Malware
YARA‑X 1.21.0 Adds stdin Support for --scan‑list and Fixes 4 Bugs
The latest YARA‑X 1.21.0 release introduces stdin support for the --scan-list CLI option, enabling piping of folder lists for scanning. It also includes five improvements and four bug fixes. Defenders should upgrade to take advantage of the new feature and review the changelog for potential impact on existing automation.
What happened
YARA‑X released version 1.21.0, adding new functionality and fixing several bugs.
New Features
The major change is support for stdin on the --scan-list CLI option, allowing a list of directories to be piped directly into YARA for scanning.
dir /s /b /a:d c:\*samples* | yr.exe scan --scan-list - rules.yara
Bug Fixes
- Fixed four bugs that affected rule parsing and scan performance.
- Implemented five overall improvements, including better error handling and documentation updates.
What to do
Upgrade to 1.21.0 to use the new stdin feature and to benefit from the bug fixes. Update any automation scripts that invoke yr.exe --scan-list to pipe directory lists instead of writing temporary files.
Related articles
Multiple RCE, Data Breach, and DoS Vulnerabilities in F5 NGINX Products
F5 has disclosed multiple critical vulnerabilities affecting its NGINX-based products, including remote code execution, data confidentiality and integrity compromise, and denial‑of‑service. Affected versions span F5 DoS for NGINX 4.x <4.11.0, F5 WAF for NGINX 5.x <5.16.0, and several other NGINX components. Defenders should verify product versions, apply vendor patches, and monitor for anomalous activity.
Read briefing
Xcode 27.2 Beta Drops Swift, SwiftUI, and Security Tweaks for 2026
Apple’s Xcode 27.2 beta, released on September 16, 2026, brings the latest Swift language enhancements, fresh SwiftUI APIs, and broader support for visionOS, tvOS, and macOS. The beta also tightens compiler security checks, improves sandboxing, and fixes a handful of build‑time bugs. Developers can grab the installer from the Apple Developer portal and start testing the new features today.
Read briefing
HPE Aruba SD‑WAN Products Hit by Multiple Remote Code Execution and Privilege‑Escalation Flaws
HPE Aruba Networking has disclosed a set of critical flaws in its EdgeConnect SD‑WAN Gateways and Orchestrator that can be exploited for remote code execution, privilege escalation, and denial‑of‑service. Affected releases include Gateway 9.4.x‑9.7.x (pre‑9.4.9.0, 9.5.9.0, 9.6.4.0, 9.7.1.0) and Orchestrator 9.4.x‑9.7.x (pre‑9.4.11, 9.5.9, 9.6.4, 9.7.1.0). The CVE list ranges from CVE‑2024‑32664 to CVE‑2026‑76696. Patch the firmware immediately and follow HPE’s advisory for configuration hardening.
Read briefing
GHOSTPULSE Evolves to Pixel‑Level Stealth – New Detection Requires Updated YARA
The latest GHOSTPULSE loader hides its encrypted configuration and payload inside PNG pixel data, replacing the old IDAT chunk method. Defenders should update Elastic Security YARA rules, use the new extractor, and monitor for single‑file executables that embed PNGs and for keyboard‑shortcut abuse in CAPTCHA flows.
Read briefing