Security news.
Critical enterprise software vulnerabilities lead today's brief, highlighted by newly disclosed zero-days in Ivanti Connect Secure gateways and widespread active exploitation of exposed GitLab instances. Development ecosystems and AI tooling are also under intensifying pressure following supply chain attacks targeting Cursor and severe flaws uncovered in Langflow and Canonical's LXD/MicroCloud. Additionally, federal authorities formally attributed the historic $6+ billion Binance crypto heist to North Korea's state-sponsored TraderTraitor group.
Ivanti Connect Secure Zero-Days Actively Chained in Attacks
Ivanti has released security updates addressing two new vulnerabilities (CVE-2026-111357 and CVE-2026-118527) that were added to CISA's KEV catalog after being chained in active zero-day intrusions.
Over 1,000 GitLab Servers Targeted in Active RCE Campaign
Security researchers warn that more than 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution flaw that has already triggered infrastructure rebuilds at organizations like Alpine Linux.
Critical LXD and MicroCloud Flaw Allows Full Cluster Impersonation
A maximum CVSS 10.0 vulnerability in Canonical’s LXD and MicroCloud APIs enables unauthenticated attackers holding a trusted client's public certificate to impersonate users without possessing the corresponding private key.
Critical Flaws in Langflow AI Framework Permit Remote Code Execution
IBM disclosed two critical vulnerabilities affecting all Langflow versions between 1.0.0 and 1.12.8, allowing unauthenticated remote attackers to bypass authentication or execute arbitrary code on host servers.
Cursor Supply Chain Attack Delivers Backdoored Claude Extension
Attackers published a trojanized Claude Code-branded extension within the Cursor IDE marketplace designed to conduct host reconnaissance and establish persistent reverse SSH backdoors.
FBI Links Record $6.3B Binance Heist to North Korea's TraderTraitor
U.S. federal authorities formally attributed the multibillion-dollar breach of Binance to North Korean state-sponsored threat group TraderTraitor, flagging more than 600 cryptocurrency addresses used in laundering operations.
Synology Urges Immediate Updates Amid C3RB3R NAS Ransomware Surge
Synology issued an urgent advisory alerting administrators to update network-attached storage appliances immediately following a wave of attacks actively deploying C3RB3R ransomware.
Teams Help Desk Impersonation Yields Domain Controller Certificates
Threat actors are leveraging Microsoft Teams social engineering to obtain remote PC access and exploit misconfigured Active Directory Certificate Services (AD CS) settings to forge domain-level administrative credentials.