Security news.
Active zero-day exploitation and developer ecosystem compromises dominate today's briefing, led by confirmed supply chain tampering in the Cursor extension marketplace and active attacks targeting Check Point gateways. Federal authorities also flagged exploited bugs across core enterprise infrastructure, while international operations struck back against major cryptocurrency theft campaigns and malware distribution networks.
Cursor Marketplace Breach Distributes Malicious Extension
Cursor confirmed attackers leveraged compromised Fireworks AI credentials to publish a malicious Claude Code extension to its marketplace.
Check Point Warns of Zero-Day Exploit for Root Access
Threat actors are actively exploiting a high-severity flaw and chaining it with PHP2Shell to deploy backdoors and wipe VMware ESXi environments, prompting emergency hotfixes.
CISA Adds Actively Exploited UnrealIRCd Flaw to KEV
CISA added CVE-2026-114713, an improper delimiter neutralization flaw enabling server-level command injection in UnrealIRCd servers, to its Known Exploited Vulnerabilities catalog.
PostgreSQL Fixes 52 Flaws Including 22-Year-Old RCE Bug
Security updates address a CVSS 8.8 type confusion vulnerability (CVE-2026-6460) allowing authenticated users to execute code on the server, requiring administrators to rebuild C-language extensions.
US Disrupts $400M North Korean FaceStealer Crypto Ring
Coordinated federal actions disrupted a North Korean social engineering campaign that utilized deepfake video calls to siphon more than $400 million in digital assets.
Operation Endgame Dismantles Gootloader and StealC Infrastructure
International law enforcement seized 235 servers and 257 domains behind Gootloader, CastleRAT, and StealC, recovering 6.4 million stolen credentials.
Hardware Implants Found in Trezor Safe 5 Crypto Wallets
Trezor confirmed that select Safe 5 units sold by a third-party reseller contained malicious hardware additions designed to exfiltrate recovery seed phrases via cellular networks.
Citrix Patches 10 Critical Flaws Across NetScaler Appliances
Citrix issued security advisories resolving 10 high-impact vulnerabilities across NetScaler ADC and Gateway that could cause severe system disruption or denial-of-service conditions.