Monthly
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Build-time malicious code execution in the arrayref Rust crate version 0.3.10 allows an attacker to run arbitrary code on any developer or CI machine that compiles a project depending on it. The compromised release pulls in a rogue transitive dependency that beacons to a command-and-control server and accepts arbitrary command execution, making this a confirmed supply-chain compromise disclosed by the Rust Security Response WG and RustSec (RUSTSEC-2026-0260). No public standalone exploit is needed because the crate itself is the payload; not currently listed in CISA KEV.
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.
Build-time arbitrary code execution in the internment 0.8.7 crate for Rust: this specific published version was trojanized as part of the August 2026 arrayref/proc-macro1 Rust supply-chain campaign, pulling in a rogue transitive dependency that registers with a command-and-control server and executes attacker-supplied code on the developer or CI machine that compiles any project depending on it. Any Rust build that resolves internment 0.8.7 is affected, and because the payload runs during `cargo build` rather than at application runtime, compromise occurs before the target program is ever executed. No CISA KEV listing or public proof-of-concept is documented in the provided data, so this is tracked as embedded malicious code (CWE-506) rather than a confirmed in-the-wild exploit chain.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran `npm install` against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Root-level remote code execution affects a family of Zbtlink, MoreQuick, and related OEM routers/APs (e.g. L3_V2_8 3.0.0.4.528, WE826-T2 19.1101, ZBT-7628, ZBT-ZBT7621, AP522, AP7628, HC5661A, HK300, MAP-N10) that ship a factory backdoor implant named 'yunmgrd' beaconing to a hardcoded cloud C2 over unauthenticated cleartext UDP. Because the channel is unauthenticated and in cleartext, a remote attacker on the network path can hijack it, impersonate the C2, and run arbitrary commands as root - additionally tampering with DNS, stealing PPPoE credentials, and opening reverse SSH tunnels. Reported by VulnCheck with publicly available exploit code; not currently listed in CISA KEV.
Build-time malicious code execution in the arrayref Rust crate version 0.3.10 allows an attacker to run arbitrary code on any developer or CI machine that compiles a project depending on it. The compromised release pulls in a rogue transitive dependency that beacons to a command-and-control server and accepts arbitrary command execution, making this a confirmed supply-chain compromise disclosed by the Rust Security Response WG and RustSec (RUSTSEC-2026-0260). No public standalone exploit is needed because the crate itself is the payload; not currently listed in CISA KEV.
Build-time arbitrary code execution affects the append-only-vec Rust crate version 0.1.9, which was trojanized as part of the August 2026 arrayref-family supply chain attack. The crate pulls in a rogue dependency that beacons to a command-and-control server and offers the operator arbitrary code execution on any machine that compiles a project depending on it. This is classified CWE-506 (embedded malicious code); no public exploit tooling is published because the malware itself is the payload, and it is not listed in CISA KEV.
Build-time arbitrary code execution in the internment 0.8.7 crate for Rust: this specific published version was trojanized as part of the August 2026 arrayref/proc-macro1 Rust supply-chain campaign, pulling in a rogue transitive dependency that registers with a command-and-control server and executes attacker-supplied code on the developer or CI machine that compiles any project depending on it. Any Rust build that resolves internment 0.8.7 is affected, and because the payload runs during `cargo build` rather than at application runtime, compromise occurs before the target program is ever executed. No CISA KEV listing or public proof-of-concept is documented in the provided data, so this is tracked as embedded malicious code (CWE-506) rather than a confirmed in-the-wild exploit chain.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran `npm install` against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.