🕵️ RESEARCH & DEEP DIVES
Alleged ShinyHunters leader Saif al-Din Khader, aka Rey, arrested in Jordan and cooperating with FBI
The alleged leader of the ShinyHunters extortion group was arrested in Jordan and is helping the FBI identify other members.- Suspect is Saif al-Din Khader, a teenage cybercriminal from Amman known as Rey, allegedly leader of ShinyHunters and a member of Scattered Lapsus$ Hunters.
- Jordanian authorities detained him on Tuesday, per Reuters sources; he is showing investigators his devices and communications to identify former associates.
- The arrest followed ShinyHunters' hack and defacement of FBIJobs.gov, with claims of stealing 2-3 TB of data including personal and health records of FBI employees.
- The FBI says the group hacked over 140 organizations and collected at least $70 million in extortion payments.
- A 24-year-old Amsterdam man, reportedly Pepijn van der Stap (Umbreon), was separately arrested in the Netherlands as part of the same investigation.
vgmstream TXTP parser out-of-bounds write vulnerability (CVE-2026-105248) fixed in commit
An out-of-bounds write vulnerability was discovered in vgmstream's TXTP file parser, fixed by commit 4669d37.- Affects vgmstream up to and including r2117, in the parse_params/txtp_parse function of src/meta/txtp_parser.c (TXTP File Handler component)
- Manipulation leads to an out-of-bounds write (CWE-787, CWE-119); rated Medium, CVSS 5.3 (v4.0)
- The attack can be launched remotely with no privileges required, though user interaction is needed
- Fixed by patch commit 4669d37a6af94866f6f0628678f9f90d46954e8b; disclosed 2026-10-04, reported by ni-liao via VulDB
CVE-2026-19954: Perl Net::Whois::Raw pwhois tool queries wrong domain for Unicode names
The pwhois command-line tool in Perl's Net::Whois::Raw before 2.99044 queries WHOIS for the wrong domain when given Unicode domain names.- Affects the pwhois command-line tool in Net::Whois::Raw versions before 2.99044; the Net::Whois::Raw library modules are not affected.
- pwhois encodes non-ASCII labels directly with Net::IDN::Punycode and prepends xn--, skipping IDNA mapping and normalization (CWE-176).
- Labels with uppercase letters outside ASCII/Cyrillic, or not in NFC, encode to a different A-label than their IDNA form — e.g. U+00C9 + "cole" becomes "xn--cole-pka" instead of "xn--cole-9oa".
- Impact is incorrect WHOIS lookups; no indication of code execution or direct security compromise, and it is not marked as known exploited.
- Fixed in Net::Whois::Raw 2.99044; a patch is available via security.metacpan.org.
CVE-2019-25777: Perl YAML before 1.27_001 lets perl/glob documents overwrite package variables, enabling code execution
Perl YAML versions before 1.27_001 (CVE-2019-25777) allow a loaded perl/glob document to replace any package variable, leading to arbitrary code execution.- Affects applications using the Perl YAML module in versions before 1.27_001; fixed in 1.27_001 and 1.28.
- A loaded perl/glob document names a package and symbol with no restriction on the name, so targets include @INC or YAML's own load options.
- Setting $YAML::LoadCode or $YAML::UseCode via a perl/glob document turns on code loading (off by default) for every later Load() in the process.
- A subsequent perl/code document is passed to string eval, so an attacker supplying two documents to separate Load() calls in one process can execute arbitrary Perl code.
- Classified as CWE-914 and CWE-502; severity unscored, not marked as known exploited; issue reported 2019-04-27, CVE reserved 2026-09-21.
CVE-2017-20285: Perl YAML before 1.30 lets loaded documents trigger arbitrary class DESTROY methods
A deserialization flaw in Perl's YAML module before 1.30 lets a loaded document trigger the DESTROY method of arbitrary classes.- Affects Perl applications using the YAML module in any version before 1.30.
- A perl/hash:Class tag blesses a hash into an attacker-named class, and Perl calls its DESTROY method when the object goes out of scope.
- Impact depends on loaded classes: with core Perl's File::Temp::Dir, a crafted document can delete a directory tree it names.
- Classified as CWE-502 (deserialization of untrusted data) and CWE-470 (unsafe reflection); fixed in YAML 1.30, released 2020-01-27, which defaults the $YAML::LoadBlessed option to off.
- CVE-2017-20285 was published Oct 5, 2026 by CPANSec; severity is unscored and not marked as known exploited.
🕵️ RESEARCH & DEEP DIVES (one-liners)
An improper access control vulnerability exists in GROWI, which allow an unau... — CVE ThreatInt
sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmi... — CVE ThreatInt
ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side requ... — CVE ThreatInt
File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer U... — CVE ThreatInt
File Uploads Addon for WooCommerce through 1.7.6 - Unauthenticated Direct File Acc... — CVE ThreatInt
UPI QR Code Payment Gateway through 1.4.3 - Unauthenticated Cross-Order Payment-St... — CVE ThreatInt
linlinjava litemall Login Endpoint AdminAuthController.java excessive authent... — CVE ThreatInt
Keycloak-services: keycloak-services: token introspection audience bypass via... — CVE ThreatInt
Keycloak-services: keycloak-services: user session note mapper exposes upstre... — CVE ThreatInt
kishor-23 food-waste-management-system Login Flow login.php session fixiation... — CVE ThreatInt
Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetc... — CVE ThreatInt
kishor-23 food-waste-management-system Registration deliverysignup.php sql in... — CVE ThreatInt
Rey got picked up finally. — @GossiTheDog@cyberplace.social
Top 10 Best Fine-Grained Authorization Tools in 2026 [Ranked & Scored] — Cyber Security News
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices — Cyber Security News
Top 10 Best Certificate Lifecycle Management (PKI) Tools in 2026 [Ranked & Scored] — Cyber Security News
Top 10 Best Machine Identity Management Solutions in 2026 [Ranked & Scored] — Cyber Security News