FediSecfeeds

https://www.openwall.com/lists/oss-security/2026/10/16/36

##

CVE-2026-107570
(2.5 LOW)

EPSS: 0.13%

updated 2026-10-10T00:31:27

1 posts

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

thomasnoel@mamot.fr at 2026-10-17T11:00:41.000Z ##

CVE-2026-107570 : cette fois c'est sûr on va tous mourir.

##

CVE-2026-98260
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-07T09:33:19

1 posts

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pi

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://github.com/villager1314/CVE-2026-98256-Analysis

##

CVE-2026-98256
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-07T09:33:19

1 posts

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace: __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0 __x64

1 repos

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

https://cyberworldops.eu/en/langflow-command-injection-draws-exploitation-attempts-as-version-190

##

CVE-2026-105740
(9.9 CRITICAL)

EPSS: 0.59%

updated 2026-10-06T19:17:41.197000

1 posts

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediate

cyberworldops@infosec.exchange at 2026-10-16T15:00:22.000Z ##

Langflow fixed CVE-2026-105740, a critical command injection enabling RCE with CVSS 9.9. Exploitation attempts have been observed, putting exposed AI workflow servers at immediate risk. Patch to 1.9.0 and review logs for compromise. #Langflow #RemoteCodeExecution #ThreatIntel

##

CVE-2026-96652
(4.3 MEDIUM)

EPSS: 0.22%

updated 2026-09-29T18:36:18.417000

2 posts

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

2 repos

DarkWebInformer at 2026-10-18T16:00:00.969Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

CVE-2026-96654
(6.5 MEDIUM)

EPSS: 0.23%

updated 2026-09-29T18:35:57.403000

2 posts

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

2 repos

DarkWebInformer at 2026-10-18T16:00:00.969Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

CVE-2026-96655
(4.3 MEDIUM)

EPSS: 0.22%

updated 2026-09-29T18:35:19.410000

2 posts

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

2 repos

DarkWebInformer at 2026-10-18T16:00:00.969Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

https://github.com/a3igner/plex-codec-cache-implant

##

CVE-2026-96656
(7.2 HIGH)

EPSS: 0.40%

updated 2026-09-29T18:34:58.550000

2 posts

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

3 repos

DarkWebInformer at 2026-10-18T16:00:00.969Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

##

DarkWebInformer@infosec.exchange at 2026-10-18T16:00:00.000Z ##

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

https://www.openwall.com/lists/oss-security/2026/10/16/36

##

CVE-2026-97941
(7.8 HIGH)

EPSS: 0.15%

updated 2026-09-25T15:18:02.843000

1 posts

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic __slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL and cmpxchg succeeds. However, as reported by Hyunwoo Kim [1], other CPUs mig

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

updated 2026-09-13T07:17:39.837000

1 posts

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk->ops->install_pte is not specified, the code continues to the next PMD entry in the range without resetting

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.

https://www.openwall.com/lists/oss-security/2026/10/16/36

##

CVE-2026-81376
(9.6 CRITICAL)

EPSS: 0.90%

updated 2026-09-11T21:09:45.063000

2 posts

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

DarkWebInformer at 2026-10-18T18:21:55.063Z ##

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce

##

DarkWebInformer@infosec.exchange at 2026-10-18T18:21:55.000Z ##

CVE-2026-81376: VS Code RCE via Security Feature Bypass; $4,000 bounty.

Write-up: https://samchen.blog/blog/vscode-nested-form-to-rce

##

CVE-2026-80775(CVSS UNKNOWN)

EPSS: 0.17%

updated 2026-09-04T18:31:32

1 posts

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()") moved the allocation here and assumed that the process has just a single thread at this point. Commit ee9dce44362b ("futex

harrysintonen@infosec.exchange at 2026-10-16T22:09:52.000Z ##

Ah it's weekend again: "... vulnerabilities can be exploited for Linux server LPE, container escape, and Android LPE."

CVE-2026-98260 (Timer)
This is a use-after-free caused by the interaction between an exec() failure in a thread other than the process leader and POSIX CPU timer cleanup.

CVE-2026-98256 (Signal)
This is a sigqueue use-after-free caused by a race between exec() in a nonleader thread and cleanup of a private pending signal queue.

CVE-2026-89754 (MM)
Retry state from the page table walker escapes into an upper level, causing an out-of-bounds write to the temporary result buffer used by mincore().

CVE-2026-80775 (Futex)
This is a use-after-free caused when two tasks that share an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH.

CVE-2026-98385 (Scheduler)
This is a use-after-free caused when scheduler cache accounting continues to update per-CPU statistics belonging to a previously freed mm_struct. The vulnerable path is reached when CONFIG_SCHED_CACHE is enabled, scheduler cache is active at runtime, and the CPU topology contains multiple LLCs.

CVE-2026-97941 (SLAB)
This is a list corruption caused by a race between returning a freelist and removing a slab from the node partial list during SLUB object refill. The public trigger causes a kernel panic.