Security news.
Critical edge infrastructure and developer ecosystems face coordinated pressure today as CISA warns of active exploitation chains targeting Ivanti Connect Secure appliances and GitLab instances. Supply chain threats are also intensifying across software engineering toolchains, highlighted by trojanized AI developer extensions planting persistent SSH backdoors and suspicious hardware implants surfacing in popular cryptocurrency wallets.
Ivanti Connect Secure Flaws Chained for Unauthenticated Root
Threat actors are actively chaining vulnerabilities, including CVE-2026-111357, to gain unauthenticated root access to Ivanti Connect Secure gateways, prompting immediate CISA KEV inclusion.
Max-Severity GitLab RCE Actively Exploited in the Wild
CISA added a maximum-severity integer overflow flaw in GitLab (CVE-2026-97229) to its KEV catalog following active exploitation allowing unauthenticated remote code execution.
Critical Linux Kernel Flaw Exposes MPTCP Servers to Remote Root
Anthropic researchers demonstrated remote code execution as root against servers running Multipath TCP (MPTCP) listeners without requiring authentication.
Trojanized Claude Code Extension Installs Persistent SSH Backdoors
A malicious Claude Code-branded extension hosted on the Cursor IDE marketplace exposed thousands of developers to an infostealer and persistent SSH backdoors.
Chainalysis Discloses Breach via Offensive Agentic AI
Threat actors leveraged offensive agentic techniques to penetrate internal tools at blockchain analytics firm Chainalysis, exposing customer identity data and organization roles.
WordPress Core RCE Draws 63,000 Rapid Exploitation Attempts
Attackers launched widespread automated campaigns against a high-severity remote code execution flaw in WordPress Core versions 4.7 through 7.1.3 immediately following security patch releases.
Trezor Investigates Suspected Hardware Implants in Wallets
Trezor issued a security warning regarding Trezor Safe 5 units sold through a Southeast Asian reseller that reportedly contained rogue cellular circuit boards designed to exfiltrate recovery seeds.
Drupal Warns of Critical Commerce Core Vulnerability Exploited in Wild
Drupal maintainers urged immediate updates for an actively exploited access bypass flaw in the Commerce Core module that allows attackers to manipulate online store orders.