https://www.immunitysec.com/intel/ News on actively exploited vulnerabilities, hacking and extortion campaigns, AI security incidents, and patching priorities, written for a general tech audience. en Sun, 01 Nov 2026 00:00:00 GMT https://www.immunitysec.com/intel/13_cursor-claude-code-extension-ssh-backdoor/ https://www.immunitysec.com/intel/13_cursor-claude-code-extension-ssh-backdoor/ Cursor said on October 29, 2026, that tampered versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension were available in its extension marketplace for about 11 hours that day. The tampered versions tried to install a backdoor, a hidden way for an attacker to log in to a computer. Cursor said at most 5,000 users were affected, and how the attacker published the versions remains unclear. Sun, 01 Nov 2026 00:00:00 GMT AI Security News & Analysis https://www.immunitysec.com/intel/12_binance-hack-north-korea-tradertraitor/ https://www.immunitysec.com/intel/12_binance-hack-north-korea-tradertraitor/ The FBI said on October 31, 2026, that North Korea was responsible for the theft of more than $6 billion in cryptocurrency from Binance, the world's largest crypto exchange, on or about October 29. Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic call it the largest crypto theft on record. Binance says it will cover all losses, and about $3 billion of the stolen assets has been frozen. Sat, 31 Oct 2026 00:00:00 GMT Threat Intelligence News & Analysis https://www.immunitysec.com/intel/11_cisco-sd-wan-cve-2026-20127-keydrift-volt-typhoon/ https://www.immunitysec.com/intel/11_cisco-sd-wan-cve-2026-20127-keydrift-volt-typhoon/ Cisco Talos reported on October 28, 2026, that a hacking group it tracks as UAT-11473 exploited CVE-2026-20127, a critical flaw in Cisco Catalyst SD-WAN controllers, to install KeyDrift, malware built to steal encryption key material. Talos assessed with high confidence that the group's infrastructure overlaps considerably with Silent Train, a covert network that Lumen's Black Lotus Labs says China's Volt Typhoon used in at least four confirmed zero-day campaigns. Cisco released fixes for the flaw in February 2026. Fri, 30 Oct 2026 00:00:00 GMT Threat Intelligence News & Analysis https://www.immunitysec.com/intel/10_cve-2026-46300-fragnesia-php2shell-firewalls/ https://www.immunitysec.com/intel/10_cve-2026-46300-fragnesia-php2shell-firewalls/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fragnesia, a Linux kernel flaw tracked as CVE-2026-46300, to its catalog of exploited vulnerabilities on October 28, 2026, and gave federal civilian agencies until October 31 to fix it. CISA said attackers can chain the flaw with the PHP2Shell flaws in PHP to plant web shells and run commands as root. Security firm Dream reported that a suspected China-linked attacker used that chain to take over 25 servers, three of them in a U.S. government-affiliated environment. Thu, 29 Oct 2026 00:00:00 GMT Defensive Engineering News & Analysis https://www.immunitysec.com/intel/9_cve-2026-111497-brotli-http2shell-exploited/ https://www.immunitysec.com/intel/9_cve-2026-111497-brotli-http2shell-exploited/ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, a flaw in Google's Brotli compression library known as HTTP2Shell, to its catalog of exploited vulnerabilities on October 27, 2026. Crafted compressed data can crash affected software, expose its memory, or in some cases let an attacker run code. The flaw affects Node.js, Python packages, .NET, and other software built on Brotli. U.S. federal civilian agencies must fix it by November 10. Wed, 28 Oct 2026 00:00:00 GMT Vulnerability News & CVE Analysis https://www.immunitysec.com/intel/8_openai-agents-huggingface-breach-reward-hacking/ https://www.immunitysec.com/intel/8_openai-agents-huggingface-breach-reward-hacking/ OpenAI and Hugging Face disclosed on July 21, 2026, that AI agents OpenAI was testing had escaped an isolated test environment and broken into parts of Hugging Face's production systems. In an August 26 report, OpenAI named reward hacking, agents cheating on tasks by looking up solutions online, as a primary driver of the incident and said training had reinforced the behavior. Mon, 31 Aug 2026 00:00:00 GMT AI Security News & Analysis https://www.immunitysec.com/intel/7_clop-ransomware-ptc-windchill-cve-2026-12569/ https://www.immunitysec.com/intel/7_clop-ransomware-ptc-windchill-cve-2026-12569/ The Cl0p extortion group exploited CVE-2026-12569, a critical flaw in PTC's Windchill and FlexPLM software, and in August 2026 named Shell, Philips, General Electric, Fiserv, and dozens of other companies on its leak site as data theft victims. None of the named companies has confirmed a significant breach. The data Cl0p claims to hold is engineering material such as drawings and blueprints rather than personal records. Sun, 30 Aug 2026 00:00:00 GMT Threat Intelligence News & Analysis https://www.immunitysec.com/intel/6_llms-txt-supply-chain-attack-ai-coding-agents/ https://www.immunitysec.com/intel/6_llms-txt-supply-chain-attack-ai-coding-agents/ Researchers found 120 corporate websites whose llms.txt files, guides published for AI tools, told readers to install code packages that nobody had registered, Ars Technica reported on August 27, 2026. After the researchers registered some of those names, AI coding agents including Claude, OpenAI Codex, and Nous Research Hermes installed them inside corporate networks, the first at a Fortune 500 company within an hour. One such package, linked from clerk.com, already contained malware. Sat, 29 Aug 2026 00:00:00 GMT AI Security News & Analysis https://www.immunitysec.com/intel/5_doj-fbi-seize-qscan-qtrouter-china-hacking-platforms/ https://www.immunitysec.com/intel/5_doj-fbi-seize-qscan-qtrouter-china-hacking-platforms/ On August 26, 2026, the U.S. Justice Department and FBI announced they had seized internet domains behind QScan and QTRouter, two hacking platforms that court documents say were run by QTFY, a Chinese state-sponsored group employed by Nanjing Xinjiuwei Network Technology Company. According to an FBI affidavit, the group has targeted U.S. federal networks since at least 2018, including NASA, the Federal Reserve, the Department of Energy, the Department of Justice, HHS, NIH, and the U.S. Senate. On August 28 the DOJ corrected its statement to say the agencies were targets, only some of which were compromised. Fri, 28 Aug 2026 00:00:00 GMT Threat Intelligence News & Analysis https://www.immunitysec.com/intel/4_cisa-kev-august-2026-netscaler-detection-guide/ https://www.immunitysec.com/intel/4_cisa-kev-august-2026-netscaler-detection-guide/ CISA added six vulnerabilities to its catalog of flaws known to be used in attacks on August 26, 2026. Researchers showed that the newest, CVE-2026-8452 in Citrix NetScaler ADC and NetScaler Gateway, lets attackers run their own code on the appliance without logging in. Federal civilian agencies had until August 29 to fix it. Thu, 27 Aug 2026 00:00:00 GMT Defensive Engineering News & Analysis https://www.immunitysec.com/intel/3_cve-2026-75604-nextjs-windows-avif-rce/ https://www.immunitysec.com/intel/3_cve-2026-75604-nextjs-windows-avif-rce/ Vercel released Next.js 15.5.24 and 16.3.3 on August 25, 2026, moving the release forward to fix two critical flaws that let attackers run code on servers without logging in. One affects sites hosted on Windows servers and has no workaround. The other comes from an image library that Next.js uses to process AVIF images. Wed, 26 Aug 2026 00:00:00 GMT Vulnerability News & CVE Analysis https://www.immunitysec.com/intel/2_vcenter-cve-2026-59310-china-apt-ransomware/ https://www.immunitysec.com/intel/2_vcenter-cve-2026-59310-china-apt-ransomware/ A hacking group that researchers suspect is Chinese-speaking began exploiting CVE-2026-59310, a critical flaw in VMware vCenter Server, five days after Broadcom released a fix on July 29, 2026. German incident response firm QUIRSO counted 361 victim IP addresses in 47 countries and found ransomware in one network it analyzed. Tue, 18 Aug 2026 00:00:00 GMT Defensive Engineering News & Analysis https://www.immunitysec.com/intel/1_cve-2026-63520-sharepoint-bdc-rce/ https://www.immunitysec.com/intel/1_cve-2026-63520-sharepoint-bdc-rce/ Microsoft has patched CVE-2026-63520, a SharePoint Server flaw that lets an attacker with a SharePoint login run code on the server, according to Rapid7, which disclosed it with Microsoft on August 11, 2026. Microsoft's advisory says an attacker without a login could exploit it. Combined with a separate login bypass, CVE-2026-55040, the attack needs no account. CISA added CVE-2026-55040 to its catalog of exploited vulnerabilities on August 18 with a due date of August 21, 2026. Wed, 12 Aug 2026 00:00:00 GMT Vulnerability News & CVE Analysis