Attackers gained root access to Ivanti VPN appliances and at least 25 Palo Alto Networks firewalls, while a separate Cisco firewall zero-day is being exploited to crash devices. All three vendors have released patches, putting fixes for exposed network equipment at the top of the immediate workload.
Alpine Linux’s GitLab rebuild shows why an upgrade alone does not settle whether a system is safe: its custom image lacked a required Ruby patch, and missing logs left investigators unable to rule out compromise.
Wordfence also blocked more than 60,000 attempts against a WordPress upgrade flaw in 24 hours, though that count does not establish any successful break-ins.
Software add-ons supplied another route into trusted systems: malicious Claude Code packages reached Cursor’s marketplace, and 319 Chrome extensions with an estimated 13.4 million installs routed searches through operator-controlled servers.
The Cursor packages attempted to install an SSH backdoor; the Chrome extensions exposed search queries and let operators link them over time.
Alpine Linux rebuilt its GitLab server and reset all passwords after attackers targeted CVE-2026-97229, a critical remote code execution flaw, on October 20–21. Its custom container image lacked the required Ruby patch despite a GitLab upgrade.
Investigators found no evidence of code execution or package tampering, but missing logs prevented them from ruling out a compromise.
Microsoft will begin retiring Microsoft-provided SMS and voice authentication for Entra ID on February 1, 2027, across Worldwide and Government Community Cloud environments.
Users with another registered sign-in method can use it; those relying solely on SMS or voice must register a passkey after one final phone verification. Customer-managed telecom providers are unaffected.
Malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 were available through Cursor’s extension marketplace for roughly 11 hours on October 29, targeting Windows and macOS users with an attempted SSH backdoor.
The packages collected host data, though code errors and missing administrator rights limited remote login attempts on most hosts. Cursor removed the packages and worked with the hosting provider to disable the attacker’s server.
Ivanti patched two Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, chained in zero-day attacks since at least October 1. The privilege escalation and authenticated file-upload flaws were used alongside CVE-2026-104935, an authentication bypass patched in October.
Volexity linked the attacks to UTA0576, which gained unauthenticated root-level code execution and tampered with logs to evade Ivanti’s Integrity Checker Tool.
CVE-2026-98432 affects IPv4 TCP handling in Linux kernel 4.4 and later and can allow unauthenticated remote code execution under specific conditions. Anthropic reported that its Claude research model produced a root-level exploit against a server with a multipath TCP listener.
Patched kernels are available for several distributions; no vendor advisory had reported attacks in the wild as of October 29.
Wordfence blocked 60,471 attempts in 24 hours to exploit a WordPress Core remote code execution flaw that exposes a temporary installer during full Core upgrades. Unauthenticated attackers must hit a brief race condition to exploit the flaw, which WordPress patched in version 7.1.4 on October 28, 2026. The count reflects blocked requests, not confirmed compromises or individual sites targeted.
Apple notified selected iPhone users in 99 countries that mercenary spyware attacks had targeted them, in a new wave reported October 30, 2026. The alerts identify targeting with high confidence but do not confirm successful infections. Apple did not identify the attackers, spyware product, delivery method or software flaw involved.
Socket identified 319 Chrome extensions with an estimated 13.4 million installs over a decade that hijacked search settings and routed queries through operator-controlled servers. Advertised as PDF converters, manual finders and search tools, the extensions exposed queries to their operators and generated referral payments by forwarding searches to Yahoo or Bing.
Queries were often tied to unique identifiers, allowing operators to link searches over time.
A China-linked hacking group gained root access to at least 25 Palo Alto Networks firewalls by chaining PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel vulnerability. Palo Alto Networks confirmed the attacks and released PAN-OS patches.
Defiant reported more than 77,000 PHP2Shell requests targeting WordPress but no known successful compromises as of October 28.
Attackers are exploiting CVE-2026-76418 in Cisco Secure Firewall ASA and FTD to crash devices through the Remote Access SSL VPN service. The flaw, rated 8.6, lets unauthenticated remote attackers trigger device reloads with crafted requests when secondary authentication is configured on an exposed tunnel group.
Cisco has released patches and identified disabling secondary authentication as a temporary mitigation.
Adobe, Veeam and Juniper Networks patched 39 vulnerabilities, including critical code execution flaws. Adobe fixed eight critical bugs in Campaign Classic, while Veeam addressed a cross-tenant configuration access and remote code execution flaw in Backup for Microsoft 365.
Juniper fixed 18 flaws in Session Smart Router and Session Smart Conductor, including critical unauthenticated command execution and privilege escalation bugs.
