Security news.
Today's security landscape is dominated by active exploitation of enterprise edge infrastructure and critical platform flaws, headlined by CISA warnings for Ivanti and GitLab vulnerabilities. Meanwhile, attackers are aggressively targeting developer workflows, leveraging malicious IDE extensions and agentic AI tooling to compromise environments and harvest cloud credentials. IT teams should prioritize urgent patching for exposed Ivanti devices, WordPress installations, and Linux servers.
Ivanti Connect Secure Zero-Days Chained for Root Access
CISA added two actively exploited vulnerabilities, including CVE-2026-111357, to its KEV catalog after attackers chained them to achieve unauthenticated remote root access.
CISA Warns Max-Severity GitLab RCE Under Active Exploitation
Attackers are actively targeting CVE-2026-97229, an integer overflow flaw allowing unauthenticated remote code execution on exposed GitLab Community and Enterprise editions.
Critical Linux Kernel Vulnerability Enables Remote Root via MPTCP
Researchers developed a working exploit for an unauthenticated flaw allowing attackers to execute commands as root on servers running Multipath TCP listeners.
Fresh WordPress Core RCE Sees 63,000 Exploitation Attempts
A newly patched unauthenticated race condition affecting WordPress Core versions 4.7 through 7.1.3 triggered massive exploitation attempts within 24 hours of disclosure.
Trojanized Claude Code Extension Backdoors Cursor IDEs
A malicious extension masquerading as Anthropic's Claude Code was distributed to thousands of developers via Cursor's marketplace, installing persistent SSH backdoors.
Northflank Cloud Breach Compromises Customer AI Secrets
Cloud host Northflank urges users to rotate all environment credentials and secrets after unauthorized actors breached the platform to abuse customer AI API keys.
Android "SMS of Death" Exploit Drops Unpatched Devices
A proof-of-concept exploit was published for CVE-2026-58882, allowing remote attackers to crash Android devices or disrupt cellular services simply by sending a malicious text message.
TeamViewer Vulnerability Permits Host-to-Viewer Takeover
A patched integer overflow flaw tracked as CVE-2026-111585 allows a compromised or malicious host machine to reverse attack and execute arbitrary code on a connecting technician's system.