Daily DefSec Brief·Nov 2, 2026·4m

Claude Code extension backdoor on Cursor, Drupal Commerce exploited | Cyber Security News Nov 2

Show notes

1. Exploited Drupal Commerce flaw skips authorization - CVE-2026-118539 - https://www.drupal.org/sa-contrib-2026-254

2. Tampered Claude Code extension hit Cursor users - https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

3. Update: Ivanti VPN needs a second patch - CVE-2026-111357, CVE-2026-118527 - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

4. Fake help desk call led to AD CS takeover - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/

5. Northflank breach: rotate every stored secret - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/

6. TeamViewer host can run code on the viewer - CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/

7. Swapped vendor script drained Polymarket users - https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html

8. Attackers run AI pentest frameworks in intrusions - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/

9. LXD flaw lets a public certificate log you in - CVE-2026-112816 - https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557

10. One text message crashes Android phone service - CVE-2026-58882 - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/

11. Email to Request Tracker can hijack the reader - CVE-2026-105454, CVE-2026-105455, CVE-2026-105456 - https://cert.pl/en/posts/2026/10/CVE-2026-105454/

12. n0n ransomware got in on stolen credentials - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754

13. GCHQ can't account for thousands of drives - https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices

← Previous

GitLab RCE now exploited, Linux kernel remote root | Cyber Security News Oct 30

Every version and fix here was checked against the vendor's advisory or the researcher's write-up before it aired. Today's question: Who approves your developers' editor extensions? Reply in the comments or at [email protected] . 1. Exploited Drupal Commerce flaw skips authorization - CVE-2026-118539 - https://www.drupal.org/sa-contrib-2026-254 2. Tampered Claude Code extension hit Cursor users - https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/ 3. Update: Ivanti VPN needs a second patch - CVE-2026-111357, CVE-2026-118527 - https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 4. Fake help desk call led to AD CS takeover - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ 5. Northflank breach: rotate every stored secret - https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/ 6. TeamViewer host can run code on the viewer - CVE-2026-111585, CVE-2026-92372, CVE-2026-92374 - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/ 7. Swapped vendor script drained Polymarket users - https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html 8. Attackers run AI pentest frameworks in intrusions - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/ 9. LXD flaw lets a public certificate log you in - CVE-2026-112816 - https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557 10. One text message crashes Android phone service - CVE-2026-58882 - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ 11. Email to Request Tracker can hijack the reader - CVE-2026-105454, CVE-2026-105455, CVE-2026-105456 - https://cert.pl/en/posts/2026/10/CVE-2026-105454/ 12. n0n ransomware got in on stolen credentials - https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754 13. GCHQ can't account for thousands of drives - https://therecord.media/gchq-cannot-account-for-thousands-of-data-devices