> infrastructure security
for people who build things
Tracking vulnerabilities, supply chain attacks, and threat intelligence that matters to engineers running real infrastructure.
Cursor Traces Backdoored Claude Code Extension to a Leaked Fireworks AI Key
Cursor's incident update says a key it issued to inference provider Fireworks AI exposed agent traces with credentials, which let an attacker plant trojanized Claude Code 2.1.312/2.1.313 builds with an SSH reverse-tunnel backdoor in Cursor's extension marketplace.
SCKit: Blank RMM+ Access Key Lets Attackers Push Rogue ScreenConnect Clients to Nearly 500 MSP-Managed Hosts
A third-party ScreenConnect extension, RMM+ 1.0.31-1.0.32, accepted an empty access key. Attackers used it to run SCKit through Run Command on 288 hosts in 90 minutes, then hit 205 more on November 13 from new infrastructure.
Check Point Gaia CVE-2026-123039: DynamicCLI Root Zero-Day Chained With PHP2Shell to Backdoor Gateways and Wipe ESXi
Attackers used PHP2Shell against Check Point Mobile Access portals, then an unauthenticated root socket in Gaia's DynamicCLI daemon (CVE-2026-123039), to backdoor gateways and wipe VMware ESXi hosts. Install the November Jumbo Hotfix and hunt for compromise.
Barracuda ESG CVE-2026-116606 + CVE-2026-111560: Pre-Auth Root Chain Now Exploited, CISA KEV Deadline Today
Barracuda confirms exploitation of an ESG authorization bypass chained with a root command injection; CISA added both to KEV with a November 13 federal deadline.
N-able N-central Under Siege: 4EverAble2Shell and Agent2Shell Bypass Hotfix 2 Days After the Able2Shell Zero-Day Dump
A researcher's Able2Shell dump of 33 alleged N-central zero-days forced N-able to take its hosted RMM cloud offline; new 4EverAble2Shell (root RCE) and Agent2Shell (SYSTEM on managed Windows endpoints) chains reportedly defeat the November 10 Hotfix 2.
wfx-loot: 4,800 Hijacked GitHub Accounts Push a CI Secret Stealer That Deletes Its Own Workflow Runs
A campaign that started November 10 used thousands of compromised GitHub accounts to inject a GitHub Actions secret stealer into tens of thousands of repos. It reverts its commit and deletes the run log within about a minute, so the main trace left is a gap in run numbers.
Cisco BroadWorks CVE-2026-20320 XXE Added to KEV After Jailbroken AI Agent Used It to Breach a European Telco
CISA lists Cisco BroadWorks CVE-2026-20320, a blind XXE in the OCI XML parser, as exploited after Malbear Labs tied it to an autonomous AI-driven intrusion at a European telecom provider.
Xen Orchestra VSA-2026-062: Empty-Object Cookie Auth Bypass Exploited to Take Over XCP-ng Pools
Vates warns that a critical Xen Orchestra auth bypass, triggered by a single crafted cookie, is being exploited to gain admin access and root on managed XCP-ng hosts.
Checked Is Not Used: Four Bugs in Two Weeks Where the Verified Thing Wasn't the Thing That Ran
APT, LXD, WordPress and SonicWall all shipped fixes this month for the same design error: a security check performed on one object or path, and an action taken on another. Here is how to find that gap in your own estate.
CVE-2026-19868: SonicWall SonicOS SSL-VPN SAML Bypass Exploited in the Wild, CISA Deadline November 20
SonicWall patched an actively exploited SonicOS SSL-VPN flaw that lets attackers with valid credentials sidestep SAML-enforced MFA; CISA added it to KEV on November 6.
OpenSSH 'sshole' CVE-2026-123158: A Long Password Walks Past Authentication on Alpine and musl Systems
OpenSSH 10.6p2 ships an emergency workaround for a password-authentication bypass on musl-based, non-PAM builds such as Alpine Linux; a 257-byte-plus password can log in to accounts that have no password set.
CVE-2026-109518: APT Retry Logic Lets On-Path Attackers Swap a Verified Package and Run Code as Root
A flaw in APT's download retry and hard-link handling lets a network attacker replace a package after signature verification, yielding root code execution on Debian and Ubuntu. Patches are out.
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypassed the CVE-2026-7273 Patch and Hit Nearly 1,000 Switches
Binarly found that attacks on ~1,000 Zyxel GS1900 switches used a separate CGI out-of-bounds write, CVE-2026-107441, that defeats the earlier CVE-2026-7273 fix; Zyxel's new firmware is out.
Siemens SIMATIC IoT2050 CVE-2026-58115: Unauthenticated Node-RED Editor Exploited to Drop Linux Bots and Persistent Webshells
VulnCheck reports in-the-wild exploitation of CVSS 10.0 CVE-2026-58115, where Siemens SIMATIC IoT2050 Advanced gateways expose an unauthenticated Node-RED editor, since October 30.
WordPress Core CVE-2026-119977: Upgrade-Window Race Condition Gives Unauthenticated RCE, Added to CISA KEV
CISA added WordPress Core's CVE-2026-119977, a TOCTOU race in the full-package upgrade process affecting 4.7 through 7.1.3, to KEV on November 3; federal agencies must patch to 7.1.4 by November 6.
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: The Missing Privilege Escalation Zero-Days in the UTA0576 Root Chain Are Patched
Ivanti has patched the two remaining Connect Secure zero-days that UTA0576 chained with the CVE-2026-104935 auth bypass to reach root; both are in CISA KEV.
Canonical LXD CVE-2026-112816: mTLS Certificate-Chain Flaw Lets Attackers Impersonate Any Trusted Client (CVSS 4.0 10.0)
Canonical patched a CVSS 4.0 10.0 improper certificate validation bug in the LXD HTTPS listener that lets an attacker authenticate as any trusted client via a crafted certificate chain; MicroCloud is affected too.
CVE-2026-118539: Drupal Commerce Core Access Bypass Exploited in the Wild Against Online Stores
Drupal rates SA-CONTRIB-2026-254 'highly critical' and confirms active exploitation of an unauthenticated access bypass in Commerce Core (CVE-2026-118539); fixes are in 3.3.13 and 8.x-2.41.
No Exploit Required: October 2026 Was Four Stolen-Credential Breaches in a Trench Coat
LiteLLM, Gheist, UpdraftCentral, and Railway had no common CVE, but one common root cause: long-lived, over-scoped credentials sitting where attackers could reach them. A trend analysis, and the controls that would have changed each outcome.
EDK II PXE Flaw (CVE-2026-97631): One Oversized ICMP Error Corrupts Server Firmware Before the OS Loads
A CVSS 9.5 buffer overflow in TianoCore EDK II's PXE driver lets an unauthenticated network attacker corrupt memory in the DXE phase of a booting server, ahead of Secure Boot and any OS controls.