Supply-chain attacks and actively exploited flaws in software engineers run, without the advisory noise. Each claim linked to its source.
16 Narratives · RSS · shorter items in the Daily Brief
A supply chain compromise placed a backdoored version of Anthropic's Claude Code extension in Cursor's marketplace for roughly 11-12 hours, reaching up to 5,000 users before removal. The malicious versions added SSH keys, installed persistence mechanisms,
Built from 8 signals across 8 sources · 407 items reviewed
What changed · following since Oct 30 Nov 1 — Red Hat raised the flaw to Critical, Amazon Linux shipped fixes, and Go's default MPTCP behavior expanded the perceived attack surface.
The severity consensus has shifted after Red Hat raised its
Built from 3 signals across 3 sources · 731 items reviewed
A PKI compromise at eMudhra exposed private keys for eight intermediate certificate authorities, enabling anyone to forge valid TLS certificates for arbitrary domains. Major platform vendors and runtime maintainers responded with coordinated certificate blocklists, but the fragmented trust store landscape
Built from 6 signals across 6 sources · 408 items reviewed
What changed · following since Oct 25 Oct 30 — Palo Alto Networks confirmed active exploitation against internet-exposed PAN-OS management interfaces and is releasing fixed versions across affected branches.
The attack surface has widened from PHP itself to critical network
Built from 20 signals across 13 sources · 1745 items reviewed
CVE-2026-99999 breaks a shared Linux kernel isolation boundary: specially crafted packets from a guest VM can read host memory, making the issue relevant beyond Vercel's sandboxes. Vercel confirmed the flaw after it was demonstrated against live sandboxes,
Built from 2 signals across 2 sources · 258 items reviewed
What changed · following since Oct 10 Oct 20 — GhostAction has added GitHub-themed phishing and a VS Code-triggered credential stealer disguised as a font file, with 94 repositories carrying the second stage.
GhostAction has evolved from workflow injection into
Built from 5 signals across 3 sources · 515 items reviewed
Attackers compromised three country-code registries and used them to obtain unauthorized HTTPS certificates for Google and YouTube domains, showing that browser trust can fail outside the target company’s infrastructure. Google said its systems were not breached, but domains
Built from 2 signals across 2 sources · 113 items reviewed
What changed · following since Oct 8 Oct 18 — MALFEX package imgdecode, uploaded September 30, 2026, had 979 downloads and used a Windows DLL to decrypt GitHub shellcode and inject it into dllhost.exe.
Two npm supply-chain paths now cover
Built from 5 signals across 3 sources · 293 items reviewed
Automated vulnerability reporting is forcing open-source security programs to change both intake and release cadence. OpenSSH 10.6 responds to a surge in AI-assisted reports by planning more frequent releases, while Google temporarily stopped accepting product vulnerability reports
Built from 2 signals across 2 sources · 111 items reviewed
Cloudflare’s October 5 announcements show two sides of platform security: expanding cryptographic infrastructure while correcting a storage-isolation failure in Containers and Sandboxes. A Workers Paid customer could recover residual disk blocks from other customers’ containers because reused thin-
Built from 3 signals across 2 sources · 74 items reviewed
CVE-2026-88779 is being exploited in targeted attacks against affected customer-managed Citrix NetScaler ADC and NetScaler Gateway deployments, where it can cause denial of service. Citrix rates the memory overflow flaw 8.7 CVSS and has released security
Built from 3 signals across 3 sources · 74 items reviewed
Attackers exploited Zimbra CVE-2026-73570 before the flaw was publicly disclosed, turning an unauthenticated command-injection bug into mailbox and credential theft. The incident shows that a patch can be available while defenders still lack the disclosure and detection
Built from 3 signals across 3 sources · 105 items reviewed