Good morning. Ivanti has shipped the last fix for the Connect Secure attacks we covered in October, and CISA’s deadline for it is today. Scanners are polling for a WordPress bug that opens only during core updates, a tampered Claude Code extension sat in Cursor’s marketplace for 11 hours on Thursday, and Drupal says a Commerce Core flaw is being used against online stores.
Lead Story
Ivanti fixed the root bug in the Connect Secure VPN chain, and CISA lists it as exploited with a November 2 deadline. Get the fixed builds →
Also Worth Your Attention
Attackers are polling for the WordPress update bug we flagged on Thursday, hoping to catch a site mid-update. Block the staging folder →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
A tampered Claude Code extension in Cursor’s marketplace tried to plant an SSH key on developer machines. Run the one-line check →
Drupal says a Commerce Core flaw that can cost stores money is being exploited. Update, then audit orders →
Also on the radar: Canonical fixed a CVSS 10.0 flaw in LXD and MicroCloud that lets anyone who can reach the HTTPS API sign in as a trusted client using only that client’s public certificate; update to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15, or MicroCloud 3.4.1 or 2.1.5 (Ubuntu advisory, The Hacker News). A Linux kernel use-after-free in IPv4 TCP connection setup, present since 4.4, is fixed in 6.12.113, 6.18.56 and 7.2.10 (kernel CVE announcement).
Lining up this week’s patches? Our patch priority checklist ranks exploited, internet-facing systems like the Ivanti VPN ahead of everything else.
Source: CISA KEV addition; Ivanti advisory; Wordfence on WordPress; Cursor security notice; Drupal advisory
Slack paste: Ivanti Connect Secure to 22.8R2.6 / 25.1.1.3 / 25.1.3.1 today and rotate its AD account; block wp-content/upgrade and confirm WordPress 7.1.4; grep authorized_keys for svc-telemetry on Cursor machines; Drupal Commerce Core to 3.3.13 and audit orders.
Go Deeper
- Cybersecurity tools for server checks and log review
- Identity and access management: service accounts, keys and sign-ins
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
