All alerts
11 malicious packages published on 2026-11-07 (pypi 10, npm 1)
Including: qzc690385, qzc690383, qzc690382, genblaze-fal, pulumi-doppler, genblaze-atlascloud, dsh-notify-focus, reqnests…
What to do: snare checks lockfiles and installs against these automatically — `snare deps`.
snare v1.9.0 released — update restarts the guard, notifies or auto-installs
snare update now restarts the guard and cleans up after itself. And snare tells you when there's a new version, or installs it for you. No more snare guard stop && snare guard start After an update, the background guard used to keep running the old version until you restarted it
What to do: Update: `snare update`.
CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux
CVE-2026-123158 (*sshole) enables an OpenSSH authentication bypass on Alpine Linux. Review lab results, exposure conditions, fixes, and mitigations.
33 malicious packages published on 2026-11-06 (npm 32, pypi 1)
Including: @cherrydotfun/miniapp-sdk, hello-bat-fwi9, tailwind-animationfound, modelsdesk, kampodine, automic-style-engine, monobomber, monopw…
What to do: snare checks lockfiles and installs against these automatically — `snare deps`.
LXD has restricted project bypass leading to arbitrary command execution
Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qe
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file write on client due to trusted image hash
Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the serve
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has argument injection in backup compression algorithm leading to AFW and ACE
Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly le
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it se
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260630083100-c5184be310b1 or later.
LXD has arbitrary file read+write on host via templates/ symlink in malicious image
Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/sto
What to do: Upgrade github.com/canonical/lxd to 0.0.0-20260203144152-d1c8ba15d160 or later.
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]
More from All alerts
LXD has arbitrary file write on host via exec-output symlink in crafted image
snare v1.8.0 released — a block explains what it caught
Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
snare v1.7.1 released — the 'behind' message goes away after you update
snare v1.7.0 released — snare update now actually updates
D-Link warns of multiple zero-days in DGS-3130 Series switches
Actively exploited: SonicWall SonicOS SSLVPN (CVE-2026-19868)
PyPI's redesigned project pages with clearer security signals are now live
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
56 malicious packages published on 2026-11-05 (npm 52, pypi 4)
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Deleting a leaked key from your repo doesn't protect you
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Hackers backdoor Linux servers using trojanized CWP web server
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
10 malicious packages published on 2026-11-04 (npm 10)
Vercel rolls out new protection against stolen session cookie attacks
Surviving cybersecurity until the end of 2026
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
Google Calendar phishing campaign hijacks sessions, bypasses MFA
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
Malicious release of screenshot-desktop (npm) — 66,054 downloads last week
CISA flags WordPress RCE flaw as actively exploited in attacks
Actively exploited: Apple Multiple Products (CVE-2024-27834)
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
18 malicious packages published on 2026-11-03 (npm 16, pypi 2)
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Binance says fake job interview led to $6.3 billion crypto heist
Google: LLMjacking attacks rack up $1 million in cloud AI charges
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access
Elo Ruby backend has Remote Code Execution via unescaped #{...} interpolation in emitted string literals and subtype-constraint labels
Hardening GitHub Actions Against Outside Threats
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges