figlet-chalk-render v1.2.1 (npm) contains CRITICAL malicious code: on import, it downloads & runs a Windows executable, evading CI/sandbox. Remove & audit dependencies now. https://radar.offseq.com/threat/malicious-code-in-figlet-chalk-render-npm-e2cae6cc542e670e #OffSeq #npm #SupplyChainSecurity

nebulaai-sdk v1.0.0 (npm) is CRITICAL: Installs a RAT on Windows, opening C2 access with user privileges. Remove the package & conhost.exe if installed. Monitor for suspicious connections. https://radar.offseq.com/threat/malicious-code-in-nebulaai-sdk-npm-cf83f4133db4c1ba #OffSeq #npm #malware

FAST FAC1203R (20200116_2.0.4) faces a CRITICAL buffer overflow (CVE-2026-101354). Public exploit out, no vendor patch. Limit network access & monitor devices. https://radar.offseq.com/threat/cve-2026-101354-stack-based-buffer-overflow-in-fast-fac1203r-384c04ef24176780 #OffSeq #CVE2026101354 #IoT...

Netcore NAP930 v0.1.241010.141410 hit by CRITICAL OS command injection (CVE-2026-102240, CVSS 10). Public exploit, no patch. Isolate affected systems & monitor. https://radar.offseq.com/threat/cve-2026-102240-os-command-injection-in-netcore-nap930-5453a1be70791747 #OffSeq #Netcore #Vulnerability

CRITICAL: Ziroom ZHOME A0101 v1.0.1.0 has a command injection risk (CVE-2026-101264). No patch — limit API access & watch for updates. Full system compromise possible. https://radar.offseq.com/threat/cve-2026-101264-command-injection-in-ziroom-zhome-a0101-06a3a86bcb9501aa #OffSeq #IoTSecurity #CV...

CRITICAL buffer overflow (CVE-2026-101039) in FAST FAC1900R 20190827_2.0.2 enables remote code execution. Exploit is public, no patch. Apply network restrictions immediately. https://radar.offseq.com/threat/cve-2026-101039-stack-based-buffer-overflow-in-fast-fac1900r-f3ece93ec0ed3ff8 #OffSeq #CVE...

aaPanel BaoTa <=11.8.0 hit by CRITICAL OS command injection (CVE-2026-101009). Public exploit, no vendor fix. Restrict access & monitor systems. https://radar.offseq.com/threat/cve-2026-101009-os-command-injection-in-aapanel-baota-2affddad69ededf3 #OffSeq #CVE2026101009 #cybersecurity

Netcore NBR200V2 v1.3.241127.071246 hit by CRITICAL OS command injection (CVE-2026-101002). Exploit code public, no patch. Isolate affected devices & apply network-level controls. https://radar.offseq.com/threat/cve-2026-101002-os-command-injection-in-netcore-nbr200v2-8a15ef317ba62749 #OffSeq #Ne...

TOTOLINK N150RT v3.4.0-B20201030 faces CRITICAL OS command injection (CVE-2026-100896, CVSS 9.4) ⚠️. Public exploit exists — restrict mgmt interface & check for updates. No patch yet. https://radar.offseq.com/threat/cve-2026-100896-os-command-injection-in-totolink-n150rt-29dd6473e6a24e03 #OffSeq ...

Seetong T8108 series faces CRITICAL CVE-2026-100886: remote unauthenticated access possible due to improper authentication (v4.6.1.4). No patch — restrict device access immediately. https://radar.offseq.com/threat/cve-2026-100886-improper-authentication-in-seetong-t8108-acea634abd75f700 #OffSeq #...

CRITICAL: requests-cache-utils v1.0.0 (PyPI) contains install-time malware, exfiltrating browser data. Remove and avoid use. Full details: https://radar.offseq.com/threat/malicious-code-in-requests-cache-utils-pypi-e8c3f4806b2131ca #OffSeq #Malware #PyPISecurity

donutautosellsrc PyPI package (v0.3.7 – 0.3.9) is CRITICAL: contains obfuscated infostealer using blockchain C2. Uninstall affected versions now and monitor for data loss. https://radar.offseq.com/threat/malicious-code-in-donutautosellsrc-pypi-adf2fee072c2c5b1 #OffSeq #PyPISecurity #Malware

Ad Inserter plugin (WP, 2.8.12 – 2.8.18) hit by CRITICAL code injection. Subscriber users can run PHP or serve XSS. Upgrade to 2.8.19+ now. https://radar.offseq.com/threat/cve-2026-81655-cwe-94-improper-control-of-generation-of-code-code-injection-in-ad-inserter-d330f89b1f759aca #OffSeq #WordPres...

CRITICAL: Contrast <1.16.0 vulnerable to attestation relay attacks. Unbound TEE reports can let attackers impersonate trusted workloads. Patch now. https://radar.offseq.com/threat/contrast-before-1160-is-susceptible-to-remote-attestation-relay-attacks-cve-2026-100835-3833ee713219f7e3 #OffSeq #CVE...

D-Link DIR-895L faces CRITICAL CVE-2026-100740 (CVSS 9.4): out-of-bounds write enables remote attacks. Exploit code is public. No patch yet — monitor vendor for updates. https://radar.offseq.com/threat/cve-2026-100740-out-of-bounds-write-in-d-link-dir-895l-73af9e0aee6421f0 #OffSeq #CVE2026100740 ...

OpenClaw Slack (<2026.8.1) faces HIGH severity (CVSS 8.7) auth bypass in multi-person DMs — unauthorized users can trigger Slack agents. Upgrade to 2026.8.1+ to secure your data. https://radar.offseq.com/threat/cve-2026-100575-missing-authorization-in-openclaw-slack-2a3447a3c9192e9f #OffSeq #Vuln...

openclaw msteams <2026.8.1 has a HIGH severity bug (CVE-2026-100582) allowing unauthorized channel reads. Upgrade to 2026.8.1+ to block data exposure. https://radar.offseq.com/threat/cve-2026-100582-missing-authorization-in-openclaw-msteams-98e504ab6e11afa6 #OffSeq #Vulnerability #Cybersecurity

CRITICAL: tobychui zoraxy 3.2.3 – 3.3.4 has auth bypass (CVE-2026-100390) via IPv6 X-Forwarded-For spoofing. Restrict IPv6 or avoid IP-based controls until patched. https://radar.offseq.com/threat/cve-2026-100390-authentication-bypass-by-spoofing-in-tobychui-zoraxy-92a9e1620a0f6d01 #OffSeq #CVE20...

chromatitle npm v1.0.0 carries CRITICAL malicious code: obfuscated loader fetches & runs remote payloads on import. Remove & audit dependencies ASAP. No patch available. #OffSeq #npm #Security https://radar.offseq.com/threat/malicious-code-in-chromatitle-npm-1cefd95c647d92b5

CRITICAL: Bitget hit by $351.6M theft from hot/warm wallets — multiple blockchains affected. Withdrawals paused, User Protection Fund covers losses. Monitor for updates. https://radar.offseq.com/threat/hackers-steal-3516-million-in-bitget-crypto-exchange-hack-95a2b6dc1669868f #OffSeq #cryptosec #...