This brief distinguishes source reporting from SecOpsAI's original observations.
Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
Source-reported by Socket Blog.
Socket reports that Cursor confirmed a malicious extension labelled Claude Code 2.1.313 was available through the Cursor extension marketplace on October 29, potentially affecting up to 5,000 users. The analysis Socket cites describes code that adds an SSH authorized key, attempts a reverse SSH tunnel and installs persistence. Early reports named Open VSX, npm and the VS Code Marketplace; Socket found no publication or removal record for 2.1.313 in Open VSX's change feed or in npm's records.
Defensive action: If you installed Claude Code 2.1.313 through the Cursor marketplace, treat the host as compromised: isolate it, remove unauthorized SSH keys and persistence, and rotate credentials and sessions. Move to Claude Code 2.1.314.
Limitations: Source-reported; SecOpsAI did not reproduce the issue. Socket has not obtained or analysed the artifact. The remediation steps come from The Hacker News coverage of Cursor's notice, not from Socket's post. SecOpsAI did not read Cursor's notice directly.
Published: not supplied; first observed: 2026-10-30T10:01:01.787758Z.
Informational advisory: Session upload progress
Source-reported by PHP Security Advisories.
PHP Security Advisories published an informational advisory on 23 Oct 2026 about an unlikely remote code execution vector in session upload progress, tracked as CVE-2026-115560. It needs an unusual setup: session.serialize_handler set to php_binary or php_serialize in configuration, then switched to php at runtime with ini_set() before session_start(), with session upload progress still enabled. PHP is handling it in the regular release cycle and says a full advisory will follow with the next release.
Defensive action: Set session.upload_progress.enabled=0 until the next regular PHP bugfix release, as PHP advises. PHP says applications that never change the serialize handler at runtime can keep the feature enabled. If you applied this setting as a mitigation for CVE-2026-109619 on or after 21 Oct, keep it in place.
Limitations: Source-reported; SecOpsAI did not reproduce the issue. cve.org had no public record for CVE-2026-115560 on 2026-10-30. PHP describes the setup as unlikely in practice, which is milder than some news coverage of it.
Published: 2026-10-23T10:12:28Z; first observed: 2026-10-24T19:24:48.168938Z.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-115560 exists | not found | https://www.cve.org/CVERecord?id=CVE-2026-115560 |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability. CVE-2026-111357 (official CVSS 7): Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. The source also mentions CVE-2026-104935, CVE-2026-118527. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-30T20:51:00.083025Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-111357 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-111357 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability. CVE-2026-76418 (official CVSS 8.6): A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-29T20:24:17.085521Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-76418 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-76418 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. CVE-2026-97229 (official CVSS 10): GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-29T20:24:17.085521Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-97229 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-97229 |
| CVSS 10.0 | confirmed | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-97229 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. CVE-2026-48356 (official CVSS 9.3): Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-28T19:35:16.789731Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-48356 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-48356 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability. CVE-2026-41709 (official CVSS 2.7): VMware ESX contains an insufficient logging vulnerability. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-28T19:35:16.789731Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-41709 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-41709 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability. CVE-2026-46300 (official CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @from to @to. The source also mentions CVE-2026-109618, CVE-2026-109619. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-28T19:35:16.789731Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-46300 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-46300 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability. CVE-2026-111497 (official CVSS 9.2 and 9.8): A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-28T19:35:16.789731Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-111497 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-111497 |
| CVSS 9.2 | confirmed | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111497 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: no SecOpsAI rule covers this yet.
SecOpsAI deployment exposure: Node.js, PyPI / Python.
CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-109619: PHP Stale Internal Request-State Vulnerability. CVE-2026-109619 (official CVSS 8.1 and 9.2): PHP has various global state that temporarily points into request memory. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. SecOpsAI users can enable RULE-311 (PHP2Shell Exploitation Indicators (T1190)).
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-27T18:55:20.189630Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-109619 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-109619 |
| CVSS 9.2 | confirmed | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-109619 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: RULE-311 (PHP2Shell Exploitation Indicators (T1190))
CVE-2026-109618: PHP Memory Corruption Vulnerability
Source-reported by CISA Known Exploited Vulnerabilities.
CISA Known Exploited Vulnerabilities reports: CVE-2026-109618: PHP Memory Corruption Vulnerability. CVE-2026-109618 (official CVSS 9.2 and 9.8): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. CISA lists it as exploited in the wild.
Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. SecOpsAI users can enable RULE-311 (PHP2Shell Exploitation Indicators (T1190)).
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: not supplied; first observed: 2026-10-27T18:55:20.189630Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-109618 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-109618 |
| CVSS 9.2 | confirmed | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-109618 |
| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
SecOpsAI detection: RULE-311 (PHP2Shell Exploitation Indicators (T1190))
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
Source-reported by GitHub Security Advisories.
GitHub Security Advisories reports: vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE. CVE-2026-115915 (official CVSS 8.1 and 9.8): vLLM is an inference and serving engine for large language models. The source also mentions CVE-2024-29510, CVE-2026-59203.
Defensive action: Upgrade to a fixed release: vllm 0.32.0.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: 2026-10-28T21:15:29Z; first observed: 2026-10-30T14:31:54.264186Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-115915 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-115915 |
SecOpsAI detection: no SecOpsAI rule covers this yet.
SecOpsAI deployment exposure: PyPI / Python.
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Source-reported by GitHub Security Advisories.
GitHub Security Advisories reports: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE. CVE-2026-115905 (official CVSS 10): zip is a zip library for Rust that supports reading and writing simple ZIP files.
Defensive action: Upgrade to a fixed release: zip 9.0.5.
Limitations: Source-reported; SecOpsAI did not reproduce the issue.
Published: 2026-10-28T21:09:50Z; first observed: 2026-10-30T14:31:54.264186Z.
Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.
| Claim | Check | Source |
| --- | --- | --- |
| CVE-2026-115905 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-115905 |
| CVSS 10.0 | confirmed | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-115905 |
SecOpsAI detection: no SecOpsAI rule covers this yet.
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Source-reported by GitHub Security Advisories.
GitHub Security Advisories reports: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers. The source also mentions CVE-2018-1193, CVE-2025-41235.
Defensive action: Upgrade to a fixed release: github.com/labstack/echo/v5 5.4.0, github.com/labstack/echo/v4 4.16.0.
Limitations: Source-reported; SecOpsAI did not reproduce the issue. SecOpsAI recorded no CVE identifier for this advisory.
Published: 2026-10-28T21:04:52Z; first observed: 2026-10-28T21:15:31.354919Z.
Verified automatically by SecOpsAI rules (primary source with a stated fix; no CVE recorded to check) under the editor's recorded policy.
SecOpsAI detection: no SecOpsAI rule covers this yet.
GitPython command wrappers omit unsafe protocol and option checks
Source-reported by GitHub Security Advisories.
GitHub Security Advisories reports: GitPython command wrappers omit unsafe protocol and option checks. The source also mentions CVE-2022-24439, CVE-2023-40267, CVE-2026-42215, CVE-2026-67323.
Defensive action: Upgrade to a fixed release: GitPython 3.2.0.
Limitations: Source-reported; SecOpsAI did not reproduce the issue. SecOpsAI recorded no CVE identifier for this advisory.
Published: 2026-10-27T15:26:43Z; first observed: 2026-10-27T16:20:46.271411Z.
Verified automatically by SecOpsAI rules (primary source with a stated fix; no CVE recorded to check) under the editor's recorded policy.
SecOpsAI detection: no SecOpsAI rule covers this yet.
Collection scope
Collection is bounded and does not establish comprehensive surveillance. 0 enabled sources lack a fresh successful collection. 5 registry collectors provide metadata coverage without artifact scanning. Unknown eligible-event and evidence-coverage denominators are reported as unknown.
Credits and corrections
Prepared by Onyedika Christopher Agada. Technical verification and final release require recorded human review. Corrections will retain the previous edition and explain material changes.
Comments
Comments are moderated before publication. Do not post secrets, tokens, customer data, or exploit payloads.