cybr.cx | October 31, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-118527 & CVE-2026-111357 | Ivanti Connect Secure
Two vulnerabilities in Ivanti Connect Secure are being chained in active attacks right now, with a CISA remediation deadline of November 13 and November 2 respectively. CVE-2026-118527 allows a remote authenticated attacker to upload files with attacker-controlled content to a predictable on-disk location; CVE-2026-111357 then enables local privilege escalation via a missing authentication check on a critical function. Both chain with a third flaw (CVE-2026-104935) — if you're running Connect Secure and haven't patched, assume you're a target.

⚠️ Actively exploited — CVE-2026-97229 | GitLab CE/EE
CISA due date was November 1 — if you haven't acted, you're already past the window. An unauthenticated attacker can trigger arbitrary code execution on the GitLab server by embedding a specially crafted regular expression in a CI/CD configuration file, exploiting an integer overflow in the regex engine. The blast radius here is enormous: compromised GitLab instances mean full access to source code, secrets, and pipeline infrastructure.

⚠️ Actively exploited — CVE-2026-76418 | Cisco Secure Firewall ASA & FTD
Unauthenticated remote attackers can crash Cisco ASA and FTD devices into a reload loop via a null pointer dereference triggered by an unchecked return value — a straightforward denial-of-service that's being actively weaponised. Perimeter devices going dark is a classic precursor move; verify your ASA/FTD versions and apply patches immediately.

⚠️ Actively exploited — CVE-2026-111497 | Google Brotli
A crafted Brotli-compressed stream can corrupt adjacent decoder state memory, enabling memory disclosure, denial of service, or potentially arbitrary code execution — all without authentication. Brotli is embedded in browsers, CDNs, web servers, and countless libraries, making the attack surface extremely broad. Patch or pin immediately.

⚠️ Actively exploited — CVE-2026-48356 | Adobe Commerce & Magento
Unrestricted file upload in Adobe Commerce and Magento is being exploited to achieve arbitrary code execution in the context of the current user. E-commerce platforms are high-value targets for skimming and data theft — if you're running Magento in any form, this is urgent.

⚠️ Actively exploited — CVE-2026-46300 | Linux Kernel
Today is the CISA deadline on this one. A missing variable initialisation in socket buffer coalescing causes ESP input processing to decrypt shared page-cache fragments in-place, enabling unintended modification of page-cache-backed data. The implications for IPsec-protected traffic integrity are serious — check your kernel version now.

⚠️ Actively exploited — CVE-2026-109618 & CVE-2026-109619 | PHP
Two PHP RCE flaws — an out-of-memory corruption and a stale internal request-state bug — are both in active exploitation with a CISA deadline that has already passed (October 29). Unauthenticated remote code execution on PHP-based web applications should need no further motivation to patch.

CVE-2026-119408 | n8n — CVSS 8.8
Authenticated users in n8n who can create, modify, or import workflows can abuse deprecated Function, Function Item, and LangChain Code nodes that run outside task runner isolation to execute arbitrary JavaScript directly in the n8n main process. Affects versions before 2.42.6, 2.43.3, and 3.0.1. Organisations using n8n for automation pipelines — especially those with broad user access — should upgrade immediately.

CVE-2026-119420 | Lago — CVSS 8.8
Lago's acceptInvite GraphQL mutation performs no password verification, allowing an organisation administrator to invite a victim's email address, accept with an arbitrary password, and receive a valid JWT granting access to the victim's organisations, billing data, API keys, and payment integrations. All versions through 1.55.0 are affected. Any SaaS built on Lago should treat this as critical given the financial data exposure.

CVE-2026-119572 | Traefik — CVSS 8.7
When a Kubernetes Ingress NGINX provider configuration in Traefik (3.7.0-ea.1 through 3.7.14) has mTLS enforced via auth-tls-secret, a separate Ingress declaring any path on the same host without matching auth-tls settings silently causes Traefik to fall back to default TLS — effectively disabling client certificate enforcement for the entire host. Unauthenticated attackers can reach backends that should be mTLS-protected.

CVE-2026-119373 | SQLite FTS5 — CVSS 7.8
A heap buffer overflow in fts5MergeRowidLists() can be triggered by populating a detail=none FTS5 table with negative rowids and running a prefix MATCH query, corrupting heap memory and crashing the process. SQLite's ubiquity — embedded in browsers, mobile apps, and countless server-side applications — makes this worth tracking even if exploitation requires some data-write access.

Headline News

Backdoored Claude Code Extension Distributed Through Cursor Marketplace

A trojanised extension impersonating the official Claude Code tool for VS Code was published to the Cursor marketplace and distributed to developers, delivering a remote access trojan to affected machines. The extension appeared legitimate, leveraging the Claude branding and passing casual inspection — a textbook supply chain attack targeting developer tooling. Compromised developer laptops represent a particularly high-value target: they typically hold source code, cloud credentials, SSH keys, and access to CI/CD pipelines, meaning a single infection can cascade into a full organisational breach. The incident underscores the danger of the extension ecosystem as an attack surface — marketplace vetting remains inconsistent, and developers tend to extend implicit trust to tools associated with well-known AI brands. Security teams should audit installed extensions across developer endpoints immediately and treat any Claude Code installation sourced outside official Anthropic channels as suspect.

$6.3 Billion Drained from Binance in 20-Minute Attack

In what is being described as one of the largest cryptocurrency thefts on record, attackers extracted approximately $6.3 billion from Binance in a window of just twenty minutes. The speed and scale of the operation points to sophisticated pre-positioning — attackers likely had prolonged access to internal systems or signing infrastructure well before the extraction began, using the compressed execution window to outpace detection and response. On-chain analysts have flagged outflows routing through Tornado Cash-funded wallets, though the full money-movement picture remains contested. For practitioners, the incident is a stark reminder that the threat model for financial infrastructure includes ultra-fast exfiltration scenarios where traditional SOC response timelines are simply insufficient — detection and automated circuit-breaker controls need to operate at machine speed. The exchange and investigators are ongoing in their analysis.

Pentagon Investigates Cyberattack Linked to Military Freezer Failures

The US Department of Defense is investigating a suspected cyberattack that caused widespread refrigeration system failures at military commissaries in August, spoiling food supplies at installations across the country. Investigators are also examining a potentially linked incident targeting refrigeration infrastructure in France, raising the possibility of a coordinated campaign against allied military logistics. The targeting of physical infrastructure — specifically cold-chain systems — is a notable escalation in operational technology (OT) threat activity, demonstrating adversary willingness to cause tangible, real-world disruption to military readiness. For security practitioners working in OT and ICS environments, the incident reinforces that networked building management and environmental control systems carry genuine national security risk and must be treated with the same rigour as IT infrastructure.

Schrödinger's Feed

QNu Labs, an India-based quantum-safe cryptography company, has been brought to market through a new distribution partnership aimed at accelerating enterprise adoption of post-quantum security products — timed deliberately against the backdrop of the National Quantum Initiative Reauthorization Act currently moving through US legislative channels. The pairing of a quantum-safe crypto vendor with a regional cybersecurity distributor is a telling signal: the PQC commercialisation wave is no longer confined to Western vendors or hyperscalers, with Asia-Pacific players now actively building out quantum-resistant product ecosystems. For practitioners, the policy angle matters — reauthorisation funding will shape which PQC research and standardisation efforts get resourced over the next decade. If your organisation hasn't started a cryptographic inventory in anticipation of migration to NIST's finalised PQC standards, the window for comfortable planning is closing.

/dev/random

Bunny CDN — a content delivery network used by a substantial slice of the web — suffered a security incident this week that should give anyone using CDN infrastructure for more than just caching reasons to pause. The specifics involve unauthorised access that put customer-facing content delivery at risk, which is the kind of incident that tends to go underappreciated until you remember that a compromised CDN sits inline between your origin and every end user, with the ability to silently modify or intercept served assets. It's the digital equivalent of someone quietly tampering with the postal truck rather than breaking into your house — by the time the package arrives, the damage is already done. Happy Halloween: the scariest thing in security is still the infrastructure you trust implicitly.