63 thousand attacks on WordPress; Microsoft reissues .NET patch
Fixed flaw remained exploitable in Alpine's GitLab and mass attacks target the WordPress update window.
The 30-second summary
- Microsoft reissues .NET fix for Node2Shell: two October 13 patches did not close the Brotli decoder flaw.
- Issuers froze about US$ 2 billion in stablecoins stolen from Binance; total theft estimate exceeds US$ 5.6 billion.
- Almost 63 thousand attack attempts in 24 hours target the WordPress update window; no breach confirmed.
- CISA confirms Ivanti flaws in attacks and sets November 2 and 13 deadlines for Connect Secure.
- Alpine's GitLab remained exposed after update: the flaw was in Ruby, with no fix on the server.
Microsoft reissues emergency .NET fix for Node2Shell
Microsoft reissued .NET fixes for the Node2Shell flaw in Google's Brotli decoder, after admitting that two October 13 fixes were incomplete. The flaw already has active exploitation confirmed by CISA (the US government cybersecurity agency).
The flaw affects an extensive list of software: Node.js, Bun, Python.NET packages, PowerShell and the Envoy and Istio proxies. A successful attack allows executing code on the server, without login, on any system that decompresses malicious data.
For the technical team
Out-of-bounds write in the Brotli decoder (CVE-2026-111497, CVSS 9.2): malicious compressed data corrupts memory and allows unauthenticated RCE in services that decompress traffic. Microsoft reissued the October 25 updates because two October 13 fixes were incomplete. Active exploitation confirmed by CISA, with KEV deadline on November 10.
- CVE
- CVE-2026-111497
- Affected
- Brotli 1.0.3 to 1.2.0; Node.js 22.x, 24.x, 26.x and EOL lines (20.x, 23.x, 25.x); Bun before 1.4.4; .NET 8.0 to 11 RC; Visual Studio 2019/2022/2026; PowerShell 7.4 to 7.6; Envoy and Istio with Brotli decompression; Python packages Brotli and brotlicffi
- Exploitation
- confirmed active
- Fix
- Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4; Brotli 1.2.1; .NET 8.0.33, 9.0.22, 10.0.14 and 11 RC3; PowerShell 7.4.22, 7.5.13, 7.6.9; restart services and rebuild container images on a patched base
Takeaway: An applied patch can be incomplete; only retesting shows whether the flaw truly closed.
Sources: Microsoft, The Hacker News, @IntCyberDigest, @BleepinComputer
On the radarFollow this incident live →Issuers freeze about US$ 2 billion from the Binance theft
Stablecoin issuers froze about US$ 2 billion linked to the theft of Binance wallets, the world's largest cryptocurrency exchange. Real-time estimates of the attack, on October 29, rose from US$ 2.8 billion to more than US$ 5.6 billion.
Part of the money remains with the attackers. Researcher pashov considers it likely that the other tokens listed on Binance will be sold, which may pressure prices; founder Changpeng Zhao confirmed that the company "appears" to have been breached.
For the technical team
Binance wallet drainage recorded on October 29, with real-time estimates that rose from US$ 2.8 billion to more than US$ 5.6 billion. Tether and Circle froze about US$ 2 billion in USDC/USDT. Movement traceable on blockchain with the Arkham tool; vxunderground reports a near-simultaneous compromise of Polymarket.
- Affected
- Binance exchange wallets (initial vector not reported in the sources)
- Exploitation
- not reported in the sources
- Fix
- not reported in the sources
Takeaway: Money in a hot wallet leaves in minutes; control over who approves the transaction defines the size of the loss.
Sources: @vxunderground, @WatcherGuru, @CryptoMichNL, @pashov
On the radarFollow this incident live →PHP2Shell hit a few hundred victims, researcher estimates
The wave of attacks with the PHP2Shell flaws compromised firewalls at about two dozen targets, and a researcher estimates a few hundred victims in total. The number is small compared with the millions of vulnerable PHP servers.
Exploitation requires the target to match exactly the exploit built by the attacker, which limits the reach for now. Japan's incident response center (JPCERT) published an advisory with the fixed versions, including Ubuntu and Red Hat packages.
For the technical team
CVE-2026-109618 and CVE-2026-109619: unauthenticated RCE in PHP, chainable with privilege escalation in the Linux kernel and flaws in Palo Alto management interfaces. Active exploitation confirmed; exploits depend on the target's specific build, which explains the limited number of victims.
- CVE
- CVE-2026-109618, CVE-2026-109619
- Affected
- PHP 5.4 to 8.5.11 in all branches serving web; 8.1 and earlier without a fix from the PHP project; more than 22.6 million exposed instances, according to SecurityWeek
- Exploitation
- confirmed active
- Fix
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; vendor packages from Ubuntu (22.04 and 24.04) and RHEL 9 (RHSA-2026:87151, backport keeps version 8.0.30); also patch the kernel and PAN-OS
Sources: JPCERT/CC, TechCrunch Security
On the radarFollow this incident live →Almost 63 thousand attempts target WordPress flaw in 24 hours
Attackers made almost 63 thousand attempts in 24 hours against the WordPress remote code execution flaw, fixed on October 28 in version 7.1.4. The flaw exploits the window of seconds while the system updates itself.
Wordfence telemetry recorded more than 18.5 thousand requests in 21 hours, the first one nine minutes after the firewall rule. No successful breach was confirmed, but sites between 4.7 and 7.1.3 remain exposed without the patch.
For the technical team
Unauthenticated race condition in the core upgrade process exposes a predictable path of the temporary installer and may allow RCE if the attacker hits the window. No CVE assigned; official severity low, third parties assign CVSS 8.1 and 9.0. Wordfence recorded 18,527+ requests in 21 hours, with no confirmed compromise.
- Affected
- WordPress Core 4.7 to 7.1.3; versions 4.6 and earlier without a security update
- Exploitation
- not observed
- Fix
- WordPress 7.1.4 and security releases for branches 4.7 to 7.0; investigate suspicious PHP requests in wp-content/upgrade
Takeaway: The update window is a target monitored in real time; applying and checking the patch the same day reduces exposure.
Sources: The Hacker News, @DarkWebInformer, SecurityWeek
On the radarFollow this incident live →Cursor restores marketplace after backdoor in Claude Code extension
Cursor took the marketplace offline, neutralized the malware together with providers and restored it, after distribution of a modified version of the Claude Code extension with an SSH backdoor, remote attacker access to the machine, for about 11 hours. The impact reaches at most 5,000 users.
Updating alone does not clean the machine, Cursor warns: the attacker's SSH key and the persistence scripts must be removed. Because the extension ran with the developer's permissions, the code and credentials of whoever installed it must be treated as exposed.
For the technical team
Build 2.1.313 of the Claude Code extension, trojanized and not developed by Anthropic, distributed through the Cursor marketplace on October 29 for about 11 hours. Malicious loader installs a persistent SSH backdoor, adds the attacker's key and sends host data. The origin of the packaging under a legitimate identity remains unclear, according to The Hacker News.
- Affected
- Claude Code extension for VS Code 2.1.313 distributed through the Cursor marketplace, in the 11-hour window on October 29
- Exploitation
- confirmed active
- Fix
- Update to 2.1.314; on machines with 2.1.313, remove the attacker's SSH key (comment svc-telemetry) and the persistence artifacts, because updating alone is not enough
Sources: @cursor_ai, The Hacker News, @TheHackersNews
On the radarFollow this incident live →CISA confirms exploitation of chained flaws in Ivanti Connect Secure
CISA confirmed attacks on two Ivanti Connect Secure flaws, a corporate remote access solution, and added them to the KEV list of flaws already used in attacks. The flaws allow malicious file upload by an authenticated remote user and local privilege escalation.
The two flaws chain with a third, which widens the damage. Federal deadlines: November 2 for the escalation and 13 for the upload. Use in ransomware is unknown, and CISA asks for an assessment of each asset's exposure to the internet.
For the technical team
CVE-2026-118527: predictable identifier generation allows an authenticated remote attacker to write files with controlled content to a known location. CVE-2026-111357: missing authentication in a critical function allows privilege escalation to an authenticated local user. Both chainable with CVE-2026-104935; KEV requires forensic triage per BOD 26-04.
- CVE
- CVE-2026-118527, CVE-2026-111357, CVE-2026-104935
- Affected
- Ivanti Connect Secure (versions not reported in the sources)
- Exploitation
- confirmed active
- Fix
- Apply mitigations per the vendor's instructions and follow CISA directive BOD 26-04, including forensic triage; for cloud services, follow the applicable guidance or discontinue the product
Sources: CISA KEV 1, CISA KEV 2
On the radarFollow this incident live →GitLab update was not enough: flaw stayed alive in the server's Ruby
An attacker tried to break into the Alpine Linux project's GitLab through the already-fixed CVSS 10 flaw, and the server remained vulnerable: the GitLab update did not fix Ruby, where the flaw is located. There is no proof of success, and the server was rebuilt.
CISA already confirms active exploitation of this flaw, which gives remote code execution without a password from a malicious regular expression in CI/CD configuration, with a federal deadline on November 1. Instances with their own Ruby require a double patch.
For the technical team
CVE-2026-97229 (CVSS 10.0): integer overflow in the CI/CD regular expression compiler (Ruby's Onigmo engine) allows unauthenticated RCE in self-managed GitLab CE/EE. Attempt against Alpine's GitLab on October 20 and 21, after the upgrade; Ruby remained unfixed. Alpine rebuilt the server and reset all passwords.
- CVE
- CVE-2026-97229
- Affected
- Self-managed GitLab CE/EE; fixed in 19.4.2, 19.3.5 and 19.2.8; other Ruby applications with the same engine may be affected, according to CISA
- Exploitation
- confirmed active
- Fix
- Update GitLab (Alpine used 19.3.6) and, on installations with their own Ruby, also Ruby 3.3.13, 3.4.12, 4.0.9 or later
Takeaway: A patch on the application may not reach the embedded library; only verification afterward confirms.
Sources: The Hacker News, @TheHackersNews, CISA KEV, @DailyDarkWeb
On the radarFollow this incident live →Fake models on Hugging Face hijack GPUs for mining
A malware campaign returned to Hugging Face, an AI model platform, with 31 malicious repositories in seven accounts posing as Qwen2 test models. Downloads total 29,818 records, a number measured by Pluto Security, with no confirmed victims.
The files install a cryptocurrency miner hidden in the GPU and, in some builds, remote attacker access. The targets are self-hosted AI servers, rented GPU machines and CI jobs; platform scanners returned clean on the main payload.
For the technical team
Load/Mine campaign, named by Pluto Security: fake Qwen2 models execute attacker code via trust_remote_code=True before loading the weights. Payload is a GPU cryptominer hidden as a kernel worker; some builds add reverse shells. A second wave appeared days after the first was removed, with new accounts.
- Affected
- Users who loaded models from the malicious accounts with code execution enabled; Xinference and GPUStack infrastructures cited as targets
- Exploitation
- confirmed active
- Fix
- Pin audited revisions and review the code before enabling custom code; avoid trust_remote_code=True without audit; look for kernel worker processes with abnormal GPU use on AI servers and CI jobs
Takeaway: Downloading a model with embedded code without review is executing a stranger's code on your server.
Sources: @BleepinComputer, @DailyDarkWeb
On the radarFollow this incident live →Drupal publishes Commerce Core fixes and asks for order audit
Drupal published the fixed versions of the authorization flaw in Commerce Core, an online store module used on more than 42,000 sites, and recommended an audit of all orders. Active exploitation was confirmed by the project itself.
The access bypass applies to attackers without login, in any configuration of the module, and the advisory mentions possible financial impact on the seller. Drupal did not detail how the attacks occur or how many sites were affected.
For the technical team
CVE-2026-118539: missing authorization in Commerce Core allows access control bypass by an unauthenticated attacker, in any configuration of the module. Exploitation confirmed ongoing, with no details of vector or scale. Part of a batch of 38 advisories published by Drupal on October 28, nearly a dozen of them critical.
- CVE
- CVE-2026-118539
- Affected
- Commerce Core from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13
- Exploitation
- confirmed active
- Fix
- Update to 8.x-2.41 or 3.3.13 and audit orders for inconsistencies; review the other Drupal advisories from October 28
Sources: The Hacker News, @TheHackersNews, SecurityWeek
On the radarFollow this incident live →Wrapping up
Today's pattern is the incomplete fix: .NET needed a second patch, Alpine's GitLab remained exposed with Ruby unfixed and the Cursor extension required cleanup beyond the update. Meanwhile, attackers monitor these gaps, with 63 thousand attempts against the WordPress update window. Applying a patch quickly only protects when someone then checks whether the flaw closed.
Was your company's latest patch checked, or only applied?
A good part of the flaws in this edition remained open after the fix, and only a later test revealed it.
Talk to us