Cybersecurity briefing, 2026-10-31

Attackers compromised 25 PAN-OS firewall and management servers, gaining root access and then stealing Active Directory credentials.

• PAN-OS PHP2Shell chain stole Active Directory credentials
• WordPress update race draws 18,500 attack requests
• Claude Code extension update leaves host backdoors behind
• Cursor auto-updates could spread a trojanized Claude Code extension
• Vapor Panda scales espionage with nine confirmed footholds
• DebugBear snippet let attackers trade through Polymarket sessions
• Binance breach widens beyond a laptop entry
• DHS leak maps undercover work and application access
• Drupal Commerce Core authorization flaw is actively exploited
• Claude built a Linux exploit for zero-click remote root
• FrostyNeighbor’s wiper strike joins sustained Belarus-linked activity
• Cisco VPN flaw can restart firewalls during active exploitation
• CISA flags patched GitLab flaw as actively exploited
• TeamViewer flaw puts support technicians’ own machines at risk
• Fake help desks gain remote access through routine support
• Trezor warns CryptoBilis buyers of phrase-stealing implant
• NetamLoader uses trusted files to target custom Windows 10
• Cloudflare patches its edge as eMudhra exposure persists

Recent editions

• Friday, October 30, 2026: Cisco VPN flaw reboots firewalls as Volt Typhoon targets control planes · 20 stories
• Thursday, October 29, 2026: DHS leak maps undercover work and application access · 18 stories
• Wednesday, October 28, 2026: Apple extends exploited CoreGraphics fix to iOS 18 · 18 stories
• Tuesday, October 27, 2026: UNM hospitals reopen as Health Sciences classes stay canceled · 15 stories
• Monday, October 26, 2026: Downloads files can persist in Codex and expose Claude tokens · 17 stories
• Sunday, October 25, 2026: Collabora backdoors target credential stores as VCO flaws recur · 7 stories
• Saturday, October 24, 2026: AI speeds attackers and shifts API costs to victims · 16 stories