Open Cyber Threat Intelligence

CVE-2026-111497 is a critical out-of-bounds write vulnerability in the Google Brotli C library, affecting multiple runtimes including Node.js, Python, Bun, .NET, Java brotli4j, Envoy, and Istio. The flaw allows memory corruption during Brotli decompression, enabling attackers to achieve denial of service, heap memory reads, and potentially remote code execution. Exploitation has been confirmed in the wild, with CISA listing it in its known exploited vulnerabilities catalog. The vulnerability stems from a boolean return value ambiguity in DecodeBlockTypeAndLength(), leading to unbounded memory writes and exploitable state corruption.

The article discusses two major security issues: the compromise of eMudhra intermediate CA private keys due to a flawed key-generation process, leading to weak 8-bit keys being used instead of 384-bit keys, and a memory corruption vulnerability (CVE-2026-111497) in the Brotli decompression library. The eMudhra incident allowed potential certificate forgery, with trust chains extending through roots like Sectigo’s AAA Certificate Services, while the Brotli flaw affected multiple runtimes and applications including Node.js, Bun, Python (via requests), and .NET. Despite patches being released, the widespread bundling of vulnerable libraries and certificate stores in applications means updates must be manually propagated, leaving many systems exposed.

A malicious version of the Claude Code extension, 2.1.313, was distributed through Cursor's marketplace, potentially affecting up to 5,000 users. The compromised extension included code that added an SSH authorized key, attempted to establish a reverse SSH tunnel, and installed persistence mechanisms. While initial reports suggested distribution via Open VSX or npm, investigation found no evidence of the malicious version being published to those registries. Cursor confirmed the compromise, removed the extension, rebuilt its marketplace with rotated keys, and worked to take down the attacker's infrastructure.

A critical out-of-bounds write vulnerability, CVE-2026-111497 (Broccoli2Shell), has been identified in the Brotli decompression library, affecting multiple widely used technologies including Node.js, Bun, Envoy Proxy, and Python packages. The flaw allows unauthenticated remote attackers to trigger memory corruption, disclose sensitive information, crash processes, or potentially achieve remote code execution by supplying maliciously crafted Brotli-compressed data. Cloud environments are especially at risk, with Wiz reporting that 91% of cloud environments have vulnerable resources and 82% have publicly exposed Node.js instances, highlighting widespread exposure across containerized applications, Kubernetes clusters, and serverless workloads.

The article details ongoing exploitation attempts against the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Wiz Research observed multiple attack variants using different exploit kits, primarily targeting memory exhaustion and session poisoning, though no complete end-to-end exploitation was confirmed in their telemetry. Attackers used techniques such as sending oversized multipart requests to trigger memory exhaustion and attempted to leak process memory, but these stages failed due to differences in PHP configurations and deployment environments. The report also notes that some IP addresses successfully exploited honeypots, contributing to CISA's inclusion of PHP2Shell in its KEV catalog, while other tools labeled as PHP2Shell exploits actually relied on unrelated session poisoning and LFI techniques.

A coordinated campaign dubbed 'Black October' targeted multiple AI developer platforms in October, resulting in at least nine disclosed security incidents. The attacks exploited credentials through various initial access vectors, including supply chain compromises, privilege escalation, and third-party dependencies. Threat actors focused on stealing AI model access keys to enable LLMJacking—monetizing stolen tokens via resale platforms. Wiz observed downstream abuse of compromised enterprise credentials, with attackers validating keys, probing model availability, and launching massive inference floods across services like AWS Bedrock, generating over $100k in estimated usage. Two resale hubs, linked to IPs 23.106.46.239 and 38.246.114.118, were identified as key players in the illicit LLM token economy.

On October 19, 2026, an attacker compromised the GitHub account HassenBF, a legitimate OVHcloud contributor, and replaced binaries in five OVHcloud CLI releases (v0.11.0–v0.15.0) with a malicious version containing the GlassWorm credential stealer. The malicious binaries were live for 94 minutes, downloaded approximately 250 times, and exfiltrated sensitive files including cloud credentials, SSH keys, and AI agent tokens to an endpoint at 45.32.148.174. The attack leveraged a previously compromised developer machine via a malicious VS Code extension, and the payload was delivered through a trojanized release binary that bypassed checksum verification due to swapped hashes. The attacker used a local Go build without proper version flags, leaving a detectable fingerprint via the 'ovhcloud version' command. The malicious activity was detected by a customer using pinned SHA-256 hashes in CI, leading to rapid remediation and release of a clean, immutable, attested v0.16.0 version.

On October 29, 2026, malicious actors published trojanized versions (2.1.312 and 2.1.313) of the official Claude Code VS Code extension to Cursor's marketplace, delivering a persistent SSH backdoor to developer machines. The compromised extension.js file contained a self-contained loader that established reverse SSH tunnels and HTTP beacons to attacker-controlled infrastructure. The attack enabled unauthorized access via a dropped SSH key labeled 'svc-telemetry' and established persistence through scheduled tasks and LaunchAgents. The malicious builds were distributed exclusively through Cursor's marketplace and did not affect official Anthropic distribution channels.

The FBI has attributed a $6.3 billion cryptocurrency theft from Binance to North Korea's TraderTraitor threat actor group. The initial access point is suspected to be a compromised DevOps laptop, which allowed attackers to reach a service container and submit unauthorized withdrawal requests. While the exact infection method remains under investigation, the attackers exploited legitimate signing infrastructure without directly stealing private keys, using Ethereum's EIP-7702 delegation feature to authorize multiple fund sweeps. This incident highlights the risk posed by compromised developer machines with access to critical systems, especially given prior TraderTraitor activity involving malicious Python scripts sent via fake recruitment tests.

Threat actors are actively exploiting CVE-2026-0257, a PAN-OS authentication bypass vulnerability in GlobalProtect portal and gateway components, to gain unauthorized VPN access. Exploitation has been linked to ransomware operators including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra ransomware-affiliated actors. Attackers bypass MFA, establish initial footholds, and conduct reconnaissance, lateral movement via RDP/SMB, and credential harvesting. In advanced cases, they pivot to virtualization layers, targeting vCenter and ESXi to dump domain controller credentials offline. The vulnerability was added to CISA's KEV catalog on May 13, 2026, and fixes have been available since May 2026, but unpatched systems remain at risk.