Cybersecurity briefing, 2026-11-02

A clean extension update is not a clean machine.

• Ivanti Connect Secure chain reaches root without an account
• PAN-OS PHP2Shell chain stole Active Directory credentials
• Claude Code extension update leaves host backdoors behind
• Cursor auto-updates could spread a trojanized Claude Code extension
• WordPress update race draws 18,500 attack requests
• Vapor Panda scales espionage with nine confirmed footholds
• DHS leak maps undercover work and application access
• TeamViewer flaw puts support technicians’ own machines at risk
• DebugBear snippet let attackers trade through Polymarket sessions
• Fake help desks gain remote access through routine support
• GOLD OGRE used AI agents to expand ransomware intrusions
• FrostyNeighbor’s wiper strike joins sustained Belarus-linked activity
• Cisco VPN flaw can restart firewalls during active exploitation
• VOLTA builds financial dossiers from stolen Windows data
• AP account takeover carried Assad-linked campaign into markets
• Binance withdrawals resume as FBI publishes laundering wallets
• Linux kernel checksum flaw threatens guest isolation
• Ruby regex exploit fails against Alpine's GitLab, packages stay clean
• Drupal Commerce Core authorization flaw is actively exploited

Recent editions

• Sunday, November 1, 2026: Binance withdrawals resume as FBI publishes laundering wallets · 7 stories
• Saturday, October 31, 2026: PAN-OS PHP2Shell chain stole Active Directory credentials · 17 stories
• Friday, October 30, 2026: Cisco VPN flaw reboots firewalls as Volt Typhoon targets control planes · 20 stories
• Thursday, October 29, 2026: DHS leak maps undercover work and application access · 18 stories
• Wednesday, October 28, 2026: Apple extends exploited CoreGraphics fix to iOS 18 · 18 stories
• Tuesday, October 27, 2026: UNM hospitals reopen as Health Sciences classes stay canceled · 15 stories
• Monday, October 26, 2026: Downloads files can persist in Codex and expose Claude tokens · 17 stories