Today's cybersecurity landscape highlights several critical vulnerabilities, with actively exploited flaws in widely used platforms like WordPress, Drupal, and GitLab. We also saw major security incidents, including a significant cryptocurrency breach and warnings about compromised hardware wallets.
Actively Exploited Vulnerabilities in WordPress, Drupal, and GitLabVulnerability
Multiple high-severity vulnerabilities are currently being exploited in the wild across popular web platforms. WordPress Core versions 4.7 through 7.1.3 contain a remote code execution (RCE) flaw, attracting nearly 63,000 attack attempts within 24 hours of patch release. Drupal Commerce Core also faces active exploitation for a critical authorization bypass vulnerability (CVE-2026-118539), affecting versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Additionally, CISA has added a maximum-severity GitLab RCE flaw (CVE-2026-97229) to its Known Exploited Vulnerabilities catalog, urging immediate patching.
Why it matters: If your website or development environment uses these platforms, update immediately to the latest versions to prevent attackers from gaining control.
Read more at The Hacker News ↗
ChatGPT Share Link Flaw Could Expose Private ChatsVulnerability
Researchers discovered a critical flaw in ChatGPT where a malicious share link could execute attacker-controlled code within a user's logged-in session, potentially allowing access to private conversations. OpenAI addressed this P1-rated vulnerability, its most severe category, just eight days after it was reported through their bug bounty program.
Why it matters: Always be cautious when clicking on shared links, even from seemingly legitimate sources, as they could compromise your active online sessions.
Read more at The Hacker News ↗
Binance Suffers $6.3 Billion Crypto Theft Due to Compromised LaptopBreach
Cryptocurrency exchange Binance reported a 'security incident' resulting in the theft of approximately $6.3 billion in assets, with nearly $3 billion frozen on-chain. Investigations suggest the breach originated from a compromised DevOps engineer's laptop, and blockchain analysts are linking the incident to North Korean hacking groups.
Why it matters: Even large organizations are vulnerable to supply chain attacks; businesses must implement stringent security measures for all employee devices and accounts, especially those with high-level access.
Read more at The Hacker News ↗
Warning Issued for Compromised Trezor Hardware WalletsOther
Trezor has issued a warning after a customer reported a Trezor Safe 5 hardware wallet, purchased from reseller CryptoBilis, contained an unauthorized circuit board designed to transmit recovery phrases over a mobile network. Trezor advises all customers who bought devices from CryptoBilis since March 2026 to transfer their funds to new wallets with new recovery phrases.
Why it matters: When purchasing sensitive hardware like security keys or crypto wallets, always buy directly from the manufacturer or authorized, highly trusted resellers to avoid supply chain tampering.
Read more at The Hacker News ↗
Malicious Claude Code Extension Planted SSH BackdoorsThreat
A trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace, attempting to install persistent SSH backdoors on affected systems. This malicious update, version 2.1.313, was distributed under the legitimate publisher's identity, affecting up to 5,000 developers and leading Cursor to temporarily shut down its marketplace.
Why it matters: Carefully scrutinize all software extensions, even those from official marketplaces, and ensure your development environment has robust security to detect and block unauthorized network connections.
Read more at The Hacker News ↗
Critical Linux Kernel Flaw Allows Remote Root Attacks on MPTCP ServersVulnerability
Security researchers have identified and exploited a critical Linux kernel vulnerability that allows unauthenticated attackers to achieve remote code execution as root on servers running Multipath TCP (MPTCP) listeners. This flaw presents a severe risk to affected systems.
Why it matters: Ensure your Linux servers, especially those utilizing MPTCP, are promptly updated with the latest kernel patches to prevent remote attackers from taking full control.
Read more at BleepingComputer ↗
TeamViewer Flaw Allows Controlled Machines to Attack the ControllerVulnerability
TeamViewer has patched a flaw (CVE-2026-111585) where a malicious or compromised 'host' machine, being remotely controlled, could exploit an integer overflow to attack the 'viewer' machine that initiated the connection. This could lead to the viewer's TeamViewer application crashing and potentially remote code execution depending on the platform.
Why it matters: If you use TeamViewer for remote support, ensure your software is updated and exercise caution when connecting to unverified or potentially compromised remote systems.
Read more at The Hacker News ↗
Chinese Hackers Employ AI-Powered ARTEX FrameworkThreat
Chinese state-sponsored threat actors, tracked as 'Vapor Panda' (formerly VexatiousTemper) by CrowdStrike, are now using a Go-based, AI-powered penetration testing framework named ARTEX. This sophisticated tool is being deployed in targeted attacks against numerous high-value organizations globally.
Why it matters: Nation-state actors are continually enhancing their tools, including leveraging AI. Small businesses should maintain robust defenses, including advanced endpoint detection, to protect against increasingly sophisticated threats.
Read more at The Hacker News ↗
Cloudflare Reports Significant Increase in DDoS AttacksOther
Cloudflare observed a 38% increase in network-layer DDoS attacks in Q3 2026, autonomously mitigating 18.2 million such attacks and 14.4 trillion HTTP DDoS requests. This translates to approximately 8,226 network-layer attacks per hour, highlighting a growing trend in denial-of-service activity.
Why it matters: DDoS attacks can disrupt online services for any business. Ensure your website and infrastructure have adequate DDoS protection to maintain availability.
Read more at The Hacker News ↗
Syrian Hacker Sentenced for Market-Moving Fake TweetOther
Ahmad Umar Agha, known as 'Th3Pr0' from the Syrian Electronic Army, received a 42-month prison sentence in the U.S. for his involvement in a hacking conspiracy targeting Western news outlets. His actions included a fake tweet that triggered a $136 billion stock market drop.
Why it matters: Cyberattacks can have far-reaching financial and reputational consequences. Businesses must verify the authenticity of critical information, especially from social media, before making decisions.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.