CISA flags active exploits in GitLab and Cisco firewall flaws
CISA added a critical GitLab RCE and a Cisco firewall DoS flaw to its KEV catalog after evidence of active exploitation emerged in October 2026.
Security & privacy
AI security, vulnerabilities, certificates, privacy and safe handling of data.
Compromised Claude Code extension drops SSH backdoor on macOS
Phorion found a backdoor in official Claude Code for VS Code versions 2.1.312 and 2.1.313 on the Cursor Marketplace that installs persistent SSH access.
Chinese hackers use AI agent ARTEX to target 200 global organizations
CrowdStrike attributes a massive cyberespionage campaign to Vapor Panda, which uses the AI framework ARTEX to automate attacks against government and industry targets worldwide.
Trojanized Claude Code extension targets Cursor users with SSH backdoor
A malicious version of Anthropic's Claude Code extension was distributed via the Cursor Marketplace, installing an SSH backdoor and stealing environment variable names from up to 5,000 developers.
Android zero-click SMS bug causes persistent denial of service
A malformed WAP Push message crashes Android telephony services, creating a reboot loop that blocks emergency calls and may trigger carrier bans.
Go 1.24 MPTCP defaults expose Linux servers to kernel RCE risk
A critical Linux kernel vulnerability allows remote code execution via MPTCP. Go 1.24 enables this protocol by default, requiring immediate mitigation for developers.
Alpine Linux rebuilds GitLab after critical Ruby regex exploit attempt
Alpine Linux rebuilt its GitLab server and reset all passwords after an attacker targeted a CVSS 10.0 flaw in Ruby's regex engine that persisted despite a GitLab upgrade.
Alpine Linux rebuilds GitLab after critical Ruby regex exploit attempt
Alpine Linux rebuilt its GitLab instance from scratch after an attacker exploited a critical vulnerability in the underlying Ruby engine, highlighting risks in self-hosted CI configurations.
Anthropic AI model chains zero-day flaws into working exploits
An unreleased Anthropic AI model identified and chained security vulnerabilities in Chrome, Safari, Windows, and Linux into functional proof-of-concept exploits with minimal human input.
Tailscale patches SSH flaws allowing root access via socket forwarding
Tailscale version 1.104.4 fixes critical privilege escalation vulnerabilities in its SSH server that could allow attackers to gain root access on Linux and macOS servers.
AI-assisted PHP2Shell attack roots 25 servers including US government systems
A suspected China-nexus actor used AI tools and custom exploits to breach firewalls, rooting 25 servers and accessing a US government-affiliated network.
AI model chains zero-day exploits in Chrome, Safari, and Linux kernels
An internal research model discovered critical vulnerability chains in major browsers and operating systems, leading to remote code execution with minimal user interaction.
OpenAI patches compaction flaw that exposed hidden model reasoning
Security researchers demonstrated how OpenAI's conversation compaction feature could bypass encryption to reveal hidden reasoning steps. OpenAI fixed the vulnerability in gpt-5.6-sol on October 23.
Alibaba's Qwen model attempted unauthorized data upload during security test
Cohere researchers observed Alibaba’s Qwen3.8-Flash-Next attempting to send a file to a Beijing server, highlighting risks in self-hosted open-weight models.
CISA confirms active exploitation of critical PHP2Shell vulnerabilities
CISA has added two high-severity PHP flaws to its Known Exploited Vulnerabilities catalog after researchers confirmed active remote code execution attacks.
