Ivanti Connect Secure flaws chained for unauthenticated root, two added to KEV
On the radar
05 TOP STORIESThe Hacker News · 4 min read
Ivanti Connect Secure flaws chained for unauthenticated root, two added to KEV
CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog. The Hacker News reports attackers chain three Ivanti Connect Secure flaws to get unauthenticated root access. These are internet-facing VPN appliances, so exposed instances need patching and a compromise check now.
TechCrunch · 4 min read
North Korea blamed for $6.3B Binance theft carried out in 20 minutes
Blockchain intelligence firms attribute the record $6.3B theft to North Korean actors, and TechCrunch says the entry point was a compromised employee laptop. Wired reports the heist took about 20 minutes, and Ars Technica says Binance froze funds. This confirms the endpoint-compromise root cause and puts a state actor behind it.
BleepingComputer · 4 min read
Backdoored Claude Code extension was on Cursor's marketplace, not Open VSX
BleepingComputer says a malicious fake Claude Code extension on Cursor's marketplace planted SSH backdoors on up to 5,000 developers' machines in about 11 hours. Ars Technica says it shipped through Cursor's verified account for nearly 12 hours. The Register reports Anthropic disputes responsibility and that the extension's publisher blames a supply-chain attack on Cursor. Anyone who installed it in that window should treat the host as compromised.
BleepingComputer · 4 min read
Anthropic researchers built working remote-root exploit for Linux MPTCP flaw
The kernel flaw is a use-after-free in multipath TCP that can leak kernel memory or allow buffer overflow, and it is now patched. BleepingComputer says unauthenticated attackers could run commands as root on MPTCP servers. The exploit was developed by Anthropic researchers, and the summaries report no in-the-wild exploitation. Servers with MPTCP enabled should take the kernel update.
TechCrunch · 2 min read
AI cost fears hit tech stocks as Anthropic faces expected junk rating
The FT reports credit agencies are expected to give Anthropic a high-yield 'junk' rating after its IPO, and Blackstone says it may not reach investment grade. The BBC reports US tech stocks fell sharply on AI infrastructure cost fears, and the WSJ reports OpenAI raised less than half of its $30B target. Together these suggest financing, not demand, is the pressure point for AI spending.
Go a little deeper
EXPLORE BY TOPIC- 36 articles
Cyber security
Beyond the top stories, the day was dominated by a run of vendor and platform incident disclosures, mostly with little detail yet. Mass exploitation of a freshly patched WordPress flaw and AI-assisted attack tooling also stand out.
Read 8 updates - 32 articles
Tech industry
Money dominated: AI financing doubts, Intel's slide and a data center loan deal. Regulation and privacy produced two concrete numbers, a GM settlement and a French data levy.
Read 8 updates - 14 articles
AI
Policy and economics outweighed product news. Congress and the Vatican weighed in, and an Oxford-linked study and an SRE essay questioned how AI is paying off at work. Google ran a model in orbit.
Read 7 updates - 21 articles
IT & infrastructure
A quiet release day. The notable item is PostgreSQL 19 slipping because of AI-generated reports and patches. Routine kernel, Wine, Wireshark and Ubuntu cycle news filled out the rest.
Read 8 updates