30
30
45
30
60
30
30
30
42
New Python-Based Payload MechaFlounder Used by Chafer
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.
44
45
30
55
42
45
CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.
CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.
30
ZDI-26-607: Microsoft Office HTML Injection Information Disclosure Vulnerability
ZDI disclosed an HTML injection flaw in Microsoft Office (CVSS 7.6) that lets remote attackers disclose sensitive information via malicious pages or files.
Zero Day Initiative advisory ZDI-26-607 describes an HTML injection vulnerability in Microsoft Office that leads to information disclosure. Remote attackers need the target to visit a malicious page or open a malicious file to trigger it. ZDI rated the issue 7.6 on the CVSS scale and the advisory lists no CVE identifier. The advisory does not indicate active exploitation.
18
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
Microsoft Threat Intelligence reports the DeadLock ransomware operation uses the Session messaging network and Polygon blockchain smart contracts to host victim chat, proxy server addresses, and its data leak blog, making takedowns harder. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., with deployments by affiliates of Lynx and INC ransomware. The encryptor uses Curve25519 with XChaCha20, drops an interactive HTML recovery chat application, geofences CIS-linked countries, and clears logs and shadow copies to evade forensics.
62
57
45
57
45
30
60
30
57
30
42
30
30
60
42
60
57
30
60
30
57
30
45