecycle scripts (e.g. --ignore-scripts) in CI and developer workstations; Rotate any secrets present on machines where these packages were installed

### [critical] Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625)
https://helix.ml/threat-watch/i/arista-velocloud-orchestrator-cve-2026-114625 · Vulnerabilities · patched · since 2026-10-23 · CVE-2026-114625
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. CISA added CVE-2026-114625 to its Known Exploited Vulnerabilities catalog on Oct 23, 2026, which means attackers are exploiting it in the wild.
Fixed: VCO On-Prem 5.2.3.18; VCO On-Prem 6.1.3.10; VCO On-Prem 6.4.2.12
Do: Upgrade VeloCloud Orchestrator On-Prem to 5.2.3.18, 6.1.3.10, 6.4.2.12 or later (hosted VCO was already patched by Arista); Block and review access from the IPs observed in ongoing exploitation: 74.82.197.86 and 38.54.50.151; Until patched, restrict the VCO web interface to administrative networks and monitor for attempts to reach internal or local services; Review VCO web access logs for URL-like path components, encoded characters and unusual request rates, and review recent administrator activity for privilege changes; If compromise is suspected, preserve VCO web, backend, system and database logs plus file-system timestamps before remediating

### [critical] Collabora Online – Built-in CODE Server OS Command Injection Vulnerability (CVE-2026-110447)
https://helix.ml/threat-watch/i/collabora-collabora-online-built-in-code-server-cve-2026-110447 · Vulnerabilities · unknown · since 2026-10-23 · CVE-2026-110447
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on Oct 23, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 26, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] PyPI: malicious package journey-teste-shellhello spawns reverse shell during installation (no CVE)
https://helix.ml/threat-watch/i/pypi-malicious-package-journey-teste-shellhello-spawns-reverse-shell-during-installation-no-cve · Supply chain · no-fix-needed · since 2026-10-23
The PyPI package journey-teste-shellhello version 0.2.0 was identified as malicious: it overrides the install command in setup.py to execute code during installation, and in specific environments starts a reverse shell, giving an attacker arbitrary command execution on the victim machine. The GitHub advisory (GHSA-r42r-j8h5-x7r3), published 2026-10-23 and credited to OpenSSF's malicious-packages database, categorizes it as MALICIOUS under campaign 2026-10-journey-test-helloshell and marks it a targeted attack (CWE-506, embedded malicious code). Anyone who pip-installed version 0.2.0 is affected. There are no patched versions; the package is malware and should be removed, not upgraded.
Do: Check pip/requirements logs and environments for any install of journey-teste-shellhello==0.2.0 and remove it; If installed, treat the machine as compromised: isolate, hunt for reverse-shell/network callbacks, rotate credentials, and rebuild from a clean image; Block the package name in internal PyPI mirrors/proxies and alert on attempts to install it; Review CI/CD and developer workstations for signs of execution during pip install phases

### [critical] @tekmidian/pai: npm package flagged as malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/tekmidian-pai-npm-package-flagged-as-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub's advisory database published GHSA-xvgg-qjjh-gq34 on 2026-10-23 flagging the npm package @tekmidian/pai as malware (CWE-506, embedded malicious code). Versions 1.0.8, 1.0.9 and 1.0.10 are affected, with no patched versions available — the package itself is malicious, not a compromised release. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attackers can exfiltrate secrets and keys and maintain control of the host. Removal of the package does not guarantee removal of all malicious software. No fixed version exists; the only remediation is removal plus credential rotation and host rebuild.
Do: Remove @tekmidian/pai from all projects and lockfiles and block the package in your dependency allowlists/CI; Treat affected machines as fully compromised: rotate all secrets, keys, and credentials stored on them, from a clean machine; Rebuild or reimage affected hosts; do not assume package removal removes the malware; Audit logs and network traffic for signs of exfiltration or attacker persistence; Check dependency trees (including transitive dependencies) for other installs of the package

### [critical] @kibt/www-nuxt-i18n: npm package flagged as malware, all versions compromised (no CVE)
https://helix.ml/threat-watch/i/kibt-www-nuxt-i18n-npm-package-flagged-as-malware-all-versions-compromised-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub's advisory database published GHSA-2c7v-rmgw-3xrp on 2026-10-23 flagging the npm package @kibt/www-nuxt-i18n as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched versions exist; the package appears to be a typosquat-style malicious imitation of nuxt-i18n with no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying credential and secret theft by an outside party. Anyone who installed it via npm is affected. There is no fix beyond removal and remediation of the compromised host.
Do: Remove @kibt/www-nuxt-i18n from all projects and lockfiles and block the package in your registry/proxy allowlists; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean machine; Rebuild affected machines or containers from trusted images; do not assume removal of the package removes the malware; Audit npm install logs and CI pipelines for installs of the package and check for follow-on attacker activity; Switch to the legitimate nuxt-i18n package from a verified source

### [critical] @cecm-web-sdk/core: npm package is malware, full compromise of installed machines (no CVE)
https://helix.ml/threat-watch/i/cecm-web-sdk-core-npm-package-is-malware-full-compromise-of-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub's malware advisory database published GHSA-88qx-q5v7-q7x5 on 2026-10-23 flagging the npm package @cecm-web-sdk/core as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning an attacker may have full control and access to secrets, keys, and credentials on affected hosts. Removal of the package alone cannot be assumed to eliminate the malicious software. Any developer or CI environment that installed this package is affected; the only remediation is removal plus host rebuild and credential rotation.
Do: Treat any machine with @cecm-web-sdk/core installed or running as fully compromised; rotate all secrets, keys, and credentials from a clean machine immediately; Remove the package and rebuild/reimage affected developer machines and CI runners from trusted images; Audit dependency lockfiles, install logs, and npm audit trails to identify where the package was pulled in and block it in registries/proxies; Review for signs of persistence or exfiltration on affected hosts and check for unauthorized access using stored credentials

### [critical] @blueskydataplatform/shared-ui: npm package is malware, full compromise of any machine where installed (no CVE)
https://helix.ml/threat-watch/i/blueskydataplatform-shared-ui-npm-package-is-malware-full-compromise-of-any-machine-where-installed-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub published advisory GHSA-6x9m-j5h8-w3vg on 2026-10-23 flagging the npm package @blueskydataplatform/shared-ui as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and no patched version exists; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning an attacker may have obtained full control, including access to secrets, keys and credentials stored on the machine. Removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system or host that installed this package is affected.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where the package was installed, using a clean machine; Rebuild affected machines/CI runners from trusted images rather than just uninstalling the package; Audit dependency lockfiles and remove @blueskydataplatform/shared-ui from all projects and caches; Review logs and systems for signs of attacker activity following installation; Block the package in internal registries/proxies to prevent reinstallation

### [critical] @ecg-internal (npm): four packages flagged as malware, full compromise of affected machines (no CVE)
https://helix.ml/threat-watch/i/ecg-internal-npm-four-packages-flagged-as-malware-full-compromise-of-affected-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23 GitHub published four malware advisories covering every published version of four npm packages under the @ecg-internal scope: js-react-i18n (GHSA-5x9g-7rj9-4xc8), adobe-dmp-js (GHSA-vcj4-3hxm-4rf3), media-util-js-lib (GHSA-hcw5-m6mm-qg3q), and aurora-js-formatters (GHSA-9976-3w38-mrmj). All are rated critical with CWE-506 (embedded malicious code), no known source code, and no patched versions — the packages themselves are the malware. GitHub's guidance states any machine with these packages installed or running should be considered fully compromised, implying attackers may have obtained full control, harvested secrets and keys, and installed additional malicious software. Any project depending on these packages is affected; removal alone may not eradicate the compromise.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages from all projects and lockfiles and audit for persistence mechanisms or additional malware left behind; Rebuild or thoroughly forensically clean affected machines; treat them as attacker-controlled; Check CI/CD pipelines and build artifacts for use of these packages and re-run builds from clean environments; Audit npm dependency trees for other packages from the @ecg-internal scope or similar typosquats and block them

### [critical] GrabCAD (npm @grabcad/* packages): malicious packages published to npm compromise any machine that installs them (no CVE)
https://helix.ml/threat-watch/i/grabcad-npm-grabcad-packages-malicious-packages-published-to-npm-compromise-any-machine-that-installs-them-no-cve · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23 GitHub added four malware advisories for npm packages under the @grabcad scope: @grabcad/user-license (GHSA-6w2v-744r-g5j5), @grabcad/preferences-client (GHSA-mfh5-wvcp-2v6v), @grabcad/company-server-shared (GHSA-fpfw-7wv8-x4mh) and @grabcad/grabcad-shop-shared (GHSA-cc6r-jh8f-6c76). All versions (>= 0) are affected, with no patched versions and no known source code, and each is classified CWE-506 embedded malicious code. GitHub's guidance states any computer with these packages installed or running should be considered fully compromised, implying credential and secret theft and potential remote control by an outside entity. Any developer, CI system or build environment that installed any version is affected. There is no fix; removal alone cannot be assumed to eliminate the malware.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine that installed any of these packages, using a clean computer; Isolate and rebuild affected machines and CI runners from trusted images; do not trust removal of the package alone; Audit lockfiles, dependency caches and install logs to identify every environment where the packages were installed and what they may have accessed; Check for persistence, unauthorized access and exfiltration in logs since installation; treat linked cloud/SCM accounts as potentially compromised; Remove the packages from all projects and block the @grabcad npm scope in dependency firewalls/allowlists

### [critical] qowa (PyPI): malicious package disguised as utility provides C2 server/agent with file exfiltration via Telegram bot
https://helix.ml/threat-watch/i/qowa-pypi-malicious-package-disguised-as-utility-provides-c2-server-agent-with-file-exfiltration-via-telegram-bot · Supply chain · no-fix-needed · since 2026-10-23
OpenSSF and the GitHub Advisory Database flagged the PyPI package qowa (version 0.1.0) as malicious, published 2026-10-23 under campaign 2026-10-qowa. The package, disguised as a generic utility, embeds a C2 server and agent with pre-filled credentials. It can execute remote commands on victims' machines, exfiltrate files, and uses a Telegram bot as its command channel; it is classified as a RAT with spyware-like behaviour and Android-targeting code (CWE-506, Embedded Malicious Code). No patched versions exist; the package is malware and has been removed from distribution. Anyone who installed qowa 0.1.0 should treat the host as compromised.
Do: Remove qowa 0.1.0 from all environments and rebuild affected systems from clean images; Audit machines where it ran for exfiltrated files, Telegram-based C2 traffic, and persistence; rotate credentials stored on those hosts; Check dependency lockfiles, CI caches, and internal mirrors for qowa and block/reject the package name; Review proxy/firewall logs for Telegram API access from build or developer hosts around installation time

### [critical] skillward (npm): malicious package compromises machines of developers who install it (no CVE)
https://helix.ml/threat-watch/i/skillward-npm-malicious-package-compromises-machines-of-developers-who-install-it-no-cve · Supply chain · no-fix-needed · since 2026-10-23
The GitHub Advisory Database published GHSA-9wgc-5pgr-25p3 on 2026-10-23 flagging the npm package skillward as malware (CWE-506, embedded malicious code). Versions 0.1.1 and 0.1.2 are affected, with no patched versions and no known source code repository. Any machine where the package was installed or run must be considered fully compromised, with potential full control handed to an outside entity, exposing secrets, keys, and credentials to theft. All users of the package are affected; removal of the package alone cannot be assumed to remove the malicious software. There is no fix; remediation is incident response: rotate credentials and rebuild affected systems.
Do: Rotate all secrets, API keys, tokens, and credentials stored on or accessible from any machine where skillward was installed, using a clean machine; Remove skillward from all projects and lockfiles and audit for other signs of compromise; Reimage or rebuild affected machines; do not assume uninstalling the package removed the malware; Review access and audit logs for anomalous activity from affected systems; Block skillward in internal registries and dependency scanning to prevent reintroduction

### [critical] PyPI: Malicious packages onsokets, badgertask, brookworker, cobbleload published with file-exfiltration and remote-loader code (no CVE)
https://helix.ml/threat-watch/i/pypi-malicious-packages-onsokets-badgertask-brookworker-cobbleload-published-with-file-exfiltration-and-remote-loader-co · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23 GitHub's Advisory Database, crediting OpenSSF's malicious-packages project and researcher kam193, published malware advisories for four PyPI packages, all at version 0.1.0: onsokets (campaign 2026-10-proxyrubika), which contains automated file-exfiltration code targeting Android, and badgertask, brookworker, and cobbleload (campaign 2026-10-voice-synthesis-profiles), a coordinated set of loader packages that download and execute remote scripts from attacker-controlled URLs. No patched versions exist; the packages are outright malware (CWE-506). Anyone who installed any of these packages is exposed to file theft or arbitrary remote code execution. Removal of the packages and incident response are required; there is no vendor fix.
Do: Search dependency locks, environments, and CI for onsokets, badgertask, brookworker, or cobbleload and remove them immediately; If any package was installed, treat the host as compromised: rotate credentials, inspect for exfiltrated files, and rebuild affected machines and containers; Block these package names in internal PyPI mirrors/proxies and alert on any historical download attempts; Audit other recently published low-reputation PyPI dependencies, especially typosquat-like names, and pin to verified packages; Enable dependency scanning (e.g., GitHub Advisory/OSSF malware feeds) in CI to catch future malicious-package advisories

### [critical] 2026-10-voice-synthesis-profiles loader campaign: thornqueue, runpier, workslip, taskquay (PyPI) — malicious packages download and execute remote code (no CVE)
https://helix.ml/threat-watch/i/2026-10-voice-synthesis-profiles-loader-campaign-thornqueue-runpier-workslip-taskquay-pypi-malicious-packages-download-a · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23, GitHub Advisory Database (via OpenSSF malicious-packages and researcher kam193) published malware advisories for four PyPI packages: thornqueue, runpier, workslip, and taskquay, all at version 0.1.0. They belong to a coordinated campaign dubbed 2026-10-voice-synthesis-profiles consisting of similar loader packages that download and execute code from an attacker-controlled URL. The packages do not embed the final payload themselves, but provide deceptive mechanisms to load and run malicious code, with intent consistent with infostealer delivery (CWE-506, Embedded Malicious Code). No patched versions exist; the packages are pure malware and should be removed. Anyone who installed any of these packages is at risk of arbitrary remote code execution on their build or runtime environment.
Do: Search dependency locks, requirements files, CI logs and environments for thornqueue, runpier, workslip or taskquay and remove them immediately; If any package was installed, treat the affected machine/CI runner as compromised: rotate secrets, tokens and credentials accessible from it; Rebuild affected environments from trusted sources and audit for persistence or downloaded payloads; Block these package names in internal PyPI mirrors/proxies and enforce dependency allowlists or hash pinning; Monitor for follow-on packages from the same campaign and review new dependency additions for typosquat-style names

### [critical] npm malware: @k18k/entrypoint-sdk platform packages and orqiva-runtime-win32-x64 fully compromise installed hosts
https://helix.ml/threat-watch/i/npm-malware-k18k-entrypoint-sdk-platform-packages-and-orqiva-runtime-win32-x64-fully-compromise-installed-hosts · Supply chain · no-fix-needed · since 2026-10-23
GitHub's advisory database published four critical malware advisories on 2026-10-23 covering npm packages @k18k/entrypoint-sdk-darwin-x64 (0.2.0, 0.2.1), @k18k/entrypoint-sdk-darwin-arm64 (0.2.0, 0.2.1), @k18k/entrypoint-sdk-linux-x64 (0.2.0, 0.2.1), and orqiva-runtime-win32-x64 (0.1.0). The packages contain embedded malicious code (CWE-506) and no patched versions exist; GitHub states any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Any developer or CI system that installed these platform-specific binaries is affected. Removal alone is not guaranteed to eliminate the malicious software. Affected organisations must treat hosts as compromised, rotate all secrets from clean machines, and rebuild affected systems.
Do: Immediately remove the affected packages and treat all machines where they were installed or run as fully compromised; Rotate all secrets, keys, and credentials stored on or accessible from those machines, using a different clean computer; Rebuild or reimage affected developer workstations and CI runners rather than trusting cleanup; Audit dependency lockfiles and install history for the affected package names and versions; Block the packages in npm registries/proxies and monitor for reappearing lookalike packages

### [critical] Linux KVM: guest-to-host escape via malformed IPv4 checksum metadata lets guest VMs compromise the host (CVE-2026-99999)
https://helix.ml/threat-watch/i/linux-kvm-guest-to-host-escape-via-malformed-ipv4-checksum-metadata-lets-guest-vms-compromise-the-host-cve-2026-99999 · Vulnerabilities · patched · since 2026-10-16 · CVE-2026-99999
PwnEscape (CVE-2026-99999) is a Linux host kernel flaw, despite the name: the bug is in the IPv4 stack, not KVM. A guest can hand the host virtio-net checksum metadata that points inside the IPv4 header; the host writes the completed checksum there, corrupting a header it has already validated and acted on. A guest that controls its own packets can therefore leak host kernel memory back to itself repeatedly, crash the host and every VM on it, and, as the researcher demonstrated in his own lab, get root code execution on the host. The vulnerable code dates to virtio header support in 2008, so every kernel shipped since is affected. Paulos Yibelo of PWNAI Research found it in Vercel's sandbox security challenge and reported it privately on 4 September; Michael Tsirkin's fix landed upstream on 14 October. Red Hat notes a local attacker can trigger it too, so the fix matters well beyond virtualization hosts. Patched kernels are in distribution repositories now.
Fixed: Upstream kernel commit 6785011f8b16 ('ipv4: validate checksum_start before completing checksum'); AlmaLinux 8 kernel-4.18.0-553.177.1.el8_10; AlmaLinux 9 kernel-5.14.0-687.59.1.el9_8; AlmaLinux 10 kernel-6.12.0-211.67.1.el10_2
Do: Update the kernel everywhere, not just on hypervisors: a local attacker can trigger this too (Red Hat's assessment); On AlmaLinux 8/9/10 install kernel-4.18.0-553.177.1.el8_10, kernel-5.14.0-687.59.1.el9_8 or kernel-6.12.0-211.67.1.el10_2 (or newer) and reboot, confirming with uname -r; Take the fix from your own distribution (RHEL 9/10, Debian, Ubuntu, Proxmox and other KVM-based products) and verify it is the upstream 6785011f8b16 fix, not an earlier kernel; On virtualization hosts, migrate or shut down guests before rebooting so the patch does not become an outage; Until patched, treat guests you do not fully trust as able to read host memory: there is no published workaround, so isolate them on hosts you are willing to lose

### [high] Echo (labstack/echo): three denial-of-service vulnerabilities in BodyDump, Decompress and WebSocket proxy middleware fixed in v4.16.1 / v5.4.1
https://helix.ml/threat-watch/i/echo-labstack-echo-three-denial-of-service-vulnerabilities-in-bodydump-decompress-and-websocket-proxy-middleware-fixed-i · Vulnerabilities · patched · since 2026-10-23
Three coordinated advisories against the popular Go Echo framework (17K dependent repos) were published 2026-10-23, all fixed in v4.16.1 (and v5.4.1 for the proxy issue). BodyDump middleware captured request and response bodies without size limits, allowing memory exhaustion DoS (GHSA-f48p-c9v4-h7xv). Decompress middleware allowed unbounded gzip expansion, letting a small compressed request consume excessive memory/CPU (GHSA-h7wr-284f-5qvc). The Proxy middleware could retain handlers, goroutines and connections after WebSocket client disconnect, accumulating resources (GHSA-9969-6676-49h5, regression in v4.15.0+). All are opt-in middleware, not enabled by default, and no in-the-wild exploitation is known. Fixes add configurable capture/decompression limits (5 MiB default for BodyDump, 100 MiB for Decompress) and proper connection teardown.
Fixed: github.com/labstack/echo/v4 4.16.1; github.com/labstack/echo/v5 5.4.1
Do: Upgrade github.com/labstack/echo/v4 to 4.16.1 (and echo/v5 to 5.4.1 if used); Audit which routes use BodyDump, Decompress and WebSocket proxy middleware and prioritize exposed ones; If upgrading is delayed, disable BodyDump on exposed routes, place BodyLimit after Decompress, or disable WebSocket proxy routes; Configure MaxRequestBytes/MaxResponseBytes and MaxDecompressedSize appropriately rather than relying on defaults; Apply request deadlines and concurrency limits as defense in depth

### [high] Time4Popcorn (Popcorn Time fork): abandoned updater allowed RCE via hijacked update domain (CVE-2026-30612)
https://helix.ml/threat-watch/i/time4popcorn-popcorn-time-fork-abandoned-updater-allowed-rce-via-hijacked-update-domain-cve-2026-30612 · Vulnerabilities · partial · since 2026-10-23 · CVE-2026-30612
Eye Security registered the abandoned popcorntimeupd.xyz domain used by the Time4Popcorn Popcorn Time fork, whose Windows and macOS updaters fetched executables over unencrypted HTTP without signature verification (CVE-2026-30612). Whoever controlled the domain could push updates executing code as SYSTEM on Windows or root on macOS; Eye observed up to 3 million Windows and 350,000 macOS clients, including corporate, government, and military networks, though users appeared inactive. Between November 2025 and March 2026 Eye used the mechanism to deliver a payload disabling the updater, cutting requests 98% by March 1, then transferred domains to the Shadowserver Foundation. No malicious exploitation is reported. Residual risk remains: Android users cannot be remediated remotely, and the app embeds an unsandboxed 2014-era Chrome engine; full removal is recommended.
Do: Search endpoints for the Time4Popcorn app and popcorntimeupd.xyz traffic; uninstall the app entirely, including on Android devices; Check EDR/AV logs for any update or execution activity tied to popcorntimeupd.xyz or the Time4Popcorn updater; If the app was ever run with elevated privileges, review affected hosts for signs of compromise; Block the popcorntimeupd.xyz domain and related infrastructure at the perimeter

### [critical] Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)
https://helix.ml/threat-watch/i/pillow-critical-rce-flaws-in-python-image-library-via-crafted-eps-filenames-and-jpeg-tiff-buffers-cve-2026-112900-cve-20 · Vulnerabilities · patched · since 2026-10-16 · CVE-2026-112393, CVE-2026-112398, CVE-2026-112403, CVE-2026-112900
Pillow, the most widely used Python image library (~436M downloads/month), fixed a batch of vulnerabilities in version 13.0.0 released 2026-10-16. The headline flaw, CVE-2026-112900, lets an attacker run OS commands by controlling the filename of an EPS image, which Pillow passes unvalidated to Ghostscript; it affects versions 2.6.0–12.3.0 and only hosts with the gs binary installed. Two maintainer-critical fixes cover a stale-image-data memory bug and JPEG decoding overflows, including an FPX flaw enabling RCE from a single Image.open() call when olefile is installed, and CVE-2026-112403, a lossless-JPEG thumbnail buffer overflow. CVE-2026-112393, present since 2013, overflows a buffer when saving compressed TIFFs to in-memory buffers. No exploitation is known; a public PoC exists for the TIFF flaw. One JPEG flaw was found by Anthropic using Claude and validated by Ada Logics.
Fixed: 13.0.0
Do: Upgrade to Pillow 13.0.0 and rebuild containers, wheels, and base images bundling older copies; note Python 3.10 is dropped, so ensure Python 3.11+; Until upgraded, keep the Ghostscript gs binary off hosts processing untrusted uploads and never pass attacker-controlled filenames to Image.open() for EPS; Avoid draft()/thumbnail() on untrusted JPEGs, or call load() first or pass reducing_gap=None; Treat saving user-supplied TIFF images to in-memory buffers (e.g. io.BytesIO) as a sensitive path

### [high] APT41 BlackX UEFI bootkit bypasses Secure Boot via unrevoked Baton Drop certificate (CVE-2022-21894)
https://helix.ml/threat-watch/i/apt41-blackx-uefi-bootkit-bypasses-secure-boot-via-unrevoked-baton-drop-certificate-cve-2022-21894 · Vulnerabilities · partial · since 2026-10-23 · CVE-2022-21894
Kaspersky reports a new UEFI bootkit, BlackX, used in an early-2026 espionage campaign against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan, attributed with medium confidence to China-linked APT41. BlackX is a copycat of BlackLotus, exploiting the Baton Drop flaw (CVE-2022-21894) on fully patched Windows systems where admins never manually applied Secure Boot DBX revocations of the 'Windows Production PCA 2011' certificate (which expired 2026-10-19 but still loads vulnerable binaries unless blocklisted). The bootkit enrolls Machine Owner Keys, injects a kernel driver signed with a now-revoked certificate to tamper with security software and ETW, and drops a cloud-C2 RAT plus OxiDLLRunner (Rust payload via googleupdate.exe sideloading, C2 archivetj[.]com). Full remediation requires manual Secure Boot revocation steps beyond installing updates.
Do: Manually apply Microsoft's Secure Boot revocation mitigations: add 'Windows Production PCA 2011' to the UEFI Forbidden Signature Database (DBX), following Microsoft's CVE-2022-21894 guidance; Verify DBX revocations are actually present on endpoints, since patch installation alone does not enforce them; Hunt for indicators: inst.exe under C:\ProgramData\Intel\, PVMDIJGKAX2 encrypted payload file, OxiDLLRunner, googleupdate.exe sideloading, and traffic to archivetj[.]com; Restrict and monitor administrator privileges and physical access, prerequisites for bootkit deployment; Monitor for tampering with security processes, registry callbacks, and ETW providers; ensure EDR tamper protection is enabled

### [critical] npm: four malicious packages (@conduitops/logview-archive, formatting-subtitles, simplewave, log-rotate-testmetest) execute attacker-controlled code at install time (no CVE)
https://helix.ml/threat-watch/i/npm-four-malicious-packages-conduitops-logview-archive-formatting-subtitles-simplewave-log-rotate-testmetest-execute-att · Supply chain · no-fix-needed · since 2026-10-22
GitHub Advisory Database published four npm malware advisories on 2026-10-22, each critical with no patched versions. @conduitops/logview-archive uses a postinstall hook to fetch and run a package from an attacker-controlled plain-HTTP bare-IP registry (139.196.94.195:8080) hidden behind base64+XOR masking. formatting-subtitles hides shell commands inside a fake JS comment in prepare.js, beaconing to webhook.site and executing unpinned content from a mutable GitHub Gist. simplewave exfiltrates os.hostname() to an oast.fun Interactsh collector on install. log-rotate-testmetest abuses binding.gyp command expansion to run a ROT+AES-GCM+brotli-obfuscated payload under Bun. Any developer or CI machine installing these versions gets arbitrary code execution or data exfiltration; no vendor fix exists since the packages are malware.
Do: Search dependency locks, CI logs and caches for the four package/version pairs and remove them from all manifests and lockfiles; Treat any machine or CI runner that installed them as compromised: rotate credentials, tokens and keys accessible to those environments and rebuild from clean images; Block egress to 139.196.94.195:8080, webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7, api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c and oast.fun in build environments; Disable or restrict npm lifecycle scripts (e.g. npm config set ignore-scripts true, --ignore-scripts in CI) and audit any package requiring install scripts; Prefer pinned, provenance-verified dependencies from internal registries/proxies and scan for typosquat package names

### [critical] PyPI: typosquatted packages 1h1 and aanthropic download and execute malware during install (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquatted-packages-1h1-and-aanthropic-download-and-execute-malware-during-install-no-cve · Supply chain · no-fix-needed · since 2026-10-22
Two typosquatted PyPI packages, 1h1 and aanthropic (version 1.0.0), were published to the GitHub Advisory Database on 2026-10-22 as part of the '2026-10-semvver' malware campaign. Both packages download and execute a remote executable during installation, with infostealer-style malicious intent (CWE-506). The same malware binary hash appears in both advisories' VirusTotal references. Anyone who pip-installed either package — likely developers mistyping 'anthropic' or similar names — has executed malware on their machine. There are no patched versions; the packages are simply malicious and should never be used. Removal from PyPI and advisory publication are the mitigations.
Do: Check pip logs, lockfiles, and CI history for any install of 1h1 or aanthropic 1.0.0 and treat any machine that installed them as compromised; Rebuild affected machines/CI runners from trusted images and rotate all credentials, tokens, and secrets accessible from them; Audit environments for the malware binary hash e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7; Pin dependencies and verify package names carefully to avoid typosquatting; use hash-pinned requirements; Enable PyPI/GitHub Dependabot malware alerts and block these package names in dependency firewalls

### [critical] npm: Four malicious packages (@sudobility/indexer_client, agentic-awesome-skills, opencode-skills-collection, @pkgship/frpc-darwin-amd64) flagged as malware with no patched versions
https://helix.ml/threat-watch/i/npm-four-malicious-packages-sudobility-indexer-client-agentic-awesome-skills-opencode-skills-collection-pkgship-frpc-dar · Supply chain · no-fix-needed · since 2026-10-22
On 2026-10-22 GitHub added four malware advisories (CWE-506, embedded malicious code) covering npm packages @sudobility/indexer_client 0.0.146, agentic-awesome-skills (versions 18.9.0–19.13.0, ~20 listed), opencode-skills-collection (4.0.56–4.1.20, ~21 listed), and @pkgship/frpc-darwin-amd64 0.71.1. All are rated critical with no patched versions; GitHub's standard wording warns any machine with the package installed or running should be considered fully compromised, with secrets and keys exposed to an outside entity. Anyone who installed or runs these packages is affected. No fixes exist; remediation is removal plus credential rotation and host forensics.
Do: Remove the packages from all projects and lockfiles and block these names/versions in your registry proxy or allowlist; Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild affected machines or containers from trusted images; treat hosts as potentially fully compromised; Audit CI/CD and developer workstations for installs of these packages and review logs for post-install execution or exfiltration

### [critical] @seggy116/next-diff: npm package contains malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/seggy116-next-diff-npm-package-contains-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-10-22
GitHub's advisory database published GHSA-fv2r-964m-pc2m on 2026-10-22 flagging version 0.3.0 of the npm package @seggy116/next-diff as malware (CWE-506, embedded malicious code). The advisory warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be rotated. No patched version exists and no known source code is available, so remediation is removal plus incident response rather than an upgrade. Anyone who installed the package is affected; exploitation is presumed wherever it was installed.
Do: Remove @seggy116/next-diff 0.3.0 from all systems and dependency trees; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit for persistence mechanisms and lateral movement from affected hosts; Block the package in dependency management and CI to prevent reinstalls

### [critical] @factiii/runner: npm package flagged as malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/factiii-runner-npm-package-flagged-as-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-10-22
GitHub's advisory database (GHSA-9j83-qj34-g5vc, published 2026-10-22) flags the npm package @factiii/runner version 0.28.0 as embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be treated as stolen. No patched version exists and no known source code is listed. Anyone who installed @factiii/runner 0.28.0 is affected. The only remediation is removal of the package plus credential rotation and host forensics, since removal cannot guarantee all malicious software is eliminated.
Do: Rotate all secrets, keys, and credentials stored on or accessible from machines where @factiii/runner 0.28.0 was installed, using a clean machine; Remove the package and rebuild/reimage affected hosts; do not trust removal alone; Audit install logs and CI/CD systems for use of @factiii/runner 0.28.0 and check for persistence or unauthorized access; Block the package in dependency management and lockfile policies; scan repositories for references

### [critical] Linux KSMBD: Two CVSS 9.0 pre-auth/transport RCE flaws disclosed publicly before kernel fixes available
https://helix.ml/threat-watch/i/linux-ksmbd-two-cvss-9-0-pre-auth-transport-rce-flaws-disclosed-publicly-before-kernel-fixes-available · Vulnerabilities · unpatched · since 2026-10-22
Trend Micro's Zero Day Initiative publicly disclosed two CVSS 9.0 remote code execution flaws in the Linux kernel's KSMBD SMB server before fixes exist in the mainline kernel. ZDI-CAN-33774 is a protocol-dispatch race exploitable without authentication by any client reaching port 445, with a buffer-write path available to share users. ZDI-CAN-33549 is an integer underflow in the SMB Direct path requiring an RDMA-capable interface, a writable share, and SMB Direct negotiation. Neither flaw has a CVE or confirmed mainline fix; a fix for ZDI-CAN-33549 may land in the next dev cycle. Any Linux server running KSMBD is affected; RHEL does not ship it by default. No in-the-wild exploitation is known. Fixes will take weeks to reach stable and distribution kernels.
Do: Check whether KSMBD is actually in use: 'systemctl status ksmbd' or 'lsmod | grep ksmbd'; Red Hat Enterprise Linux does not ship it by default; If ksmbd is not needed, disable the service and unload the module — that removes both flaws entirely; If you must keep ksmbd, firewall port 445 to known client networks and block SMB Direct/RDMA where it is not deliberate; Make shares read-only where possible: ZDI-CAN-33774 needs share access for its write primitive, and ZDI-CAN-33549 requires a writable share; Watch kernel stable and distribution errata; CVE identifiers will be assigned only when a stable fix exists, so searching for a CVE will miss it for now; Consider Samba for exposed file sharing until kernel fixes reach your distribution

### [medium] Azure AI Foundry: SSRF allows authorized attacker to elevate privileges over a network (CVE-2026-108456)
https://helix.ml/threat-watch/i/azure-ai-foundry-ssrf-allows-authorized-attacker-to-elevate-privileges-over-a-network-cve-2026-108456 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-108456
Microsoft's October 2026 security guidance (published 2026-10-22) discloses CVE-2026-108456, a server-side request forgery vulnerability in Azure AI Foundry. An attacker who is already authorized to interact with the service can abuse the SSRF to elevate privileges over a network, potentially gaining access beyond their intended permissions. No exploitation in the wild or public proof-of-concept is reported. Microsoft has released a security update via the MSRC Update Guide; customers using Azure AI Foundry should apply the update and review service permissions and network access controls.
Do: Apply the Microsoft security update for Azure AI Foundry via the MSRC Update Guide; Review and restrict authorized user roles and permissions on Azure AI Foundry instances; Audit network egress/access controls around AI Foundry resources for signs of SSRF abuse; Monitor Azure activity logs for anomalous privilege changes

### [high] Microsoft Exchange Online: stack-based buffer overflow allows authorized attackers to execute remote code (CVE-2026-96185)
https://helix.ml/threat-watch/i/microsoft-exchange-online-stack-based-buffer-overflow-allows-authorized-attackers-to-execute-remote-code-cve-2026-96185 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-96185
Microsoft disclosed CVE-2026-96185, a stack-based buffer overflow in Microsoft Exchange Online that permits an authorized attacker to execute arbitrary code over a network. Because Exchange Online is a cloud service, Microsoft has remediated the flaw on its side; no customer-side patch is required. The vulnerability requires the attacker to already hold authorized access, which limits exposure compared with unauthenticated RCE, but successful exploitation could yield code execution within the service context. No exploitation in the wild or public proof-of-concept has been reported. Organizations using Exchange Online should review their tenant for signs of compromise and ensure they are on current service builds.
Do: Review Microsoft 365 audit and sign-in logs for anomalous activity by authorized accounts, especially privileged or service accounts; Verify your tenant is on the current Exchange Online service build and confirm Microsoft's advisory status; Tighten authorization controls: enforce MFA, least privilege, and conditional access for accounts with Exchange Online access; Monitor Microsoft MSRC and Message Center for updates on exploitation status or further guidance

### [critical] Microsoft: VM Inspector for Azure Virtual Machines elevation of privilege via link following (CVE-2026-110063)
https://helix.ml/threat-watch/i/microsoft-vm-inspector-for-azure-virtual-machines-elevation-of-privilege-via-link-following-cve-2026-110063 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-110063
Microsoft published an advisory on 2026-10-22 for CVE-2026-110063, an improper link resolution before file access ('link following') flaw in VM Inspector for Azure Virtual Machines. The vulnerability allows an unauthorized attacker to elevate privileges over a network, meaning an attacker with network access to a VM using the VM Inspector component could gain higher privileges. Azure Virtual Machines customers using VM Inspector are affected. Microsoft's Security Update Guide lists the issue as remediated via a security update; no in-the-wild exploitation is reported in the source. Organizations running affected Azure VMs should apply the update promptly and review VM access controls.
Do: Apply Microsoft's October 2026 security update for VM Inspector on affected Azure virtual machines; Audit which VMs have VM Inspector enabled and prioritise internet-exposed and multi-tenant hosts; Review Azure RBAC assignments and VM network rules for privilege changes you cannot account for; Track the MSRC entry for this CVE for an exploitation-status update before treating the estate as remediated

### [critical] Azure Kubernetes Configuration Service: missing authentication allows unauthorized attackers to elevate privileges over a network (CVE-2026-83938)
https://helix.ml/threat-watch/i/azure-kubernetes-configuration-service-missing-authentication-allows-unauthorized-attackers-to-elevate-privileges-over-a · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-83938
Microsoft published CVE-2026-83938 on 22 October 2026, a missing-authentication flaw in the Azure Kubernetes Configuration Service that let an unauthenticated attacker elevate privileges over the network. It affects tenants using AKS configuration features, where a rider on the service can reach things it should not. Microsoft reports no exploitation and no public disclosure, and the fix is applied to the Azure service rather than to a component you upgrade, so the work is verification: confirm the update reached your tenants and look for signs that someone used the gap.
Do: Confirm the October 2026 fix has reached your tenants via Azure Service Health rather than a patch calendar; Review Azure Kubernetes Configuration Service access and audit logs for unauthorised privilege elevation; Audit AKS cluster role bindings and node pool configuration for changes you cannot account for; Restrict network exposure of AKS management and configuration endpoints to known administration ranges

### [critical] Microsoft Entra Application Proxy: elevation of privilege via improper authentication (CVE-2026-97785)
https://helix.ml/threat-watch/i/microsoft-entra-application-proxy-elevation-of-privilege-via-improper-authentication-cve-2026-97785 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-97785
Microsoft disclosed CVE-2026-97785, an improper-authentication flaw in Microsoft Entra Application Proxy, on 22 October 2026. An unauthenticated attacker could elevate privileges over the network against tenants that publish internal applications through Application Proxy, which is the common way to expose on-premises apps to remote users. Microsoft reports no exploitation and no public disclosure. The fix lands on the connector and service side rather than as a version you install in your own stack, so the practical work is confirming your connectors are current and reviewing what the proxy exposes.
Do: Confirm every Application Proxy connector group runs a current build (connectors auto-update by default; check any group where that was disabled); Review which applications are published through Application Proxy and remove any that no longer need external exposure; Read connector and sign-in logs for anomalous or unauthenticated access patterns against published apps; Keep the proxy on the shortest path to the identity controls you rely on: conditional access, MFA and least-privilege app roles

### [high] Azure Pipelines: command injection allows unauthorized remote code execution (CVE-2026-105014)
https://helix.ml/threat-watch/i/azure-pipelines-command-injection-allows-unauthorized-remote-code-execution-cve-2026-105014 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-105014
Microsoft disclosed CVE-2026-105014 on 22 October 2026: a command-injection flaw in Azure Pipelines that lets an unauthenticated attacker run code over the network, rated 9.1 with the full confidentiality and integrity impact of a build-system compromise. Microsoft reports no exploitation and no public disclosure, and fixes the service on its own side, so there is no version to pin or patch yourself. The consequence for defenders is downstream: a compromised pipeline can execute in your build agents, read your source, and use the service connections those pipelines hold. Treat any unexplained pipeline run, changed variable group or new service connection as worth investigating.
Do: No version to pin: Microsoft fixed this in the service. Confirm your tenant has received the October 2026 update through Azure Service Health rather than a patch calendar; Review Azure Pipelines run history and audit logs for runs, agent jobs or service-connection uses nobody authorised; Rotate pipeline service connections, PATs and deployment credentials if you find unexplained runs, then re-scope them to least privilege; Reduce the blast radius: keep production service connections behind approvals and separate from pipelines that build untrusted pull requests

### [high] Twisted: Three unauthenticated remote memory-exhaustion DoS vulnerabilities in words IRC, XMPP XML stream, and conch telnet parsers (CVE-2026-115776, CVE-2026-115775)
https://helix.ml/threat-watch/i/twisted-three-unauthenticated-remote-memory-exhaustion-dos-vulnerabilities-in-words-irc-xmpp-xml-stream-and-conch-telnet · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115775, CVE-2026-115776, CVE-2026-115778
On 2026-10-22/23 Twisted published three reviewed GitHub advisories for unauthenticated remote denial-of-service flaws fixed in 26.10.0rc1, all affecting versions <= 26.4.0. (1) CVE-2026-115776: the words IRC server's dataReceived buffers line-feed-free input with no length cap; 60 MB sent grew a test server from ~47 MB to ~2966 MB RSS, crashing the single-threaded process and dropping all users. (2) CVE-2026-115775: the xish domish XML element stream (used by XMPP servers) materialises an unbounded element tree when a peer never closes a container, parsed before authentication. (3) A third advisory covers the conch telnet transport, where an unclosed IAC SB subnegotiation grows a per-connection buffer without limit. All are CWE-770/CWE-400 allocation-without-limits issues requiring no credentials; no confidentiality, integrity, or code-execution impact. Fixes are in Twisted 26.10.0rc1.
Fixed: Twisted 26.10.0rc1
Do: Upgrade Twisted to 26.10.0rc1 or later wherever it is installed, prioritising hosts running twistd words (IRC/XMPP) or conch telnet services exposed to untrusted networks; If upgrading is not immediately possible, restrict network access to Twisted IRC/XMPP/telnet endpoints (firewall, VPN, or reverse proxy limits) and add connection/memory limits or rate limiting at the perimeter; Monitor Twisted-based services for abnormal memory growth and set process memory limits (e.g. ulimit, container limits) so a single connection cannot exhaust the host; Inventory dependent applications (8500+ dependent repos) for bundled or vendored Twisted and schedule their updates

### [high] gitoxide gix: untrusted .git/config can disable .git path-protection checks, enabling hook/config overwrite (GHSA-q54r-jf2p-rfr2)
https://helix.ml/threat-watch/i/gitoxide-gix-untrusted-git-config-can-disable-git-path-protection-checks-enabling-hook-config-overwrite-ghsa-q54r-jf2p-r · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-40034
The gix crate's Cache::protect_options() read core.protectHFS, core.protectNTFS and gitoxide.core.protectWindows with an unfiltered config accessor instead of the trust-aware boolean_filter() used elsewhere, so settings from an untrusted repository-local .git/config (Trust::Reduced, e.g. ownership mismatch on shared filesystems) were honored. An attacker controlling a repo's .git/config on a shared or CI filesystem can disable these protections; crafted tree entries (NTFS short names, alternate data streams, HFS+ ignorable code points) then resolve to .git on case-insensitive filesystems during checkout, index build, merge or tree edit, allowing overwrite of hooks/config and plausibly arbitrary command execution via hook execution. Affects gix 0.88.0–0.89.0; fixed in gix 0.90.0. No in-the-wild exploitation known; a PoC test is public.
Fixed: gix 0.90.0
Do: Upgrade gix to 0.90.0 or later and rebuild any tools or binaries that depend on the affected versions; Audit dependencies and lockfiles for gix 0.88.0–0.89.0 across Rust projects and CI images; Avoid opening untrusted repositories with gix-based tools on shared, network-mounted, or reused CI workspaces until patched; Treat checkouts from other users on multi-user hosts as untrusted; verify .git/hooks and .git/config integrity after opening shared repos

### [high] multer: DoS process crash via pending async fileFilter after request teardown (CVE-2026-113872)
https://helix.ml/threat-watch/i/multer-dos-process-crash-via-pending-async-filefilter-after-request-teardown-cve-2026-113872 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-113872
A high-severity denial-of-service vulnerability (CVE-2026-113872, GHSA-q7qp-rjg7-q26m) in multer 2.0.0–2.4.x lets a single unauthenticated request crash the Node.js process. When an asynchronous fileFilter is configured, aborting a request (e.g. one file rejected) while another file's async fileFilter is pending causes the callback to resume a parsing stream multer has already torn down; busboy then emits an error on a stream with no error listener, triggering an unhandled 'error' event and process exit. Any app using multer with an async fileFilter is affected regardless of storage engine; sync fileFilter usage is unaffected. Fixed in multer 2.5.0 (released Oct 22, 2026); workaround is using a synchronous fileFilter. No in-the-wild exploitation reported.
Fixed: multer 2.5.0
Do: Upgrade multer to 2.5.0 or later and redeploy; If upgrading is not immediately possible, switch to a synchronous fileFilter or remove async fileFilter usage; Add process-level monitoring/restarts (e.g. PM2, Kubernetes liveness probes) to limit DoS impact; Review upload endpoints for exposure to unauthenticated multipart requests

### [high] virtualenv: bash activator stores unescaped --prompt in PS1, enabling command execution on later prompt expansion (CVE-2026-115586)
https://helix.ml/threat-watch/i/virtualenv-bash-activator-stores-unescaped-prompt-in-ps1-enabling-command-execution-on-later-prompt-expansion-cve-2026-1 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115586
A regression in virtualenv 21.14.9 (introduced by the fix for GHSA-6w3r-xr62-4xcp) removed unconditional escaping of $ and backticks from the bash bin/activate script. When promptvars is off at activation time, the caller-supplied --prompt value is stored raw in PS1; since promptvars and posix mode are runtime shell state, re-enabling prompt expansion (shopt -s promptvars, set -o posix) or spawning an interactive child bash that inherits exported PS1 causes bash to expand the stored value and execute embedded command substitution. An attacker controlling the prompt value (e.g. via project metadata or tool config) gains command execution as the user sourcing bin/activate. Fixed in 21.14.13; 21.14.8 is not affected.
Fixed: virtualenv 21.14.13
Do: Upgrade virtualenv to 21.14.13 or later and recreate any virtual environments created with 21.14.9–21.14.12; Audit CI pipelines and tooling that pass --prompt sourced from project metadata or untrusted config; treat such prompts as attacker-controlled; Avoid sourcing bin/activate in shells where promptvars/posix mode may later be enabled, and unset/scrub exported PS1 in non-interactive contexts; Check whether any environments were activated in shells with prompt expansion re-enabled; investigate for signs of executed command substitution

### [high] toml (npm): Three high-severity CPU DoS vulnerabilities in toml.parse() allow event-loop blocking via crafted TOML documents (CVE-2026-114144, CVE-2026-114143)
https://helix.ml/threat-watch/i/toml-npm-three-high-severity-cpu-dos-vulnerabilities-in-toml-parse-allow-event-loop-blocking-via-crafted-toml-documents · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-114141, CVE-2026-114143, CVE-2026-114144
Three coordinated advisories published Oct 22, 2026 describe denial-of-service flaws in the toml npm package (<= 5.0.0), all fixed in 5.0.1. CVE-2026-114144: unbounded-length integer literals are passed to BigInt() before the 64-bit range check, so a ~5MB hex/decimal literal burns ~6s of CPU. CVE-2026-114143: quadratic O(n²) work in assign(), deepRef(), and setNestedKey() when recomputing dotted-key path prefixes; a ~100KB dotted key hangs for ~6.8s and ~200KB crashes the process with OOM. A third advisory describes quadratic rescans in addTableArray() for many [[name]] headers (~10.3s for a 321KB document). All paths synchronously block the Node.js event loop, stalling every request in the process. Any service parsing attacker-supplied TOML (config uploads, CI/CD, linters, editors) is exposed. Public PoCs exist; no in-the-wild exploitation reported. Fix: upgrade to toml 5.0.1.
Fixed: toml 5.0.1
Do: Upgrade toml to 5.0.1 or later immediately (npm audit / lockfile update); Audit dependencies for anything that calls toml.parse() on untrusted or third-party input (config upload endpoints, CI/CD pipelines, linters, editors/language servers); Until patched, add input-size limits and timeouts around TOML parsing, or run parsing in an isolated worker/child process so the main event loop is not blocked; Monitor for signs of DoS attempts: long CPU spikes correlated with TOML-parsing requests

### [high] Strands Agents SDK: A2A server leaks conversation history across tenants (CVE-2026-115419)
https://helix.ml/threat-watch/i/strands-agents-sdk-a2a-server-leaks-conversation-history-across-tenants-cve-2026-115419 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115419
The Agent2Agent (A2A) server in Strands Agents SDK failed to isolate conversation state between callers, sharing conversation history across callers with different context_id values. In multi-tenant deployments, an authenticated remote user could read another caller's conversation history or influence model behavior for other callers (CWE-488). Any deployment where an A2A server is reachable by more than one user or tenant is affected. No in-the-wild exploitation is known. Fixed versions use an agent factory so conversation state is isolated per A2A context_id; there is no full workaround other than running a separate A2A server instance per user or tenant.
Fixed: strands-agents 1.43.0; @strands-agents/sdk 1.5.0
Do: Upgrade strands-agents to 1.43.0 or later (Python) and @strands-agents/sdk to 1.5.0 or later (TypeScript); Until upgraded, do not expose an A2A server to more than one user or tenant; run a separate A2A server instance per user or tenant if multiple callers need access; Patch any forked or derivative code to incorporate the upstream fixes; Review logs for signs of cross-tenant conversation access in multi-tenant deployments

### [high] body-parser: single unauthenticated request crashes Node apps via trailing bytes after gzip body (CVE-2026-111181)
https://helix.ml/threat-watch/i/body-parser-single-unauthenticated-request-crashes-node-apps-via-trailing-bytes-after-gzip-body-cve-2026-111181 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-111181
A high-severity DoS vulnerability (CVE-2026-111181, GHSA-27r3-jxmh-p828) in the ubiquitous body-parser middleware lets any unauthenticated client crash a Node.js process with a single crafted request. When a request carries Content-Encoding (e.g. gzip), body-parser pipes it into a decompression stream and leaves it piped with no error listener after the body is read; a valid compressed frame followed by trailing bytes triggers an error on the finished decoder that is re-thrown as an uncaught exception, terminating the process. Parsing runs before routing, so no matching route or authentication is needed. Affects body-parser >=2.0.0,<2.4.0 and <1.20.9. Fixed in 2.4.0 and 1.20.9; no exploitation reported (EPSS 0.366%).
Fixed: body-parser 2.4.0; body-parser 1.20.9
Do: Upgrade body-parser to 2.4.0 (or 1.20.9 on the 1.x line) and redeploy affected services; As an interim mitigation, pass inflate: false to body-parser middleware where compressed request bodies are not needed; Audit Express/Node services for body-parser usage and add process-level crash recovery/restarts (e.g. health checks, auto-restart) as defense in depth; Monitor for crash loops or uncaught exceptions that could indicate probing

### [critical] Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)
https://helix.ml/threat-watch/i/pillow-multi-frame-image-loaders-reuse-stale-native-buffers-after-mode-transitions-enabling-oob-writes-and-rce-cve-2026 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-96639
Pillow multi-frame image loaders (PSD, MPO/JPEG, DCX, MIC) can retain native ImagingCore storage allocated for one frame while a later frame changes the image mode and decoder tiles. ImageFile.load_prepare() only reallocates storage when _im is None and does not verify the retained buffer matches the current mode/size, so a crafted file with frame 0 in a narrow mode (e.g. L) and frame 1 in a wider mode (RGB/CMYK) causes native out-of-bounds writes, crashes, and over-reads. The researcher demonstrated command execution via the documented ImageSequence.Iterator + frame.load() path, including a one-request unauthenticated web-upload exploit. All Pillow users processing untrusted images (web upload services especially) are affected. Fixed in Pillow 13.0.0, published 2026-10-22.
Fixed: 13.0.0
Do: Upgrade Pillow to 13.0.0 immediately, prioritising internet-facing services that process user-uploaded images; If upgrade is not immediate, restrict or sandbox image processing of untrusted uploads (e.g. isolate in containers/worker processes with limited privileges); Block or reject multi-frame MPO/PSD/DCX/MIC uploads at ingestion until patched; Audit image-processing pipelines for Pillow versions >= 11.0.0, < 13.0.0 and monitor for crash anomalies indicating exploitation attempts

### [critical] mem0ai: SQL injection in Databricks vector store lets attackers execute SQL via crafted memory content (CVE-2026-115324)
https://helix.ml/threat-watch/i/mem0ai-sql-injection-in-databricks-vector-store-lets-attackers-execute-sql-via-crafted-memory-content-cve-2026-115324 · Vulnerabilities · patched · since 2026-10-22 · CVE-2026-115324
A SQL injection vulnerability (CVE-2026-115324) was disclosed on 2026-10-22 in mem0ai's Databricks vector store (mem0/vector_stores/databricks.py). Versions 0.1.117 through before 1.0.8 pass attacker-influenced memory text, metadata, or message names into unescaped string interpolation in insert() and update() calls, allowing injection of arbitrary SQL against the configured Databricks SQL warehouse. Any application storing untrusted user content in mem0 memories backed by the Databricks vector store is affected, with high confidentiality, integrity, and availability impact. No in-the-wild exploitation is reported. Fixed in mem0ai 1.0.8 (commit a2ffca3), which escapes/parameterizes the affected queries.
Fixed: mem0ai 1.0.8
Do: Upgrade mem0ai to 1.0.8 or later immediately if you use the Databricks vector store; If upgrading is delayed, restrict or disable the Databricks vector store path and sanitize/validate memory text, metadata, and message names before storage; Review Databricks SQL warehouse logs for signs of injected or anomalous queries; Limit the SQL warehouse credentials used by mem0 to least privilege to contain potential injection impact; Audit any stored memories for suspicious content that may have been used as an injection vector

### [critical] Cisco: Snort 3 security hardening release fixes out-of-bounds write, incorrect calculation, privilege management and DoS flaws across multiple products (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356)
https://helix.ml/threat-watch/i/cisco-snort-3-security-hardening-release-fixes-out-of-bounds-write-incorrect-calculation-privilege-management-and-dos-fl · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-20011, CVE-2026-20043, CVE-2026-20218, CVE-2026-20221, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76445, CVE-2026-76524
Cisco's Snort 3 engineering team completed an internal security review and released hardening updates addressing multiple internally discovered vulnerabilities, grouped by CWE with one CVE per class: CVE-2026-20043 (out-of-bounds write, CWE-787), CVE-2026-20236 (incorrect calculation, CWE-682), CVE-2026-20291 (improper privilege management, CWE-269) and CVE-2026-20356 (uncontrolled resource consumption, CWE-400), with a maximum CVSS of 9.0. Affected products include Cisco Cloud-delivered Firewall, Cyber Vision, Meraki MX, Secure Access, Secure Firewall Threat Defense and UTD on IOS XE; Snort 2 is not affected. The flaws were found in internal testing and are not known to be exploited. Snort 3.12.4.0, Cyber Vision 5.6.0 and various FTD releases contain fixes; CDFW, CSA and Meraki instances were updated automatically on 2026-10-21. No workarounds exist.
Fixed: Snort 3.12.4.0; Cyber Vision 5.6.0; FTD 7.0.10 / 7.2.12 / 7.4.8 / 7.6.6 / 7.7.13 / 10.0.2 / 10.1.0
Do: Upgrade Open Source Snort 3 to 3.12.4.0 or later; Upgrade Cisco Cyber Vision to 5.6.0 (or migrate from older releases); Upgrade Cisco Secure FTD to the first fixed release for your train (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0); Update UTD on Cisco IOS XE per the advisory's fixed release table; Verify CDFW, CSA and Meraki MX devices are online so automatic Snort 3 package updates have applied

### [critical] x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)
https://helix.ml/threat-watch/i/x402-sdks-critical-flaws-let-malicious-apis-drain-ai-agents-token-balances-bypass-solana-payments-and-relay-login-signat · Vulnerabilities · patched · since 2026-10-22
Security firm V12 disclosed three critical flaws in the x402 payment SDKs used by AI agents to pay for API calls. The default client set no spending limit, letting a malicious API request an agent's full token balance; the TypeScript Solana facilitator accepted token approvals (moving no tokens) as valid payments, enabling complete payment bypass; and the SIWx sign-in client signed login messages without verifying the destination site, enabling relayed authentication. All three were fixed in August 18 releases (2.23.0+), which add $1-per-payment caps, stablecoin-only defaults, instruction-type checks, and domain verification. No attacks reported, but npm/PyPI audits give no warning to upgrade. Latest versions: 2.28.0 (TypeScript/Go), 2.25.0 (Python).
Fixed: @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios 2.28.0; Go v2.28.0; Python 2.25.0; minimum 2.23.0 for the three critical fixes
Do: Upgrade @x402/fetch, @x402/axios, @x402/extensions, @x402/svm to 2.23.0+ (latest 2.28.0); Python to 2.25.0; Go to v2.28.0; If unable to upgrade, register a payment policy (registerPolicy / register_policy max_amount) that drops payment options above a set amount; Do not pass spendControls: false; review any apps that disable spend controls; Verify SIWx login messages identify the site being contacted before signing; Audit agent wallets for unexpected balance drains or unauthorized approvals

### [high] pypdf: Crafted PDFs with repeated malformed cross-reference entries cause long runtimes / DoS (CVE-2026-115585)
https://helix.ml/threat-watch/i/pypdf-crafted-pdfs-with-repeated-malformed-cross-reference-entries-cause-long-runtimes-dos-cve-2026-115585 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-115585
A follow-up advisory (GHSA-jr96-gvgh-j3r4) for pypdf describes a denial-of-service flaw where an attacker can craft a PDF with cross-reference streams containing repeated malformed cross-reference entries, causing long runtimes when parsed. It is a follow-up to GHSA-55h5-xmcq-c37v, whose fix still reloaded the whole stream despite caching. All pypdf versions before 6.21.2 are affected; any service parsing untrusted PDFs with pypdf is exposed. No in-the-wild exploitation is reported. Fixed in pypdf 6.21.2 (commit 68a0e50, PR #4240); organisations unable to upgrade can apply the PR #4240 changes as a workaround.
Fixed: pypdf 6.21.2
Do: Upgrade pypdf to 6.21.2 or later wherever it parses untrusted PDFs; If immediate upgrade is not possible, apply the changes from upstream PR #4240; Audit dependencies and services that process user-supplied PDF files for exposure; Add timeouts/resource limits around PDF parsing to blunt DoS attempts

### [high] Cisco IOS XR (ASR 9000/9900 Series): crafted IPv4 packets can reset or shut down line card network processors, causing DoS (CVE-2026-76505)
https://helix.ml/threat-watch/i/cisco-ios-xr-asr-9000-9900-series-crafted-ipv4-packets-can-reset-or-shut-down-line-card-network-processors-causing-dos-c · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76505
Cisco published a High-severity advisory (CVE-2026-76505, CWE-20, CVSS 7.5) for a denial-of-service vulnerability in the IPv4 packet-processing path of IOS XR on ASR 9000 and 9900 Series routers with Lightspeed- or Lightspeed-Plus-based line cards, and on ASR 9902/9903 compact routers. An unauthenticated remote attacker can send crafted IPv4 packets processed as for-us traffic to trigger network processor resets; repeated resets can leave the NP in a persistent shutdown state requiring a line card reload. Transit IPv4 and IPv6 traffic do not trigger it; IPv6-only configurations are unaffected. Cisco has released fixed software; no workarounds exist, but an iACL dropping UDP port 1701 traffic destined to infrastructure addresses is a proven mitigation. No exploitation reported in the wild.
Do: Upgrade ASR 9000/9900, ASR 9902/9903 routers running vulnerable IOS XR releases to a fixed release from the advisory; Until patched, deploy an ingress iACL on edge/external interfaces denying UDP destination port 1701 to local router addresses while permitting transit traffic; Inventory affected devices with show platform and confirm Lightspeed/Lightspeed-Plus line cards and IPv4-enabled interfaces via show ipv4 vrf all interface brief; Check logs with show logging | include "NP.*reset" for signs of exploitation or prior NP resets; Restrict exposure of router infrastructure addresses at the network edge generally

### [high] Cisco Secure Client Secure Firewall Posture module: local privilege escalation via crafted IPC messages (CVE-2026-76462)
https://helix.ml/threat-watch/i/cisco-secure-client-secure-firewall-posture-module-local-privilege-escalation-via-crafted-ipc-messages-cve-2026-76462 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76462
Cisco published a High-rated advisory for a privilege escalation vulnerability (CVE-2026-76462, CWE-20) in the IPC channel of the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux. Insufficient validation of user-supplied input lets an authenticated local attacker send crafted IPC messages to a local socket and perform limited file writes with SYSTEM or root privileges; on macOS and Linux this can yield full root, which is why Cisco rated it High despite the 5.5 CVSS. No workarounds exist and no public exploitation is known. Fixed in Cisco Secure Client 5.1.20.333; earlier releases are vulnerable. Bug ID CSCwu48192.
Fixed: 5.1.20.333
Do: Upgrade Cisco Secure Client to 5.1.20.333 or later on all endpoints running the Secure Firewall Posture module; Prioritise macOS and Linux hosts, where exploitation yields full root privileges; Restrict local access to devices running the Posture module until patched; Check with Cisco TAC for fixed software if lacking a valid service contract

### [medium] Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96652)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96652 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96652
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. CISA added CVE-2026-96652 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 3, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)
https://helix.ml/threat-watch/i/cisco-unified-communications-products-october-2026-hardening-release-fixes-multiple-vulnerabilities-across-voice-collabo · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481, CVE-2026-76487
Cisco published a critical hardening release on 2026-10-21 addressing multiple internally discovered vulnerabilities across Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. Issues are grouped by CWE into eight CVEs (CVE-2026-76473 through CVE-2026-76481) covering injection (CWE-74, max 9.8), improper authentication (CWE-287, 9.8), XSS (9.3), input validation, SQL injection, access control (all 8.8), path traversal (7.8), and exceptional-condition handling (7.5). Vulnerabilities affect the products regardless of configuration, were found during internal testing including use of frontier AI models, and are not known to be exploited. No workarounds exist; fixed software is available — release 15SU5, while release 14 users must migrate to a fixed release.
Fixed: 15SU5 (Release 14: migrate to a fixed release)
Do: Upgrade Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, Emergency Responder, and Prime Collaboration Deployment to the first fixed releases (15SU5 for release 15; migrate off release 14); Prioritise internet-exposed Unified CM and Unity Connection instances given 9.8 unauthenticated network-attack vectors; Check for follow-up Cisco advisories detailing individual vulnerabilities and apply Snort rules 67356/67358 for detection; Since no workarounds exist, restrict network access to management interfaces until patching is complete

### [critical] Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)
https://helix.ml/threat-watch/i/cisco-expressway-series-unauthenticated-root-rce-via-static-credentials-plus-hardening-release-batch-cve-2026-76466 · Vulnerabilities · patched · since 2026-10-21 · CVE-2026-76435, CVE-2026-76466, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497
Cisco published advisories on 2026-10-21 for Cisco Expressway Series (Expressway-C/E). CVE-2026-76466 (CVSS 9.8, CWE-798) is a critical unauthenticated remote RCE: use of persistent cookies plus insufficient client-certificate validation in clustering lets an attacker with network access connect to the database service and invoke RPC commands to execute arbitrary OS commands as root. It affects devices running X15.5.3 or earlier when configured in a cluster; no workarounds exist. A companion hardening advisory (cisco-sa-exwy-hardening-FhcqBVcs, max CVSS 8.6) fixes eight internally discovered issues (CVE-2026-76490 through -76497) covering out-of-bounds write, reachable assertions, null derefs, code injection, link following, insecure temp files and permission flaws, found partly using frontier AI models. Neither is known to be exploited. Fixed in X15.5.20; X14 and earlier must migrate.
Fixed: X15.5.20
Do: Upgrade clustered Expressway-C/E devices to X15.5.20 or later immediately, prioritising internet-facing Expressway-E; Migrate devices on X14 or earlier to a fixed release; Restrict network access to the database service and clustering ports (firewall/ACL) as interim mitigation until patched; Audit cluster configurations and TLS Verify Mode settings; review logs for suspicious RPC connections to the database service; Apply the October 2026 hardening release fixes to all Expressway deployments regardless of clustering configuration

### [medium] Welsh ransomware breach: Ogi Networks & Data Cymru — weak passwords led to theft of 3,300 children's records (no CVE)
https://helix.ml/threat-watch/i/welsh-ransomware-breach-ogi-networks-data-cymru-weak-passwords-led-to-theft-of-3-300-children-s-records-no-cve · Breaches · no-fix-needed · since 2026-10-20
The UK Information Commissioner's Office reprimanded two Welsh organisations, Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru), after a ransomware attack resulted in the theft of personal data belonging to 3,300 individuals, the vast majority of whom were children. According to reporting by Alex Hickey, the incident stemmed from poor credential hygiene — accounts secured with passwords such as 'Password1' and 'Test 2' — which allowed hackers to gain access and deploy ransomware, exfiltrating children's personal data. The ICO issued reprimands rather than fines. No specific CVEs are involved; the root causes are weak passwords and inadequate access controls. Remediation centres on strong credential policies, MFA, and improved security governance at the affected organisations.
Do: Review and enforce strong password policies and ban weak/default credentials; Deploy multi-factor authentication across all accounts; Review ransomware defences: backups, segmentation, and exfiltration monitoring; Audit third-party and partner data-sharing arrangements for access controls; Ensure incident response and ICO breach-notification procedures are tested

### [medium] Parkview Health patient portal outage after suspected cyber incident
https://helix.ml/threat-watch/i/parkview-health-patient-portal-outage-after-suspected-cyber-incident · Breaches · no-fix-needed · since 2026-10-20
Parkview Health, an Indiana-based health system serving Indiana and Ohio, disabled its network on Monday, 2026-10-20, in response to suspicious activity consistent with a suspected cyber incident. The shutdown left patients without access to the MyChart patient portal and online doctor search, with urgent medical needs redirected to phone calls or walk-in clinics. Sources do not confirm data exfiltration, ransomware, or a specific attacker, and no CVE applies. Affected patients should use phone or in-person channels for urgent care. Organizations should treat this as an operational disruption event; monitoring for follow-up breach notifications is warranted until Parkview confirms the scope and whether patient data was accessed.
Do: If you are a Parkview patient, use phone or walk-in clinics for urgent needs and monitor official channels for updates; Watch for follow-up breach notifications before assuming data was or was not exposed; Healthcare peers should review network segmentation and incident-response plans for rapid network isolation

### [medium] Frontier Communications: $625,000 Connecticut settlement over April 2024 RansomHub ransomware data breach
https://helix.ml/threat-watch/i/frontier-communications-625-000-connecticut-settlement-over-april-2024-ransomhub-ransomware-data-breach · Breaches · no-fix-needed · since 2026-10-20
Connecticut Attorney General William Tong announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach. The breach was carried out by the RansomHub ransomware group and compromised sensitive personal information of Frontier customers. The settlement follows Tong's broader pattern of litigating data breaches affecting Connecticut residents. No new exploitation is reported; this is a legal/regulatory resolution of a previously disclosed 2024 incident. No vendor patch applies; remediation is contractual and regulatory in nature.
Do: Review state breach-notification obligations and settlement terms for compliance lessons; Harden against RansomHub-style ransomware: patch edge devices, enforce MFA, segment networks; Maintain tested offline backups and incident-response plans; Monitor for stolen customer data reuse; support affected customers with credit monitoring where applicable

### [critical] Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)
https://helix.ml/threat-watch/i/fortinet-fortisiem-public-poc-exploit-released-for-unauthenticated-rce-via-path-traversal-and-nul-byte-file-overwrite-cv · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-106173
Researchers at Horizon3.ai published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM allowing unauthenticated remote code execution. The gRPC QueryResultReq handler on TCP port 27918 processes a user-supplied 'query-id' without validation, letting attackers traverse directories and embed a NUL byte to truncate the appended filename and overwrite arbitrary files. The PoC overwrites /opt/charting/redishb.sh, a Redis health-check script run by cron every 60 seconds, converting the arbitrary-file-write into code execution. Fortinet patched the flaw last week: FortiSIEM 7.5.0 users must upgrade to 7.5.1 or above; 7.6 is not affected. With a public PoC available, organisations running affected versions face imminent exploitation risk.
Fixed: FortiSIEM 7.5.1 or above (7.6 not affected)
Do: Upgrade FortiSIEM 7.5.0 to 7.5.1 or above immediately; Restrict network access to TCP port 27918 (gRPC service) from untrusted networks; Check /opt/charting/redishb.sh and similar cron-run scripts for tampering; Hunt for signs of exploitation, including unexpected writes or cron-executed script modifications; Monitor Fortinet advisories for additional affected branches

### [high] Happy DOM: unsanitized ESM import alias enables host code execution (CVE-2026-115895)
https://helix.ml/threat-watch/i/happy-dom-unsanitized-esm-import-alias-enables-host-code-execution-cve-2026-115895 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-115895, CVE-2026-33943
Happy DOM's ESM compiler fails to validate import binding aliases before interpolating them into generated JavaScript, an incomplete fix for CVE-2026-33943. An invalid import alias is transformed into a valid destructuring default initializer that executes, letting attacker-controlled HTML or module source escape the sandbox and reach Node.js host APIs (e.g., node:fs) to execute arbitrary code. Confirmed affected in v17.0.0 through v21.0.3; v16.8.1 is not affected. Exploitation requires enableJavaScriptEvaluation: true and attacker-controlled HTML/module input, affecting SSR, preview, scraping, and testing services. Fixed in happy-dom 21.0.4. A public PoC exists; no in-the-wild exploitation known.
Fixed: happy-dom 21.0.4
Do: Upgrade happy-dom to 21.0.4 or later immediately; If upgrade is not possible, disable enableJavaScriptEvaluation or ensure it never processes attacker-controlled HTML/module source; Audit SSR, preview, scraping, and testing services that evaluate untrusted HTML with happy-dom for exposure; Check hosts for artifacts such as a HAPPY_DOM_RCE_PROOF directory or unexpected process/node:fs access; Review dependent repositories and CI pipelines that render untrusted content via happy-dom

### [high] Atlassian: October bulletin patches 75 third-party CVEs across Data Center and Server products (multiple CVEs incl. CVE-2026-65637, CVE-2026-65182, CVE-2026-68525, CVE-2026-58062, CVE-2026-75595, CVE-2026-77185)
https://helix.ml/threat-watch/i/atlassian-october-bulletin-patches-75-third-party-cves-across-data-center-and-server-products-multiple-cves-incl-cve-202 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-21589, CVE-2026-58062, CVE-2026-65182, CVE-2026-65637, CVE-2026-65905, CVE-2026-68525, CVE-2026-75595, CVE-2026-77185
Atlassian's October 2026 security bulletin lists 176 vulnerability entries (162 high, 14 critical), covering 75 unique CVEs, all in third-party dependencies such as Apache Tomcat, Bouncy Castle, Netty, Apache SSHD, Jackson, Axios, Spring, Struts and ActiveMQ. Affected products include Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. Critical unique CVEs include Tomcat issues CVE-2026-65637, CVE-2026-65182 and CVE-2026-68525, Bouncy Castle CVE-2026-58062, Netty CVE-2026-75595 and Apache SSHD CVE-2026-77185; Atlassian assesses its use of these components as lower, non-critical risk. Flaw types include DoS, crypto weaknesses, auth issues, SSRF, information disclosure and code execution. No exploitation is reported. Fixes are available in the latest or bulletin-listed releases; a separate critical Tomcat flaw CVE-2026-65905 appears on the disclosure portal.
Fixed: Latest product versions or fixed releases listed in the October 2026 bulletin
Do: Update all affected Atlassian Data Center/Server products to the latest versions or the fixed releases listed in the October 2026 bulletin, prioritising internet-facing Confluence, Jira and Crowd instances; Check the Atlassian vulnerability disclosure portal for CVE-2026-65905 (critical Apache Tomcat flaw in Data Center and Crowd) and ensure the corresponding fix is applied; Inventory which third-party components (Tomcat, Netty, Bouncy Castle, SSHD, Struts, ActiveMQ) your instances expose and review exposure to DoS, SSRF and code execution flaws; Monitor Atlassian advisories and threat intel, as attackers have rapidly exploited Atlassian flaws in the past (e.g. CVE-2026-21589)

### [high] EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CVE-2026-106931)
https://helix.ml/threat-watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-106931
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 23, 2026 (BOD 22-01); treat that as the outer limit.

### [high] Plex Media Server External Control of File Name or Path Vulnerability (CVE-2026-96656)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96656 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96656
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. CISA added CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 23, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-96655)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96655 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96655
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. CISA added CVE-2026-96655 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 3, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CVE-2026-96654)
https://helix.ml/threat-watch/i/plex-media-server-cve-2026-96654 · Vulnerabilities · unknown · since 2026-10-20 · CVE-2026-96654
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. CISA added CVE-2026-96654 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 23, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Siemens Software Center Uncontrolled Search Path Element Vulnerability (CVE-2026-110936)
https://helix.ml/threat-watch/i/siemens-software-center-cve-2026-110936 · Vulnerabilities · patched · since 2026-10-20 · CVE-2026-110936
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. CISA added CVE-2026-110936 to its Known Exploited Vulnerabilities catalog on Oct 20, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Nov 3, 2026 (BOD 22-01); treat that as the outer limit.

### [critical] Apache Traffic Server: 15 vulnerabilities fixed including critical magick plugin command injection and request smuggling flaws (CVE-2026-111813 et al.)
https://helix.ml/threat-watch/i/apache-traffic-server-15-vulnerabilities-fixed-including-critical-magick-plugin-command-injection-and-request-smuggling · Vulnerabilities · patched · since 2026-10-20 · CVE-2025-31699, CVE-2025-55702, CVE-2026-111804, CVE-2026-111805, CVE-2026-111808, CVE-2026-111813, CVE-2026-111816
The Apache Software Foundation announced fixes for 15 vulnerabilities in Apache Traffic Server, addressed in versions 9.2.16, 10.1.5 and 10.2.1. The most severe (CVE-2026-111813, CVSS 10.0) lets an unauthenticated client control ImageMagick convert arguments via the experimental magick plugin's default configuration. Other issues include a wasm plugin use-after-free and unvalidated metric IDs (CVE-2026-111804), request smuggling via reused origin connections owed a request body (CVE-2025-31699) and unread Expect: 100-continue bodies (CVE-2025-55702), cache poisoning via a malformed 302 bypassing parse-error rejection (CVE-2026-111816), and HTTP/2-triggered origin worker-pool exhaustion (CVE-2026-111805, CVE-2026-111808). All ATS versions 9.0.0 through 10.2.0 are affected; no in-the-wild exploitation is reported. Fixes are available in the new releases.
Fixed: 9.2.16; 10.1.5; 10.2.1
Do: Upgrade to ATS 9.2.16, 10.1.5 or 10.2.1 immediately, prioritising internet-facing deployments; Disable or remove the experimental magick and wasm plugins if not strictly needed, especially on unpatched instances; Review access controls and front-end proxy connection sharing given the request smuggling and cache poisoning flaws; Monitor for signs of cache poisoning or request desync in logs after upgrading

### [critical] Laravel: TokenGuard authentication bypass via non-string API credentials allows account takeover (CVE-2026-114509)
https://helix.ml/threat-watch/i/laravel-tokenguard-authentication-bypass-via-non-string-api-credentials-allows-account-takeover-cve-2026-114509 · Vulnerabilities · patched · since 2026-10-19 · CVE-2026-114509
A critical authentication bypass (CVE-2026-114509, CVSS 9.2) was disclosed in Laravel's built-in TokenGuard. When a standard token-based API guard is configured, an unauthenticated attacker can submit a specially crafted non-string credential value that is mishandled during the authentication lookup; under certain MySQL/MariaDB database configurations the query matches an unintended user record, letting the attacker authenticate as an arbitrary existing user without knowing their API token. Any route protected by the affected guard is exposed to account takeover. Fixes were released in laravel/framework 12.68.0 and 13.29.0 on 2026-10-19/23; no in-the-wild exploitation is known.
Fixed: laravel/framework 13.29.0; laravel/framework 12.68.0
Do: Upgrade laravel/framework to 12.68.0 (Laravel 12) or 13.29.0 (Laravel 13) immediately; Audit applications for use of token-based API guards and treat those routes as exposed until patched; Review auth logs for anomalous API token authentication or unexpected user sessions; If immediate upgrade is not possible, add middleware or validation rejecting non-string API token credentials; Verify database configuration (MySQL/MariaDB collation/type coercion behaviour) and consider hardening token column comparisons

### [critical] OpenCode: Malicious MCP servers can execute PowerShell commands during OAuth sign-in on Windows/WSL (no CVE assigned)
https://helix.ml/threat-watch/i/opencode-malicious-mcp-servers-can-execute-powershell-commands-during-oauth-sign-in-on-windows-wsl-no-cve-assigned · Vulnerabilities · patched · since 2026-10-19 · CVE-2025-6514
A command-injection flaw in OpenCode's browser-launch helper let a malicious or later-hijacked remote MCP server supply an OAuth authorization endpoint that was passed unescaped into a PowerShell command, executing attacker code with the developer's privileges when the developer ran 'opencode mcp auth' on Windows or WSL. macOS and Linux are unaffected. Pillar Security disclosed it on October 19 after private reporting on August 29; Anomaly fixed it in 1.18.33 (September 28) as an unannounced refactor, declined a CVE on the grounds that user-configured MCP servers are outside its trust model, so scanners won't flag vulnerable builds. The underlying 'open' npm package fixed similar behavior in v11 in 2023. No in-the-wild exploitation reported. Separate from the OpenCode Console breach that may have exposed API keys.
Fixed: 1.18.33
Do: Upgrade OpenCode to 1.18.33 or later on all Windows and WSL machines; Run 'opencode mcp list' and remove any unvetted remote MCP servers from configuration; Audit remaining MCP servers for trustworthiness, including domains that could change hands; Check OpenCode versions directly since no CVE exists for scanner detection; Rotate API keys if potentially exposed via the related OpenCode Console breach

### [high] OpenCode distillation attack breach — OpenCode Console users with linked AI providers had credentials exposed; attacker can run inference on victim accounts (no CVE)
https://helix.ml/threat-watch/i/opencode-distillation-attack-breach-opencode-console-users-with-linked-ai-providers-had-credentials-exposed-attacker-can · Breaches · no-fix-needed · since 2026-10-18
On 2026-10-18 OpenCode disclosed a security breach tied to a large-scale 'distillation attack' affecting 1.4% of OpenCode Console users who had external AI providers (Anthropic, OpenAI, Google) linked to their accounts. OpenCode says it emailed every impacted user the morning of October 18; users who received no email were not impacted. The incident is ongoing and the vendor has not published a root cause or said what data was accessed. Linked provider credentials are stored locally at ~/.local/share/opencode/auth.json (or the Windows equivalent); if exposed, attackers can run inference against the victim's provider account, causing unexpected spend and potential access to data the keys can reach. No affected CLI versions were identified — impact is scoped to Console accounts with linked providers, not CLI installs. Remediation centers on rotating linked API keys and reviewing provider usage dashboards.
Do: Check whether your organisation received OpenCode breach notification emails; per the vendor, no email means not impacted; Find machines running OpenCode (check which opencode, ~/.opencode/bin, ~/.config/opencode, ~/.local/share/opencode/auth.json, or scan with StepSecurity Dev Machine Guard); Inspect auth.json to identify linked Anthropic, OpenAI, or Google providers; Rotate any Anthropic, OpenAI, or Google API keys linked to OpenCode or OpenCode Console; Review provider usage dashboards for unauthorised inference requests and unexpected spend; Maintain an inventory of AI coding agents and linked credentials across developer machines

### [high] postal-mime: Quadratic CPU DoS when decoding headers with many joinable RFC 2047 base64 encoded words (no CVE)
https://helix.ml/threat-watch/i/postal-mime-quadratic-cpu-dos-when-decoding-headers-with-many-joinable-rfc-2047-base64-encoded-words-no-cve · Vulnerabilities · patched · since 2026-10-18
postal-mime versions 3.0.0 through 4.0.7 suffer from a quadratic CPU consumption flaw (CWE-400/CWE-407) when decoding headers containing long runs of joinable RFC 2047 base64 encoded words, e.g. repeated =?utf-8?B?...?= tokens in Subject, From, To, filenames or descriptions. The join check ran a regex over the accumulated text for every word, so a single well-formed ~1.6 MB message could block the event loop for 1–20 seconds, and inline message/rfc822 parts multiplied the cost via per-message header budgets. Any application parsing untrusted mail with affected versions, including the exported decodeWords() helper, is exposed; no confidentiality or integrity impact. Fixed in 4.0.8 with linear-time decoding, plus stricter limits on nested message parts and header sizes. No exploitation known.
Fixed: postal-mime 4.0.8
Do: Upgrade postal-mime to 4.0.8 or later; Until upgraded, lower maxHeadersSize from the 2 MiB default to bound per-message cost; Parse untrusted mail in a terminable worker process to contain event-loop blocking; Audit mail-parsing paths, including use of the exported decodeWords() helper, for exposure to untrusted input

### [high] Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)
https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8 · Supply chain · partial · since 2026-10-17
Pillow wheels from 11.1.0 through 12.3.0 bundle a libopenjp2 (2.5.3/2.5.4) containing a heap-buffer-overflow write in opj_j2k_read_sod (OSV-2025-219), introduced in OpenJPEG in June 2024 — notably, older OpenJPEG 2.5.2 is safe. The flaw is reachable from Image.open(fp); im.load() with default settings, and because the wheel bundles its own copy, patched host OS libraries do not help. A public ASan PoC demonstrates the overflow through Pillow's own decoder. Attackers can craft a JPEG 2000 codestream that triggers memory corruption even when uploaded as avatar.png with image/png Content-Type, since Image.open() sniffs magic bytes. Fixed in Pillow 13.0.0; the upstream OpenJPEG fix (91d08b11, Feb 2026) remains unreleased. No in-the-wild exploitation reported.
Fixed: pillow 13.0.0
Do: Upgrade Pillow to 13.0.0 (or pin to <=11.0.0 if downgrade is feasible); Until upgraded, pass an explicit formats= list excluding JPEG2000 to Image.open() and validate on the detected format, not client Content-Type or filename; Reject or sandbox untrusted image uploads; consider blocking JPEG 2000 magic bytes (JP2/j2k codestreams) at the application layer; Audit image-processing services for reliance on filename/Content-Type allowlists that Image.open() bypasses; Monitor for an OpenJPEG release carrying 91d08b11 and rebuild any vendored/bundled OpenJPEG accordingly

### [high] Rank Math SEO PRO 3.0.123: malware distributed in some downloads via compromised update channel (Oct 15–16, 2026)
https://helix.ml/threat-watch/i/rank-math-seo-pro-3-0-123-malware-distributed-in-some-downloads-via-compromised-update-channel-oct-15-16-2026 · Supply chain · no-fix-needed · since 2026-10-17
Rank Math disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. The affected version was downloaded or installed via update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, meaning sites that updated during this window may be running a trojanized build of the popular WordPress SEO plugin. Wordfence published a PSA amplifying the disclosure. Rank Math has since addressed the issue, so users outside the window are unaffected; those who installed 3.0.123 during the window should treat their site as potentially compromised. No CVE has been assigned; details of the malware's capabilities have not been fully disclosed in the source.
Do: Check if Rank Math SEO PRO 3.0.123 was installed or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; If so, update to the latest clean version immediately and scan the site for malware and backdoors; Rotate WordPress admin credentials, API keys, and any secrets accessible from the site; Review site integrity: unknown admin users, modified core/plugin files, scheduled tasks, and outbound connections; Check logs for suspicious activity since the update and consider professional incident response if compromise is suspected

### [medium] BCHP / XTIUM 2024 healthcare data breach — $2.7M NY/CT settlement
https://helix.ml/threat-watch/i/bchp-xtium-2024-healthcare-data-breach-2-7m-ny-ct-settlement · Breaches · no-fix-needed · since 2026-10-17
New York AG Letitia James and Connecticut AG William Tong secured $2.7 million from Boston Children's Health Physicians (BCHP) and its IT vendor XTIUM over a 2024 data breach. Notably, both the healthcare provider and its IT services company were held liable, underscoring that organizations remain accountable for their vendors' security failures. The settlement includes a corrective action plan requiring improved data security practices. Affected individuals are BCHP patients whose data was exposed in the breach; the sources do not specify the number of affected individuals or the exact data types. No new exploitation is reported; the incident is now resolved via settlement and mandated remediation.
Do: Review vendor and business-associate agreements to ensure security obligations and breach liability are explicit; Assess third-party IT providers' security posture and incident response capabilities; Review state AG enforcement trends on vendor liability in breach settlements; Ensure breach notification and patient communication procedures meet NY/CT requirements; Implement or verify a corrective action plan covering data security controls

### [high] Pillow: decompression bomb check bypass in SpiderImagePlugin.seek() enables multi-GB allocation DoS (CVE-2026-96637)
https://helix.ml/threat-watch/i/pillow-decompression-bomb-check-bypass-in-spiderimageplugin-seek-enables-multi-gb-allocation-dos-cve-2026-96637 · Vulnerabilities · patched · since 2026-10-17 · CVE-2026-96637
Pillow's SpiderImagePlugin.seek() bypasses the decompression bomb check: seek() calls _open() directly, which re-parses an attacker-controlled SPIDER header and reassigns image size without any bounds validation, so ImageFile.load_prepare() allocates memory at an unchecked size. A crafted SPIDER stack file under 1KB can cause ~6.4GB allocation (mode F, e.g. 40000x40000) on im.load(), enabling denial of service. Sibling multi-frame plugins (GIF, TIFF, ICNS, ICO) do re-check on alternate paths; SpiderImagePlugin did not. All versions before 13.0.0 are affected. Fixed in Pillow 13.0.0 (commit 7cb0e02). A public PoC exists; no in-the-wild exploitation reported. Credit: Yazan Balawneh, CyStack Security Team.
Fixed: pillow 13.0.0
Do: Upgrade pillow to 13.0.0 or later wherever it is installed, especially in services that process untrusted image uploads; Until upgraded, restrict or reject SPIDER-format images (.stk/.hdr) from untrusted sources, or run image processing with memory limits (ulimit, container memory caps); Audit dependency manifests and lockfiles for pillow < 13.0.0 and rebuild/redeploy affected images; Monitor for memory-exhaustion/OOM events in image-processing workloads

### [high] filelock: local attacker can plant symlinks/journal files to overwrite or unlink lock user's files via SQLite-backed ReadWriteLock (CVE-2026-112940)
https://helix.ml/threat-watch/i/filelock-local-attacker-can-plant-symlinks-journal-files-to-overwrite-or-unlink-lock-user-s-files-via-sqlite-backed-read · Vulnerabilities · patched · since 2026-10-17 · CVE-2026-112940
The filelock library's SQLite-backed ReadWriteLock and AsyncReadWriteLock pass SQLite a path they do not control: on Linux the lock validates its database via a descriptor and connects through /proc/self/fd/<n>, which SQLite reopens by name, following symlinks, and on POSIX it also acts on -journal, -wal and -shm side files. A different local user who can create or rename entries in the lock database's directory (a 0777 or group-writable directory without the sticky bit) can make the lock user's read_lock()/write_lock() write attacker-chosen bytes into the lock user's files, create or unlink files, admit a reader beside a writer, or kill the holder; in sticky directories a planted -wal file makes every acquire fail. Affected versions 3.20.4–4.2.0; fixed in 4.2.1. No in-the-wild exploitation reported.
Fixed: filelock 4.2.1
Do: Upgrade filelock to 4.2.1 or later wherever ReadWriteLock/AsyncReadWriteLock is used; Audit where lock databases are placed; avoid 0777 or group-writable directories without the sticky bit; Verify kernel hardening: fs.protected_regular=1/2 and fs.protected_hardlinks=1 on hosts running multi-user workloads; Check downstream dependencies (filelock has ~58K dependent repos, e.g. tox, virtualenv tooling) for updated requirements

### [high] Pillow: four high-severity DoS/memory-safety flaws in PDF append, TarIO, PNG eXIf, and WMF/EMF rendering (CVE-2026-96640, CVE-2026-96642)
https://helix.ml/threat-watch/i/pillow-four-high-severity-dos-memory-safety-flaws-in-pdf-append-tario-png-exif-and-wmf-emf-rendering-cve-2026-96640-cve · Vulnerabilities · patched · since 2026-10-17 · CVE-2026-96640, CVE-2026-96642, CVE-2026-96643, CVE-2026-96644, CVE-2026-96778
Four high-severity advisories were published for Pillow on 2026-10-17/22, all fixed in 13.0.0. CVE-2026-96640: a malformed PDF /Pages tree with repeated child references makes PdfParser.linearize_page_tree() expand duplicates exponentially, causing CPU resource exhaustion via Image.save(..., append=True) with attacker-supplied PDFs (affects >=5.1.0). CVE-2026-96642: TarIO.TarIO() spins forever at 100% CPU on a crafted tar header with a negative size field. A third flaw makes EXIF parsing quadratic via repeated markers in PNG eXIf chunks (affects >=11.0.0). A fourth, Windows-only, heap over-read in WMF/EMF rendering stems from 16-bit dimension truncation in display.c. All are denial-of-service or memory-safety issues reachable with small crafted files; no exploitation reported. Upgrade to Pillow 13.0.0.
Fixed: Pillow 13.0.0
Do: Upgrade Pillow to 13.0.0 across all environments and rebuild/redeploy dependent images; Audit services that accept untrusted PDFs and use Pillow's PDF append path; restrict or sandbox until patched; Identify apps calling PIL.TarIO.TarIO() directly on untrusted archives and remove or gate that path; On Windows hosts, avoid processing untrusted WMF/EMF files with Pillow until upgraded; Add or verify dependency-scanning rules for these CVEs in CI and pin >=13.0.0

### [medium] State Bank of India: 3,897 customer records with personal data found on dark web in ~375,000-record leak
https://helix.ml/threat-watch/i/state-bank-of-india-3-897-customer-records-with-personal-data-found-on-dark-web-in-375-000-record-leak · Breaches · no-fix-needed · since 2026-10-16
State Bank of India confirmed in an October 21 stock-exchange filing that 3,897 customer records containing personal data were identified within a set of about 375,000 records offered on the dark web by a threat actor named Siriusim on BreachForums. Exposed fields reportedly include names, mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, and loan/lead metadata; account numbers, balances, passwords, OTPs, card details, PAN and Aadhaar are not listed. The alert came October 16 via CERT-In and the Defense Cyber Agency; an independent CERT-In-panel firm is investigating. The bank has not confirmed data authenticity, the source, whether SBI systems were breached, or customer notification. Main risk is impersonation/social-engineering against affected customers.
Do: Treat exposed fields (name, DOB, phone, address, CIF ID) as usable for convincing phishing and vishing; brief fraud and support teams on SBI-themed impersonation attempts; If you are an SBI customer or partner, be suspicious of unsolicited calls/messages citing your personal details or loan applications; verify via official channels and report to 1930 or report.phishing@sbi.co.in; Monitor for further disclosures on scope, authenticity, and affected customers; review third-party/loan-processing data handlers as a possible source; Harden KYC and loan-application data handling and vendor access controls at financial organisations handling similar data

### [high] Lightning AI: unauthorized access to credentials forced the Studio platform offline
https://helix.ml/threat-watch/i/lightning-ai-platform-credential-access-incident · Breaches · partial · since 2026-10-15
On 15 October 2026 at 23:00 UTC Lightning AI detected unauthorized access to credentials on the Lightning Platform, and at 01:00 UTC on 16 October revoked all user access to contain it. The incident affects the Studio-side services — Studio, Deployments, Pipelines and Drive — and not the GPU cluster rental infrastructure or managed Kubernetes and SLURM offerings. The company says customer credentials were abused to reach customer environments and third-party services connected to them; every credential it identified as used in the attack has been revoked, and keys tied to customer cloud accounts used on the platform were invalidated. The platform stayed inaccessible to all users while an external incident-response firm assisted, and potentially affected customers were notified with account-specific detail. The root cause, the number of affected accounts and what data was taken were not disclosed as of publication.
Do: If you used Lightning Studio, rotate every secret, API key and token stored in your Studios — GitHub credentials, cloud provider keys, model-provider keys, database passwords — from a machine outside the platform; Rotate credentials for any third-party service your Lightning virtual machines could reach, then review that service's access logs for the incident window starting 15 October, 23:00 UTC; Check your cloud providers for keys issued to or used from Lightning, disable them if the platform has not already, and audit billing and API activity for unusual calls; Treat anything the compromised environments could read or exfiltrate as exposed, including source code, datasets and internal network access; Watch for follow-on phishing and lateral attempts that use information taken from the platform

### [medium] n8n creators portal: templates still in review were readable without logging in
https://helix.ml/threat-watch/i/n8n-creators-template-library-unpublished-templates-readable-without-login · Breaches · patched · since 2026-10-16
On 16 October 2026 a creator reported that one of their unpublished n8n workflow templates had appeared on a third-party website. n8n found that parts of creators.n8n.io served templates still in review to anyone, without a login, and believes a third party used that to copy templates and list them elsewhere. n8n says the gap is closed and that it is reviewing the rest of the site for similar issues. Exposed for each template in review: its name and description, the submitter's creators.n8n.io username and the full workflow including node settings and any text the creator added; paid templates were exposed only as the settings-and-notes-stripped preview. n8n states that email addresses, passwords and account details were not exposed and that no one could edit or delete templates, and that exposed copies had already passed its automatic credential and personal-data removal, which it warns is imperfect. Creators are told to treat every template they submitted for review as public and that n8n does not retain original submissions, so a creator cannot check what was in the exposed copy. We are listing this as a supply-chain-adjacent exposure: a workflow template carries the embedded credentials, API keys and webhook URLs of whoever built it.
Do: Treat every template you submitted to creators.n8n.io for review as public: revoke or rotate any API key or credential that appears in a template you submitted, including ones removed by n8n's automatic scrub, since it is not guaranteed complete; Replace webhook URLs that could trigger your workflows, and consider disabling or rotating credentials tied to triggers you do not recognise traffic from; Ask third-party template aggregators to remove n8n templates copied from creators.n8n.io, and search for your workflow names outside n8n; If a template carried another person's personal data, contact n8n (help@n8n.io) so they can help with next steps; Audit n8n instance logs for executions triggered by unexpected webhooks or credentials that should no longer exist; Anyone running n8n at work should check whether creators submitted templates on the company's behalf and rotate those credentials

### [high] @azure/msal-node: authorization code flow may disclose auth parameters to attacker-controlled endpoint (CVE-2026-109461)
https://helix.ml/threat-watch/i/azure-msal-node-authorization-code-flow-may-disclose-auth-parameters-to-attacker-controlled-endpoint-cve-2026-109461 · Vulnerabilities · patched · since 2026-10-16 · CVE-2026-109461
Microsoft patched an origin validation error (CWE-346) in MSAL for Node.js, disclosed publicly on 2026-10-16 and reviewed 2026-10-23. In the authorization code flow, an unauthorized attacker can cause sensitive parameters to be disclosed to an attacker-controlled endpoint over a network, with high confidentiality impact and no integrity or availability impact. All versions from 5.0.0-beta.0 through before 7.1.0 are affected. No in-the-wild exploitation is known (EPSS 0.348%, 27th percentile). Version 7.1.0 contains the fix; as a workaround, applications should pass only the auth_code to acquireTokenByCode. Given the library's wide use (84.8M monthly downloads, ~8,050 dependent repos), Node.js apps using MSAL auth code flow should upgrade promptly.
Fixed: @azure/msal-node 7.1.0
Do: Upgrade @azure/msal-node to 7.1.0 or later; Until upgraded, ensure acquireTokenByCode is called with only the auth_code and no other sensitive parameters; Audit apps using the auth_code flow for exposure of tokens or other parameters to redirect endpoints; Check transitive npm dependencies for vulnerable msal-node versions

### [critical] BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability (CVE-2026-102764)
https://helix.ml/threat-watch/i/beyondtrust-remote-support-cve-2026-102764 · Vulnerabilities · unknown · since 2026-10-16 · CVE-2026-102764
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 19, 2026 (BOD 22-01); treat that as the outer limit.

### [medium] Fortinet Multiple Products Path Traversal Vulnerability (CVE-2025-61624)
https://helix.ml/threat-watch/i/fortinet-multiple-products-cve-2025-61624 · Vulnerabilities · unknown · since 2026-10-16 · CVE-2025-61624
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on Oct 16, 2026, which means attackers are exploiting it in the wild.
Do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.; US federal agencies must remediate by Oct 19, 2026 (BOD 22-01); treat that as the outer limit.

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.