From us: We just got back from OWASP Global AppSec USA in San Francisco, where we showed how Pixee works as your purple team, with four agents for design review, threat modeling and detection, triage, and fixes. That included launching Pixee Beacon, a vulnerability-finding agent that builds a threat model from your code, follows the paths an attacker would take and tries to disprove every lead.
KEV kept filling up this week, with GitLab and Ivanti among the additions, even as Microsoft found that only about 0.5% of CVEs ever get used in an attack. Last week we put Anthropic's report of a lab model chaining exploits in our reading list. This week CrowdStrike and Google caught an agent framework, ARTEX, in real intrusions, and CrowdStrike counted 200+ organizations targeted. An agent doesn't need a zero-day when keys from a 2022 directory export still work.
On October 29, CrowdStrike reported that VAPOR PANDA, a China-nexus group, turned ARTEX on more than 200 organizations starting October 17, with a single controller hitting targets in at least 14 countries over 11 days. CrowdStrike confirmed post-exploitation at 9 of them and password spraying or credential scanning against at least 12 more.
The planners ran mainly on DeepSeek models, and one intrusion consumed roughly 1.4 billion input tokens. A human operator stepped in at decision points, and the agent transcripts are in Chinese.
CrowdStrike calls the campaign "an escalation in China-nexus use of AI agents." CrowdStrike names no CVEs. ARTEX got in with an unsigned SAML assertion paired with XXE, an unauthenticated orchestration service that reached root inside a container, keys from a 2022 directory export, VPN configs sitting in sent mail, and password spraying.
Google's Threat Intelligence Group and Mandiant published their own account on October 30. ARTEX is written in Go, with six sub-agents and a Next.js console, and GTIG has tracked it and similar frameworks in use since late August. It tracks one campaign as UNC7228, which overlaps Microsoft's STORM-0940. That actor typically gets from a first compromised account to deep system access in about four hours, and once did it in 15 minutes.
It planted webshells by writing MySQL general logs with a .jsp extension, iterating whenever the page failed to compile. GTIG calls it noisy, with 240 log events in one intrusion and command traffic over 491 rotating webhook.site URLs. The creator pulled the repository in October over abuse, but forks named ScopeWeaver and ARTEX PRO live on, and Microsoft reported on October 29 that two North Korean groups, Onyx Sleet and Pearl Sleet, have used ARTEX since late October. GTIG expects noisy multi-agent attacks with no human in the loop within one to three months.
At one pharmaceutical company, the operator told ARTEX's agents to find Windows machines without CrowdStrike's Falcon sensor, judging by process and folder listings. CrowdStrike says that let the operator concentrate on unprotected hosts, and the machines in your asset inventory that never show up in the EDR console are that list.
From early morning to early afternoon Pacific time on October 29, Cursor's extension marketplace served versions 2.1.312 and 2.1.313 of anthropic.claude-code for Windows and macOS that were "not developed by Anthropic," according to Cursor's security notice. The build collected the hostname, username, environment variable names and Git email address. It then tried to add its own SSH key, turn on the SSH server and open a reverse tunnel to 134.209.82.225, with a persistence mechanism that retried about every 60 seconds.
Cursor shut the marketplace down, rebuilt it and rotated keys. The notice doesn't say how many developers installed the bad versions. Microsoft published its own analysis of the backdoor on October 30.
StepSecurity compared the bytes and found a 7,386-byte loader prepended to Anthropic's clean 2.1.312 bundle. Cursor's 2.1.312 and the clean 2.1.312 on Open VSX carry the same version number and are different files.
It's the second week in a row that a trusted channel shipped malware to AI developers, after the LiteLLM 1.107.0 release on PyPI we covered last week. This one arrived through the marketplace built into the editor, under a publisher name developers already trusted.
A machine that took the bad build keeps its svc-telemetry SSH key and its com.apple.sysmond LaunchAgent or "SysMon" scheduled task, since "removing or updating the extension does not remove artifacts written outside its installation directory," Microsoft notes. Cursor says the step that turns on SSH would likely fail without admin rights, so machines where Cursor ran as an administrator are the ones to check first.
Three weeks ago we covered GitLab's fix for CVE-2026-97229, a CVSS 10 integer overflow in the regex compiler GitLab uses for CI configuration. On October 28 Alpine Linux described someone trying it against the GitLab server that hosts its package repository, and CISA added the bug to KEV the next day, with a November 1 deadline.
GitLab fixed the bug on October 12 by patching the Ruby bundled in its official packages. Alpine's container ran stock Ruby. Alpine also upgraded to 19.3.4 by mistake instead of 19.3.5, then to 19.3.6, and stayed vulnerable either way.
The attacker registered an account on October 20 and downloaded Alpine's GitLab container image. On October 20 and 21, crafted CI configurations crashed GitLab workers eight times, and four of the crashes got partway through the exploit.
Alpine writes that a successful exploit would leave "no crash and no trace in the web logs," and outbound connections weren't logged. So the team rebuilt the server from scratch, reset passwords, replaced secret keys and verified the aports repository outside GitLab. Package signing keys were never on the server. When GitLab came back on October 29 on 19.3.7 with Ruby 3.3.13, every password, 2FA setup, personal access token and CI/CD variable value had been wiped, and maintainers were told to replace webhook secrets, mirror passwords and OAuth secrets as possibly exposed.
Shadowserver was still tracking "over 1000 GitLab instances vulnerable to CVE-2026-97229" on November 1, BleepingComputer reported.
Run ruby -v inside the container, because a self-built image can report the fixed GitLab release while running stock Ruby. Upstream Ruby carries the fix from 3.3.13, 3.4.12 and 4.0.9.
On November 2, Microsoft's Yair Tsarfaty and Or Begam published an analysis of 382,789 CVEs published from 1999 through September 2026. Of those, 2,056, about 0.5%, are linked to real exploitation. Takeover bugs, such as remote code execution, authentication bypass and local privilege escalation, make up 78% of the exploited set. Compared with all published CVEs, the exploited ones skew like this:
• Server-side RCE, 20% of all CVEs and 37% of exploited ones
• Client-side RCE, 4% and 13%
• Operating system code, 23% and 41%
• XSS, 15% and 4%
• Denial of service, 16% and 7%
The time from a CVE to its KEV listing keeps shrinking. The mean was 89 days in 2024, 57 in 2025 and 20 so far in 2026, and the 2026 median is 3 days.
Patch times in Microsoft's own data run much longer. The median is about two weeks for Windows workstations, more than a month for Windows servers, 10 weeks or more for Linux servers and macOS apps, and beyond a year for network appliances. "Patching is slow, while exploitation is fast," as the authors title that section. They classify each CVE by its most consequential impact, and the patch figures come from Microsoft Security Exposure Management data.
Did your Connect Secure appliance sit exposed between October 3, when Volexity traced the chain's first use, and October 29, when Ivanti shipped fixes for the two newer flaws? On the device class Microsoft found slowest to patch, that window calls for a compromise check as well as the upgrade.
• GitLab CE/EE CVE-2026-97229, CVSS 10.0, the subject of this week's Alpine Deep Dive. We listed it as not yet exploited on October 14. New this week, CISA added it to KEV on October 29 with a November 1 deadline. GitLab's official packages are fixed in 19.4.2, 19.3.5 and 19.2.8, and images built on a stock Ruby also need Ruby 3.3.13, 3.4.12 or 4.0.9. (GitLab, Ruby, Alpine, CISA)
• Drupal Commerce Core CVE-2026-118539, rated 21 of 25 (highly critical) by Drupal. Certain routes and entity fields aren't properly protected, so an unauthenticated attacker can get around access checks in ways that can cost the store money. Drupal says the flaw is being actively exploited. Fixed in 3.3.13 for 3.x sites and 8.x-2.41 for older ones, and Drupal advises auditing existing orders for inconsistencies. It isn't on KEV. (Drupal)
• Cisco Secure Firewall ASA and FTD CVE-2026-76418, CVSS 8.6. An unauthenticated attacker can send a crafted request while connecting to the SSL remote access VPN and make the device reload. Only tunnel groups with secondary authentication configured are affected, including the default DefaultWEBVPNGroup if secondary authentication is set on it. Cisco says it learned of active exploitation in October. It lists no workaround, and the advisory has fixed releases for every ASA and FTD train, such as ASA 9.22.3.200 and FTD 7.6.7. CISA added it to KEV on October 29 with a November 1 deadline. (Cisco, CISA)
• Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527, CVSS 8.8 and 4.3, in this week's TL;DR. These are the privilege escalation and file-upload links that complete the root chain we covered on October 14 under CVE-2026-104935. The October 13 fixes don't cover them. Fixed in 25.1.1.3 and 22.8R2.6. CISA added both to KEV on October 30, with deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527. (Ivanti, Rapid7, Volexity, CISA)
• WordPress core CVE-2026-119977. During a full-package core update, WordPress unpacked the new files into a predictable folder inside the web-accessible upgrade directory. An unauthenticated attacker who wins the race against that extraction can run code on the server. Every branch from 4.7 through 7.1.3 is affected, and the October 28 release fixed it in 7.1.4 with backports down to 4.7.39. WordPress's own advisory rates it low and lists no CVE, though CISA tracks it under this one. CISA added it to KEV on November 3 with a November 6 deadline. (WordPress, CISA, The Hacker News)
• Linux kernel "Fragnesia" CVE-2026-46300, CVSS 7.8. Disclosed in May, the bug lets a local user turn ESP-in-TCP decryption into writes over cached copies of read-only files and become root. New this week, CISA added it to KEV on October 28 with an October 31 deadline. CISA says it can be chained with October's PHP2Shell flaws to implant PHP webshells and run commands as root. Ubuntu's fixed kernels include 6.8.0-124.124 for 24.04 and 5.15.0-181.191 for 22.04. (Ubuntu, CISA)
• VMware ESX CVE-2026-41709, CVSS 2.7. An administrator can perform certain operations without them being logged. Broadcom fixed it on July 29 in VMSA-2026-0006, including ESXi 8.0 U3j. CrowdStrike's October 28 legal-sector report says WARP PANDA exploited it as a zero-day in several intrusions, as late as early 2026. CISA added it to KEV on October 28 with a November 11 deadline. An attacker who already holds admin rights can use it to work without leaving a log trail. (Broadcom, CrowdStrike, CISA)
• Linux kernel TCP stack CVE-2026-98432, CVSS 9.8. A race in how the kernel frees IPv4 options on incoming connections means a SYN carrying IP options, followed by a retransmission, can make another CPU read freed memory. No login is needed, and a lost race only fails the handshake, so an attacker can retry. It affects kernels from 4.4 on and is fixed in 7.3 and stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Akamai says Anthropic reported a remote root exploit against servers with an MPTCP listener on October 27 without releasing it, and Akamai knows of no public working exploit. As of October 30, Ubuntu and RHEL hadn't shipped fixed kernels. Until a fixed kernel lands, Akamai says disabling MPTCP (net.mptcp.enabled=0) lowers the chance of triggering the race, and disabling request migration (net.ipv4.tcp_migrate_req=0) closes a separate path to it. (Akamai, Red Hat)
• Adobe Campaign Classic CVE-2026-104351 and seven more, CVSS up to 9.9. Bulletin APSB26-162 fixes eight critical flaws, among them code injection, OS command injection and incorrect authorization that each lead to code execution, plus four SQL injections. Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux is affected, and build 9403 fixes it. Adobe knows of no exploits in the wild. (Adobe, The Hacker News)
• Sophos UTM CVE-2026-118633, rated critical by Sophos. A path traversal in the email proxy, when scanning is enabled, lets an unauthenticated attacker run commands as root after winning a race by keeping up the attack for a few minutes. Every UTM version is affected. UTM is end of life, so the October 28 patch has to be installed by hand (KBA-000049692), or the box replaced with a supported Sophos Firewall. Sophos doesn't report attacks. (Sophos)
• Android CVE-2026-58868, rated critical by Google. A flaw in the Android Framework allows remote code execution with no user interaction on Android 14 through 17. Devices are fixed at security patch level 2026-11-01, which phone makers and carriers ship on their own schedules. Google's November 2 bulletin doesn't report exploitation. (Google, The Hacker News)
• Ruby Central's OSS Changelog: October 2026 (Ruby Central) Why it's worth your time: Ruby Central is running AI-assisted security scans over the 619 most-used gems, which together have 158 billion downloads, and about 317 are done. A person reviews every finding. Of 134 findings reviewed, 120 were rejected as unreachable, intended behavior or duplicates, about 15 went to maintainers or advisory channels, and six advisories are open, some still under embargo. One is in rubyntlm, which has more than 94 million downloads. Its NTLMv2 check verified logins against an empty password, so anyone with a valid username got in (GHSA-cx24-f932-rr55, rated 9.3 critical by the maintainer, fixed in 0.6.6). The same update covers opt-in dependency cooldowns in Bundler and RubyGems.org checking passwords against Have I Been Pwned.
• GenAI Code Security, Fall 2026 (Veracode, Natalie Tischler) Why it's worth your time: Veracode's latest run puts 18 models through code-generation tasks in Python, C#, JavaScript and Java and checks four weaknesses. The average security pass rate rose from 56% to 62%, the first real movement in the series, and Claude Opus 5.5 and GPT-6-Sol tie at the top with 73%. XSS made the largest single move, from 15% to 18%. Log injection sits at 12.6%, and Java at 31%, 26 to 33 points behind the other languages. Veracode's read is that models improve where a simple safe pattern exists and stall where the fix needs data-flow reasoning.
• Backporting security fixes at scale with Codex (Trail of Bits, Artem Dinaburg) Why it's worth your time: As of September 18, Trail of Bits counted 2,006 unfixed CVEs in the 5.10.y stable kernel and 337 in 6.18.y. It also counted 4,562 unique unfixed CVEs across Debian 13 packages. Its agents find missing fixes, adapt the patches, run tests and assemble the evidence, and engineers review the patches and submit them to maintainers. By October 29 that had put 149 CVE fixes into stable kernel releases. Human time ran about 30 minutes for a simple backport and about 3 hours for a hard one, before regression testing and maintainer review. The post notes that its kernel counts can run high or low, and that none of them say anything about exploitability.
• Making HTTP header injection critical with one prompt (PortSwigger, Tom Stacey) Why it's worth your time: Stacey shows how a single HTTP request header injection becomes a CRLF-powered desync that redirects random users to an attacker's domain. The method works out where the injected header lands relative to the upstream Host header, confirms the request split by watching for distinct status codes, crawls for an open redirect built from Host, X-Forwarded-Host or an absolute URL, and then combines the two. PortSwigger avoided response queue poisoning as too dangerous to real users, and notes that chaining the primitive with cache poisoning could mean full-site takeover. It has packaged the method as a new Burp scan check and agent skills. If your app builds redirects from Host-derived values, this post shows what that gadget is worth to an attacker.
• Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Sekoia TDR) Why it's worth your time: Sekoia attributes with moderate to high confidence to APT29 a campaign that injected JavaScript into legitimate sites, ran lookalike reverse proxies, and from August 27 to September 3 compromised the Plerdy SEO and analytics tracker, which thousands of mostly Ukrainian sites load. Visitors on phones got fingerprinted by a 61-collector script and served one of three exploit chains covering 8 already-patched CVEs, for iOS 16.7, iOS 18.5 and Android Chrome. The iOS 18.5 chain took messages, Keychain items, photos and Health data. For site owners, it's a detailed look at what a compromised third-party script on your pages can deliver to your visitors.
Every Thursday, 1,500+ security leaders get the week in AppSec cut down to a 5-minute read.
Join 1,500+ security leaders. Five minutes, once a week.
Your first issue lands Thursday.
One email a week. Unsubscribe in one click.