Cyber News

Daily coverage of exploited vulnerabilities, breaches and patches, with what to do first.

Inside the Daily Brief

A real sample of the weekday read

Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores

Ivanti Connect Secure CVE-2026-111357 on CISA KEV due Nov 2, WordPress CVE-2026-119977 upgrade-window attacks, a backdoored Claude Code extension in Cursor and exploited Drupal Commerce Core.
Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

Drupal stores: attackers are using a Commerce Core flaw that can cost you money. Update and audit your orders

Drupal Commerce Core CVE-2026-118539 (SA-CONTRIB-2026-254) is exploited in the wild. Update to 3.3.13 or 8.x-2.41 and audit store orders. Affected versions, checks and sources.
A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

Malicious Anthropic.claude-code 2.1.312 and 2.1.313 in the Cursor marketplace planted an svc-telemetry SSH key and reverse tunnel on Oct 29. How to check, clean up and rotate credentials.

The CyberExperts Daily Brief

Keep up with the cyber news that changes the day

Get the weekday brief for people scanning the news: the developments worth a closer look, explained in about five minutes.

Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

WordPress core CVE-2026-119977 (4.7 to 7.1.3) lets attackers run code during a core update. Wordfence logged tens of thousands of attempts. Fixed releases, wp-content/upgrade block and log checks.
Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Ivanti Connect Secure CVE-2026-111357, the dsinvoked root escalation chained in October attacks, is on CISA KEV due Nov 2. Fixed builds 22.8R2.6, 25.1.1.3, 25.1.3.1 and hunt steps.
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

Cisco ASA and FTD CVE-2026-76418 VPN zero-day on CISA KEV, GitLab CVE-2026-97229 on KEV with an Alpine Linux incident, Synology C3RB3R ransomware and Cisco SD-WAN KeyDrift.
Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Cisco Talos reports UAT-11473 used SD-WAN bypass CVE-2026-20127 to plant KeyDrift, which copies IPsec key material. Fixed releases, files to check and what to rotate.
Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices via DSM flaws CVE-2026-13639 and CVE-2026-13684, fixed Sept 18. Fixed DSM versions, backups and hunt steps.
The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

CISA added GitLab CVE-2026-97229 to KEV on Oct 29 (due Nov 1). Alpine Linux nearly lost its server because GitLab upgrades alone did not patch its Ruby. Versions, Ruby fixes and hunt steps.
Attackers can reboot Cisco firewalls through the VPN login page with one request. Upgrade before Sunday’s deadline

Attackers can reboot Cisco firewalls through the VPN login page with one request. Upgrade before Sunday’s deadline

Cisco ASA and Secure FTD CVE-2026-76418 lets an unauthenticated attacker reload a firewall through the SSL VPN login. Exploited, CISA KEV due Nov 1. Fixed releases and checks.
Thursday’s brief: PHP2Shell attackers root firewalls with a Linux bug, then WordPress 7.1.4, Jenkins and Oracle E-Business Suite

Thursday’s brief: PHP2Shell attackers root firewalls with a Linux bug, then WordPress 7.1.4, Jenkins and Oracle E-Business Suite

Linux Fragnesia CVE-2026-46300 on CISA KEV after a PHP2Shell firewall campaign, WordPress 7.1.4 security fixes, Jenkins 2.588 and Oracle EBS CVE-2026-101767 exploit attempts.
The Oracle E-Business Suite bug we flagged now has attackers testing it. Patch or close the servlet today

The Oracle E-Business Suite bug we flagged now has attackers testing it. Patch or close the servlet today

Defused saw exploit attempts on Oracle E-Business Suite CVE-2026-101767 on Oct 27. Apply the October 2026 CPU or remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.
Jenkins users with basic access could run code on your build server. Upgrade to 2.588 or LTS 2.580.2

Jenkins users with basic access could run code on your build server. Upgrade to 2.588 or LTS 2.580.2

Jenkins Security Advisory 2026-10-28 fixes 15 core flaws, including XStream RCE CVE-2026-117612 and a setup wizard admin race CVE-2026-117618. Upgrade to 2.588 or LTS 2.580.2.