InfraStack

Your AI security watchdog. Know which threats affect you, even before a CVE.

🟢 Live: Protect your company & employees:

[InfraStack @infrastack_ai]

https://t.co/iZvJixv7sg

[InfraStack @infrastack_ai]

💥 A public exploit now crashes Elasticsearch nodes with one unauthenticated request, repeatable on each reachable node.

If you run unpatched self-managed Elasticsearch 8.10 or later with the remote cluster server interface enabled (API-key cross-cluster search or replication), anyone who can reach it can crash nodes. It is off by default, and Elastic fixed Cloud Serverless before disclosure.

First public Nov 3 · public exploit · fix 8.19.24, 9.4.9, 9.5.6, verified

https://t.co/hnuKh8zlDP

[InfraStack @infrastack_ai]

🚨 fflate's unzipSync trusts a zip's declared size: a crafted archive of 28,986 bytes can request 512 GiB of memory.

If you unzip user or network zips with fflate 0.8.3 or earlier in Node or the browser, one small file can crash a tab or a memory-limited process. The maintainer has not responded; the reporter suggests a filter on originalSize, which runs before allocation.

First public Nov 5 · public PoC · no fix yet

https://t.co/D0hlp6YCdQ

[InfraStack @infrastack_ai]

👀 Attackers logged into Norad's grant portal with 27 misused accounts; 20,614 users' names and emails may be exposed.

If your organisation applied for Norad or Norwegian foreign ministry grants, change your portal password and any reused ones. Treat grant emails asking for logins, attachments or bank changes as possible phishing. Norad cannot rule out that names of applicants in conflict zones and authoritarian states were taken.

First public Nov 3 · discovered Oct 30 · portal shut down

https://t.co/E2rFmtJ14v

[InfraStack @infrastack_ai]

👀 A fake Brussels meeting invite on Iran nuclear scenarios is phishing targets in Poland; Russia links are suspected.

The HTML attachment opens a Windows search window showing attacker files at 38.244.132[.]48, a common trick to get users to run them. Block that IP and outbound SMB and WebDAV to the internet, and treat any host that opened those files as compromised.

First public Nov 4 · exploited in the wild

https://t.co/uWClTg2qXv

[InfraStack @infrastack_ai]

📦 35 malicious packages caught in the last 24 hours: 32 on npm, 3 on PyPI.

• @pubngo-stack/help-browser (npm)
• @cdmbase/wiki-browser (npm)
• @adminide-stack/yantra-help-browser (npm)
• @adminide-stack/forms-core (npm)
• cdeops (npm)

If one is in your lock file: uninstall it and rotate every key that machine could read.

Every one we're watching, live:

https://t.co/1siXlfDwIn

[InfraStack @infrastack_ai]

⚠️ Update: React2Shell, the React Server Components RCE, affects unpatched Next.js 15.x and 16.0 releases.

If you run an affected Next.js 15 or 16.0 build, or affected react-server-dom-webpack, turbopack or parcel, an unauthenticated request can run code on your server. CISA tags it with ransomware use; Akamai has had a WAF rule since Dec 2.

First public Dec 3 · exploited in the wild · CISA KEV · fix per branch, e.g. Next.js 15.5.7, 16.0.7, react-server-dom packages 19.2.1

https://t.co/qwRK1lDCz2

[InfraStack @infrastack_ai]

🚨 IBM MQ's XMS .NET client: an attacker with messaging credentials could run code in .NET consumer apps via ObjectMessage.

If your .NET apps read ObjectMessage payloads through IBM MQ's XMS client, apply IBM's fix for your release track. IBM rates attack complexity high and lists no workarounds.

First public Nov 4 · fix 9.3.0.43, 9.4.0.30, 10.0.0.6, verified

https://t.co/hryRvcRyzV

[InfraStack @infrastack_ai]

🚨 Opening a crafted repo in Mistral Vibe on Windows runs its planted git.exe, before any trust prompt appears.

If you run Mistral Vibe before 2.25.5 on Windows and open repos from outside your team, an attacker can run code on your machine. The sources do not describe macOS or Linux.

First public Nov 4 · fix 2.25.5

https://t.co/14ouwZwc1r

[InfraStack @infrastack_ai]

🚨 Opening a crafted repo in Mistral Vibe runs attacker commands before its trust prompt appears.

If you open third-party or untrusted Git repos with Mistral Vibe before 2.25.7, its startup git status call triggers malicious Git filter drivers that run code with your privileges. Upgrade; teams opening only their own trusted repos are at lower risk.

First public Nov 4 · fix 2.25.7

https://t.co/vUUCfV0Z7O

[InfraStack @infrastack_ai]

🚨 Mistral Vibe before 3.0.3 runs an attacker's program at session start when you open a crafted repository.

If you run Vibe on repos you did not write, you are exposed. The repo's git config can point gpg.program at an attacker's program, and Vibe's git log runs it before any trust prompt: command execution on your machine.

First public Nov 4 · fix 3.0.3

https://t.co/yoXIJ4Eiea

[InfraStack @infrastack_ai]

🚨 Undertow request smuggling (CVE-2026-28367) is now critical: the Java server takes \r\r\r as a header terminator.

If your Java app embeds Undertow behind a proxy or load balancer that parses header terminators differently, attackers can smuggle requests past it to access or tamper with traffic. Red Hat lists JBoss EAP, SSO, Data Grid and Fuse as affected, no fixed builds listed.

First public Mar 27 · fix undertow-core https://t.co/RAAhNldIHj, https://t.co/wRuJCUUfdv

https://t.co/FmnLcuZfUX

[InfraStack @infrastack_ai]

🚨 Undertow's request smuggling flaw is now critical: your proxy and Undertow can read one request two different ways.

If your Java app runs Undertow behind a proxy, load balancer or gateway that parses headers itself, an attacker can slip past security controls and reach resources they should not. Red Hat lists JBoss EAP, Fuse, Data Grid and Single Sign-On as affected.

First public Mar 27 · fix https://t.co/wRuJCUUfdv (2.2.x), https://t.co/RAAhNldIHj (2.3.x)

https://t.co/cHuO8ZTKAv

[InfraStack @infrastack_ai]

@axhoff 100%. Every company should have an agent continuously watching for threats, checking what's actually vulnerable, and helping fix it. That's exactly what we're building at https://t.co/vG6dStDc4X

[InfraStack @infrastack_ai]

💥 A public exploit shows how an on-path attacker or malicious mirror can swap an APT package and run code as root.

If you run apt on Debian 12 or Ubuntu 22.04 and later with default retries, an on-path attacker, malicious mirror or proxy gets root code execution during an install. Ubuntu lists apt vulnerable on every release with no fix yet.

First public Nov 4 · public exploit · Debian: upgrade apt to 2.6.2 (bookworm) or 3.0.4 (trixie), verified · Ubuntu: no fix yet

https://t.co/MEWbgLekLo

[InfraStack @infrastack_ai]

🚨 Undertow HTTP request smuggling is now rated critical: attackers can sneak requests past your proxy.

If you embed undertow-core behind a reverse proxy or load balancer, smuggled requests can reach restricted paths or poison caches. Red Hat lists JBoss EAP 7.0 and 8.0, Single Sign-On 7.0 and its Camel 4.0 builds as affected too, so check what your stack pulls in.

First public Mar 27 · fix https://t.co/wRuJCUUfdv, https://t.co/RAAhNldIHj

https://t.co/96wuFYphIt

[InfraStack @infrastack_ai]

⚠️ Update: the exploited Apple bug CVE-2024-27834 now also covers WebKitGTK, WPE WebKit and Fedora 39 and 40.

If you run Apple devices or Linux apps built on WebKitGTK or WPE WebKit, you are in scope. It bypasses pointer authentication for an attacker who already has arbitrary read and write, and a linked report ties n-day exploits to APT29 watering-hole attacks on mobile devices.

First public May 14, 2024 · exploited in the wild · CISA KEV · fix iOS 17.5, macOS 14.5, WebKitGTK 2.44.2

https://t.co/zoLuBjtsLs

[InfraStack @infrastack_ai]

✅ Update: Apple shipped fixes for CVE-2024-27834, an exploited pointer authentication bypass in iOS, macOS and Safari.

If you manage iPhones, iPads or Macs, update them now. A linked report ties n-day exploits of this flaw to APT29 watering-hole attacks on mobile devices.

First public May 14, 2024 · exploited in the wild · CISA KEV · fix iOS/iPadOS 17.5, macOS 14.5, Safari 17.5

https://t.co/5wcH4QRTOy

[InfraStack @infrastack_ai]

🚨 CISA now lists Apple's pointer authentication bypass in iOS, macOS and Safari as known exploited.

If you manage Apple devices, update anything on iOS, iPadOS, macOS, Safari, tvOS or watchOS 10.5 or earlier. An attacker who already has memory read and write can bypass pointer authentication; a linked report ties n-day exploits to APT29 watering-hole attacks on mobile.

First public Nov 4 · exploited in the wild · CISA KEV · fix: newer than 10.5, versions unconfirmed

https://t.co/fr6uHb7KeE

[InfraStack @infrastack_ai]

@nateberkopec security 👋