CISOs Brace for $6.3B Binance Heist, Ivanti/GitLab KEV Adds, SEC AI Scrutiny

CISA Adds Two Actively Exploited Ivanti Connect Secure Flaws to KEV

CISA added two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-111357, a missing authentication flaw for a critical function, and CVE-2026-118527, a predictable-identifier flaw. The agency's alert ties the additions to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize remediation of KEV-listed flaws on internet-facing assets that grant full control after exploitation, and to check for prior compromise before patching. CISA encourages all organizations, not just federal agencies, to apply the same risk-based remediation approach to these catalog entries. (CISA)

CISA Confirms Active Exploitation of Max-Severity GitLab Flaw

CISA confirmed active exploitation of CVE-2026-97229, a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler that can let an unauthenticated attacker run arbitrary code via a crafted regular expression in pipeline configuration. GitLab patched the issue in Community and Enterprise Edition versions 19.4.2, 19.3.5 and 19.2.8 and released threat detections after spotting exploitation attempts. CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to secure servers under Binding Operational Directive 26-04, while urging private-sector teams to patch GitLab Community Edition instances, of which Shadowserver tracks nearly 2,800 exposed online. (BleepingComputer)

Poisoned Claude Code Extension Planted SSH Backdoor via Cursor Marketplace

A tampered build of Anthropic's Claude Code extension, version 2.1.313, planted an SSH backdoor that let an attacker log into victims' machines and maintain a persistent tunnel, security firm Phorion found. Cursor said the malicious version sat in its VS Code extension marketplace for about 11 hours on October 29, 2026, and affected at most 5,000 users. Cursor pulled the version, shut down its marketplace, rotated keys and published cleanup scripts, warning that uninstalling the extension alone will not remove the backdoor and urging affected users to check for an authorized-keys entry labeled svc-telemetry. (Help Net Security)

Cisco Talos: Fake IT Help Desk Calls Fueled Ransomware and Credential Theft

Cisco Talos Incident Response found attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in Q3 2026, talking them into opening remote access sessions; one case ended in ransomware. The attackers needed only names and email addresses, showing no deep profiling, and targeted any susceptible employee rather than privileged users. Across engagements, phishing remained the top initial access method at 37 percent, with exploitation of public-facing applications close behind at 33 percent. Talos recommends phishing-resistant MFA such as FIDO2/WebAuthn, mandatory help desk verification before employees enroll new MFA methods, and at least 90 days of centralized log retention. (Help Net Security)

Gigamon Names Grant Yacomeni as Chief Information Security Officer

Gigamon appointed Grant Yacomeni as Chief Information Security Officer, giving him responsibility for information security, product security, cybersecurity, IT operations, and governance, risk and compliance as the company manages cyber risk across hybrid cloud and AI environments. Yacomeni brings more than a decade of cybersecurity and national security experience, including leadership roles within the U.S. Intelligence Community and the Department of Defense, where he led enterprise security programs and around-the-clock defensive cyber operations. He also served in intelligence and cybersecurity roles with the Maryland Army National Guard and is a U.S. Marine Corps veteran. (CXO Spotlight)