Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
8 stories match your filters.
A fake Claude Code 2.1.313 on Cursor's extension marketplace added an attacker SSH key, persistence and a reverse tunnel on up to 5,000 developer machines on Oct. 29. Update to 2.1.314 and check for the 'svc-telemetry' key.
NebuSec says answering a Telegram voice call could let an attacker run code on Android in versions 8.6.2 to 12.10.3. It's fixed in 12.10.4; Telegram disputes the risk and no CVE was assigned.
CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.
CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
LiteLLM says a master key leaked on GitHub in May and never revoked let an attacker steal maintainer tokens and ship a backdoored 1.107.0 to PyPI, Docker Hub and GHCR.
Node.js fixed an out-of-bounds write in its bundled Brotli decoder (CVE-2026-111497) that it says could allow remote code execution on 22.x, 24.x and 26.x. End-of-life versions get no patch.
Symantec says Russia's APT28 breached a naval shipbuilder, a law enforcement agency and an aircraft-engine maker in two NATO countries, using the HOOKEDGE backdoor and a previously unseen reflective loader.