PwnSpectrum

Mon 2 Nov

The daily cybersecurity brief

No. 252

15 stories 3 critical 7 min read Updated 06:30 IST

Top stories

  1. Critical·ExploitedNew WordPress RCE Flaw Under Active Exploitation; Update to 7.1.4 Threat actors are exploiting an un-CVE'd RCE flaw in older WordPress versions; apply the 7.1.4 patch. Do this today Upgrade WordPress to version 7.1.4 Read the full story ↓
  2. High·6 outletsNew Binance Hack Linked to North Korean Group TraderTraitor Binance confirmed a $6.3 billion hack, which FBI and analysts link to North Korean group TraderTraitor. Read the full story ↓
  3. High·6 outletsNew Malicious Claude Code Extension on Cursor Planted SSH Backdoors A malicious extension distributed via Cursor exposed developers to malware attempting to install persistent SSH backdoors. Do this today Check for the presence of an 'svc-telemetry' SSH key and follow Cursor's remediation instructions. Read the full story ↓

From the editor

Prioritize patching WordPress to version 7.1.4 due to active exploitation of an un-CVE'd RCE flaw. Review developer workstations for malicious extensions, specifically those related to Cursor. Monitor for indicators of compromise related to the Binance incident.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 3

  • WordPress RCE Flaw Under Active Exploitation; Update to 7.1.4 Critical·Exploited·The Hacker NewsNewRead Threat actors are exploiting an un-CVE'd RCE flaw in older WordPress versions; apply the 7.1.4 patch.

    Threat actors are attempting to exploit a high-severity, un-CVE'd remote code execution flaw in WordPress Core. WordPress released version 7.1.4 on October 28, 2026, to address 22 vulnerabilities, including this RCE flaw. The flaw impacts versions 4.7 through 7.1.3.

    Why it matters. The vulnerability allows unauthenticated remote code execution. Failure to update leaves systems exposed to active exploitation attempts.

    Do this today Upgrade WordPress to version 7.1.4

    Affected
    WordPress Core versions 4.7 through 7.1.3
    Read on The Hacker News

    Also covered by GBHackers

  • MDaemon Flaw Allows Code Execution via ClamAV Scanning Critical·Exploited·ESET via GBHackersNewRead Threat actors exploit an MDaemon flaw via ClamAV scanning to execute code without user interaction.

    Threat actors are exploiting a flaw in MDaemon mail server software. The attack chain uses a malicious RAR archive exploiting CVE-2025-8088, which triggers when MDaemon invokes ClamAV to scan the attachment. This process writes a malicious DLL to the mail server's file system.

    Why it matters. Mail servers are valuable targets for espionage groups, and this vulnerability allows remote code execution through the mail server's legitimate scanning process.

    Do this today Upgrade MDaemon to version 26.0.4 or later and confirm ClamAV libraries are updated.

    Affected
    MDaemon mail server
    Read the original · ESET

    Summarised from GBHackers.

  • Volt Typhoon Uses Silent Train Tactic to Pre-position Access in Critical Infrastructure Critical·Exploited·Lumen via CSO OnlineNewRead Volt Typhoon is using the Silent Train tactic to establish persistent, hard-to-detect access within critical infrastructure sectors.

    Volt Typhoon is employing the Silent Train tactic, which involves rapidly rotating chains of compromised SOHO, IoT, and enterprise devices. This method allows for exploitation and post-exploitation activity while minimizing detection and attribution risk. The group has targeted network and endpoint management systems, SD-WAN orchestrators, and control plane infrastructure.

    Why it matters. The objective appears to be establishing persistent access for potential disruption or manipulation during geopolitical crises, rather than immediate data theft. This tactic bypasses traditional perimeter defenses by compromising management layers.

    Do this today Take every management console, SD-WAN orchestrator, and admin portal off the open internet and put it behind a VPN, a jump host, or a dedicated management network.

    Read the original · Lumen

    Summarised from CSO Online.

commonly target cryptocurrency and financial organizations, information technology companies and software supply chains, government entities, and education-related organizations.

Microsoft, via The Record

Vulnerabilities & Patches 4

  • LXD/MicroCloud Flaw Allows Client Impersonation Using Public Certificate Medium·The Hacker NewsNewRead A critical flaw in LXD and MicroCloud permits client impersonation using only a public certificate.

    A flaw in Canonical's LXD and MicroCloud allows an attacker to log in as a trusted client. This requires the attacker to reach the HTTPS API over the network and possess the trusted client's public certificate. The attacker gains access to the cluster and its virtual machines.

    Why it matters. Successful exploitation allows an attacker to act as a trusted client, potentially compromising the entire cluster and its contained virtual machines.

    Affected
    LXD, MicroCloud
    Read on The Hacker News
  • WordPress Core Update Process Vulnerability Exploited for RCE Medium·Wordfence via SecurityWeekNewRead Threat actors exploit an unauthenticated race condition in the WordPress Core update process for RCE.

    A high-severity unauthenticated race condition exists in the WordPress update process. This flaw allows exploitation during the unpacking of a complete Core update package. Threat actors are actively attempting to exploit this vulnerability.

    Why it matters. Exploitation grants remote code execution without requiring site authentication. The vulnerability stems from predictable, web-accessible staging paths during upgrades.

    Do this today Ensure WordPress is updated to version 7.1.4 or later, or backported versions to 4.7.

    Affected
    WordPress
    Read the original · Wordfence

    Summarised from SecurityWeek.

  • DarkSword iOS Exploit Chain Steals Apple Notes Data via Safari Sandbox Escape Medium·Zimperium via GBHackersNewRead A DarkSword-derived exploit chain escapes Safari's sandbox on newer iPhones to exfiltrate Apple Notes data.

    Zimperium zLabs identified a DarkSword-derived exploit chain within the Coruna iOS exploit campaign. This chain escapes Safari's sandbox, achieving remote code execution and exfiltrating the Apple Notes database and installed app inventory. The process involved multiple privilege boundary crossings.

    Why it matters. The exploit demonstrates sophisticated sandbox escape capabilities, targeting sensitive local data like Apple Notes and installed application lists. Defenses must account for exploits that bypass standard application sandboxing mechanisms.

    Do this today Enforce OS version policies for all devices.

    Affected
    iOS 17.2.1 and earlier, iOS 18.6.2
    Read the original · Zimperium

    Summarised from GBHackers.

  • Microsoft Investigates Help Desk Impersonation and AD CS Abuse Paths Medium·Microsoft SecurityNewRead Attackers impersonated IT staff on Teams to abuse AD CS, achieving domain admin access without exploiting Teams.

    Intruders impersonated IT help desk personnel on Microsoft Teams to establish remote access. This was followed by the abuse of Active Directory Certificate Services (AD CS) using authentication relay and Kerberos.

    Why it matters. This technique allows attackers to leverage trusted support channels to escalate privileges to domain administrator level.

    Do this today Review AD CS templates for unauthorized modification or abuse.

    Affected
    Microsoft Teams, Active Directory Certificate Services
    Read on Microsoft Security

    Also covered by GBHackers

Malware & Ransomware 4

  • Malicious Claude Code Extension on Cursor Planted SSH Backdoors High·6 outlets·Cursor via BleepingComputerDay 2NewRead A malicious extension distributed via Cursor exposed developers to malware attempting to install persistent SSH backdoors.

    A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's marketplace for approximately 11 hours on October 29. The extension ran malicious code upon loading, attempting to collect system information and install an attacker-controlled SSH key.

    Why it matters. The malware attempted to establish persistence and exfiltrate reconnaissance data, including public IP addresses and Git email addresses, from compromised developer machines.

    Do this today Check for the presence of an 'svc-telemetry' SSH key and follow Cursor's remediation instructions.

    Affected
    Developers using Cursor IDE with Claude Code extension
    1. Sat 31 OctMalicious Claude Code Extension on Cursor Planted SSH Backdoors
    2. TodayMalicious Claude Code Extension on Cursor Planted SSH Backdoors
    Read the original · Cursor

    Summarised from BleepingComputer; also covered by Ars Technica, Dark Reading.

  • NetamLoader Malware Targets Asian Government Windows Systems via .NET Injection High·3 outlets·Securelist via The RecordDay 2NewRead NetamLoader uses legitimate Microsoft components in a supply-chain attack against customized Windows 10 builds in Asia.

    NetamLoader, a .NET loading framework built on XAML markup, targets a customized Windows 10 build used by government organizations in Asia. The malware was found within a package in a directory used for Windows operating system updates. Once active, it can interfere with security scanning and download additional malicious code.

    Why it matters. The malware's use of legitimate components and its targeting of customized operating systems indicate a high degree of attacker knowledge regarding the specific environment. This suggests a potential supply-chain compromise targeting critical infrastructure.

    Affected
    Custom Windows 10 build used by government entities in Asia
    1. Sat 31 OctNetamLoader Malware Targets Asian Government Windows Systems
    2. TodayNetamLoader Malware Targets Asian Government Windows Systems via .NET Injection
    Read the original · Securelist

    Summarised from The Record; also covered by The Hacker News, GBHackers.

  • Trezor Warns of Suspected Crypto-Theft Implant in Safe 5 from CryptoBilis Medium·3 outlets·Trezor via BleepingComputerNewRead Trezor advises users to move funds from Safe 5 units bought from reseller CryptoBilis due to reports of a potential hardware implant.

    Trezor received reports of a suspected hardware implant in a Safe 5 wallet purchased from reseller CryptoBilis. The implant reportedly includes an extra circuit board capable of transmitting the recovery phrase over a mobile network. Trezor has not independently verified the device.

    Why it matters. The potential implant could allow unauthorized reading and transmission of private key recovery phrases. Users are advised to treat any device from this source as compromised.

    Do this today Move funds from any Trezor Safe 5 purchased from CryptoBilis since March 2026 to a newly created wallet with a new recovery phrase.

    Affected
    Trezor Safe 5 purchased from CryptoBilis since March 2026
    Read the original · Trezor

    Summarised from BleepingComputer; also covered by The Hacker News, GBHackers.

  • NIK C2 Malware Uses OpenAI API for Data Exfiltration and Control High·Cisco Talos via GBHackersNewRead A Go-based implant, NIK C2, uses the OpenAI API to steal credentials and execute commands on Windows systems.

    Cisco Talos identified NIK C2, a 64-bit Windows remote access tool written in Go. This implant embeds an OpenAI client, allowing operators to send prompts and read model replies via a C2 panel. The malware can exfiltrate credentials, perform screen capture, and establish persistence.

    Why it matters. The malware leverages the victim's account to pay for inference via OpenAI, potentially masking the attacker's identity in logs. Its advanced evasion techniques include renaming itself to csrss.exe and patching AMSI in PowerShell.

    Do this today Rotate any exposed AI API keys.

    Read the original · Cisco Talos

    Summarised from GBHackers.

Threat Actors & Campaigns 1

  • Threat Actors Weaponize Agentic Frameworks Like ARTEX for Automated Intrusions Medium·Google Threat IntelligenceNewRead Adversaries are using multi-agent LLM frameworks like ARTEX to automate and accelerate complex attack chains.

    Threat actors are observed using open-source, agentic pentesting frameworks such as ARTEX, Hexstrike, and CAIRN. These frameworks automate multiple stages of the attack lifecycle by chaining complex actions using LLMs. This represents a shift toward machine-speed, scalable intrusions.

    Why it matters. The speed and scale of these automated frameworks increase the velocity of exploitation, challenging traditional defense models. Defenders must account for autonomous, multi-stage attack paths.

    Do this today Implement control-plane isolation, enforce short-lived credentials, and enforce least privilege across environments.

    Read on Google Threat Intelligence

Breaches & Incidents 3

  • Binance Hack Linked to North Korean Group TraderTraitor High·6 outlets·TRM Labs via The RecordDay 2NewRead Binance confirmed a $6.3 billion hack, which FBI and analysts link to North Korean group TraderTraitor.

    Binance reported a $6.3 billion theft attributed to hackers. The FBI and multiple security firms linked the attack to North Korean state-sponsored hackers known as TraderTraitor. Binance traced the breach to a compromised laptop belonging to a company engineer.

    Why it matters. The incident demonstrates the capability of state-sponsored actors to target major financial platforms. Binance suspended deposits and withdrawals while investigating the breach.

    1. Sat 31 OctBinance Hacked: $6.3 Billion Theft Linked to North Korea
    2. TodayBinance Hack Linked to North Korean Group TraderTraitor
    Read the original · TRM Labs

    Summarised from The Record; also covered by BleepingComputer, SecurityWeek.

  • Polymarket Breach: Third-Party Script Used for Crypto Drainage High·BleepingComputerNewRead Hackers compromised a third-party service to inject JavaScript, draining user crypto and prediction-market assets from Polymarket.

    Malicious JavaScript was distributed via a page-speed script loaded from a third-party service. This script was designed to hijack authenticated user sessions to liquidate positions and transfer assets to an attacker-controlled wallet. Polymarket suspended trading after tracing approximately $2.5 million in drained assets.

    Why it matters. Defenders must assess the security posture of external scripts and monitoring services integrated into web applications, as they can facilitate unauthorized financial transactions.

    Do this today Review third-party JavaScript dependencies for unauthorized data exfiltration or transaction execution capabilities.

    Affected
    Polymarket
    Read on BleepingComputer

    Also covered by The Hacker News

  • Revolve Reports Theft of Customer Payment Card Information Medium·Securities and Exchange Commission (SEC) via The RecordNewRead Revolve reported that cybercriminals accessed and obtained customer payment card numbers and expiration dates.

    Revolve filed an 8-K report stating threat actors used automated means to obtain customer data from saved payment information on its e-commerce platform. The stolen data included names, contact information, and payment card details. The company notified federal law enforcement agencies about the incident.

    Why it matters. Exposure of payment card data increases the risk of financial fraud for affected customers. Defenders should monitor for related credential stuffing or payment-related phishing campaigns.

    Affected
    Revolve e-commerce platform
    Read the original · Securities and Exchange Commission (SEC)

    Summarised from The Record.

CVE spotlight

CVEAffectsCVSSEPSSStatus
CVE-2026-111357 Ivanti Connect SecureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege e… 7.0 1% Exploited (KEV)CISA due 2 Nov
CVE-2026-118527 Ivanti Connect SecureIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker … — — Exploited (KEV)CISA due 13 Nov

Quiz

Yesterday's answer

Which specific vulnerability was added to the KEV Catalog and is associated with Ivanti, according to the text?

CVE-2026-111357 (Ivanti)

The story explicitly lists CVE-2026-111357 associated with Ivanti as one of the vulnerabilities added to the KEV Catalog.

Today's question

According to the news story, what action was taken to address the critical RCE flaw in WordPress Core?

The week ahead

Also worth your time

Tools

  • agent0ai/agent-zeroIn today's news · via Google Threat Intelligence · AI security · PythonProvides an open-source framework allowing an AI agent to operate within a simulated Linux environment for research and …
  • phishdestroy/TgWitnessNew · 205 stars in 3 days · Forensics & malware analysis · PythonExports Telegram chats, logs deleted messages, and compares edited message versions for evidence preservation.
  • NyxFoundation/nyxisNew · 317 stars in 7 days · Web & AppSec · LeanProvides a backend framework with formally proven authorization safety based on Cedar policies and PostgreSQL.
  • akari-sora/synology-nas-cliNew · 56 stars in 3 days · Web & AppSec · PythonAudits and remediates Synology DSM 7 configurations against ransomware indicators using a Python CLI.
  • Problem99-io/kodeblueNew · 43 stars in 7 days · Detection & response · GoProvides SOC, incident response, and SecOps capabilities for Linux servers via a dedicated agent.
  • DigitalMinimalism0/BastionNew · 57 stars in 11 days · Detection & response · GoAssesses the patch status of multiple PHP builds and searches for indicators of compromise on a host system.

And finally

Mistral Open-Sources AI Model Despite Warning of Cyberattack Potential

Mistral AI released open weights for a large model, noting its potential for misuse. Users assume responsibility for deployment guardrails.

Source: Mistral AI · via CSO Online

End of No. 252

That's today's brief.

Coming upKEV deadline tomorrow: CVE-2026-110936 · Siemens Software Center

The next brief lands at 06:30 IST.

Keyboard shortcuts

j k
Next / previous story
o or Enter
Open / close story
v
Read the source in a new tab
e
Expand / collapse all
/
Search
d
Light / dark theme
Esc
Close