Monthly
The Perl CPAN distribution IO::Socket::SSL::SelfCertificate version 1.00 is itself the attack artifact: its generate_certificate() routine writes a Python script disguised as a certificate file and executes it, causing base64-obfuscated code to be fetched from a hardcoded HTTP URL and run in memory without ever dropping a script to disk. Anyone who installs the 1.00 tarball and calls that function is exposed - a local, unauthenticated action requiring user interaction (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), rather than the remote pre-authentication scenario implied by the CNA's 9.8 network vector - and outbound HTTP egress must be reachable for the payload to be retrieved. The advisory notes there are no test scripts or build hooks, so nothing fires automatically at install time and the payload must be manually triggered; no public exploit code beyond the malicious package itself has been identified at time of analysis, EPSS is negligible at 0.12% (1st percentile), and the nearly identical CVE-2026-95831 covers the sibling Crypt::SelfCertificate module.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Build-time malicious code execution in the arrayref Rust crate version 0.3.10 allows an attacker to run arbitrary code on any developer or CI machine that compiles a project depending on it. The compromised release pulls in a rogue transitive dependency that beacons to a command-and-control server and accepts arbitrary command execution, making this a confirmed supply-chain compromise disclosed by the Rust Security Response WG and RustSec (RUSTSEC-2026-0260). No public standalone exploit is needed because the crate itself is the payload; not currently listed in CISA KEV.
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.
Build-time arbitrary code execution in the internment 0.8.7 crate for Rust: this specific published version was trojanized as part of the August 2026 arrayref/proc-macro1 Rust supply-chain campaign, pulling in a rogue transitive dependency that registers with a command-and-control server and executes attacker-supplied code on the developer or CI machine that compiles any project depending on it. Any Rust build that resolves internment 0.8.7 is affected, and because the payload runs during `cargo build` rather than at application runtime, compromise occurs before the target program is ever executed. No CISA KEV listing or public proof-of-concept is documented in the provided data, so this is tracked as embedded malicious code (CWE-506) rather than a confirmed in-the-wild exploit chain.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran `npm install` against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.
The Perl CPAN distribution IO::Socket::SSL::SelfCertificate version 1.00 is itself the attack artifact: its generate_certificate() routine writes a Python script disguised as a certificate file and executes it, causing base64-obfuscated code to be fetched from a hardcoded HTTP URL and run in memory without ever dropping a script to disk. Anyone who installs the 1.00 tarball and calls that function is exposed - a local, unauthenticated action requiring user interaction (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), rather than the remote pre-authentication scenario implied by the CNA's 9.8 network vector - and outbound HTTP egress must be reachable for the payload to be retrieved. The advisory notes there are no test scripts or build hooks, so nothing fires automatically at install time and the payload must be manually triggered; no public exploit code beyond the malicious package itself has been identified at time of analysis, EPSS is negligible at 0.12% (1st percentile), and the nearly identical CVE-2026-95831 covers the sibling Crypt::SelfCertificate module.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Build-time malicious code execution in the arrayref Rust crate version 0.3.10 allows an attacker to run arbitrary code on any developer or CI machine that compiles a project depending on it. The compromised release pulls in a rogue transitive dependency that beacons to a command-and-control server and accepts arbitrary command execution, making this a confirmed supply-chain compromise disclosed by the Rust Security Response WG and RustSec (RUSTSEC-2026-0260). No public standalone exploit is needed because the crate itself is the payload; not currently listed in CISA KEV.
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.
Build-time arbitrary code execution in the internment 0.8.7 crate for Rust: this specific published version was trojanized as part of the August 2026 arrayref/proc-macro1 Rust supply-chain campaign, pulling in a rogue transitive dependency that registers with a command-and-control server and executes attacker-supplied code on the developer or CI machine that compiles any project depending on it. Any Rust build that resolves internment 0.8.7 is affected, and because the payload runs during `cargo build` rather than at application runtime, compromise occurs before the target program is ever executed. No CISA KEV listing or public proof-of-concept is documented in the provided data, so this is tracked as embedded malicious code (CWE-506) rather than a confirmed in-the-wild exploit chain.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran `npm install` against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.