Daily brief: Saturday 31 October 2026

TeamViewer patches a flaw that lets a malicious host attack the person connecting to it, a trojanised Claude Code extension hit Cursor users, CISA confirms GitLab attacks, and WordPress and Linux need updates.

Cybersecurity

TeamViewer 15.83 fixes a flaw that lets a remote computer attack the person controlling it

TeamViewer's bulletin TV-2026-1011 covers three high-severity flaws, rated up to CVSS 8.8. The one getting attention, CVE-2026-111585, lets a malicious or compromised host crash the viewer and, depending on the platform, run code with the viewer's privileges. It affects the Full Client (including Portable) before 15.83 on Windows, Linux and macOS, and the Android Remote Control app. TeamViewer says it is not aware of any exploitation, and there is no workaround, only the update.

Why it matters for IT: Support engineers connect to unknown or untrusted machines every day, so this one points at you, not the user. Update your own TeamViewer clients to 15.83 or the fixed legacy build first, then the hosts.

Source: TeamViewer security bulletin TV-2026-1011 · The Hacker News

Claude

Fake Claude Code update on the Cursor marketplace planted an SSH backdoor

A malicious version 2.1.313 of the Claude Code extension was published to the Cursor Marketplace under Anthropic's real extension ID on 29 October. It added an attacker's key to the user's SSH authorized_keys file, tried to enable SSH and open a reverse tunnel, set up persistence and sent basic host details to the attacker. Cursor says at most 5,000 users installed it during a roughly 11-hour window, and that the version was not made by Anthropic. There is no known evidence it reached Open VSX or Microsoft's VS Code Marketplace; Anthropic has released 2.1.314.

Why it matters for IT: If anyone uses Cursor with Claude Code, check for an 'svc-telemetry' key in ~/.ssh/authorized_keys and for new scheduled tasks, cron jobs or LaunchAgents, then rotate their credentials. Editor extensions auto-update, so treat them like any other software you manage.

Source: The Hacker News

Cybersecurity

CISA confirms attacks on the critical GitLab flaw

CISA added CVE-2026-97229, a CVSS 10.0 GitLab flaw that can give an unauthenticated attacker code execution through a crafted regex in a CI configuration, to its Known Exploited Vulnerabilities list on 29 October. It also added the Cisco ASA and FTD denial-of-service flaw covered yesterday. Alpine Linux has described an attempt on its own GitLab server: it found no proof the attack worked but rebuilt the server anyway. The bug is in the Ruby regex engine, so self-compiled installs also need Ruby 3.3.13, 3.4.12, 4.0.9 or later.

Why it matters for IT: If you run self-managed GitLab, upgrade to the newest release on your branch today. If you built it yourself or use a custom image, update Ruby too, because upgrading GitLab alone did not fix Alpine's server.

Source: The Hacker News · The Hacker News: Alpine Linux GitLab incident

Cybersecurity

WordPress 7.1.4 fixes a core flaw that is already drawing tens of thousands of attacks

WordPress 7.1.4, released on 28 October, fixes a high-severity (CVSS 8.1) flaw in WordPress core affecting versions 4.7 to 7.1.3. During a full core upgrade, files are unpacked to a predictable folder under wp-content/upgrade, and an unauthenticated attacker who hits that window can reach PHP code execution. Wordfence says it blocked 62,969 attacks aimed at the flaw in 24 hours. No CVE had been assigned when the report was written.

Why it matters for IT: Check every WordPress site you look after is on 7.1.4. Then look for odd requests to PHP files under wp-content/upgrade and any admin accounts or plugins you don't recognise.

Source: The Hacker News

Open source

Linux kernel TCP flaw: some distributions have fixes, others are still working on them

CVE-2026-98432 is a race condition in IPv4 TCP connection setup that dates back to Linux 4.4. The kernel CVE team rates it 9.8, while Red Hat, SUSE, Oracle and Amazon give lower scores. Anthropic says Claude wrote a working exploit that gives a remote attacker root on servers with a multipath TCP listener, but no attacks have been reported. Debian, Oracle Linux and some SUSE and Amazon Linux kernels are fixed; Ubuntu and RHEL 8 to 10 fixes were still pending on 29 to 30 October.

Why it matters for IT: Make a list of your Linux servers and appliances, install the vendor kernel update where one exists and reboot. Where there isn't one yet, watch your distribution's CVE page, as there is no approved workaround.

Source: The Hacker News

AI scams & spam

Fake ChatGPT and Claude desktop apps on GitHub install a crypto miner

Check Point Research found a campaign it calls Yoba that uses fake GitHub projects offering desktop apps for ChatGPT and Claude. The download holds a real, signed OpenAI Codex or Claude executable next to a malicious winmm.dll, which the signed program loads. The chain sets up a scheduled task and ends by running the XMRig cryptocurrency miner. It waits about 12.7 days in total before acting, to get past sandboxes.

Why it matters for IT: A signed file is no guarantee if it sits next to a DLL it shouldn't. Tell users to install AI tools only from the vendor's own site or your app catalogue, and block unapproved software installs where you can.

Source: The Hacker News

Google announces Gemini 4 Carbon, aimed first at cyber defenders

Google unveiled Gemini 4 Carbon on 29 October, describing it as a frontier model with strong security, coding and agent abilities. It is first being released to a limited group of cyber defenders, then to trusted partners through Google's Fairwind Program. Google reports scores of 88.2% on SEC-bench Pro for finding vulnerabilities and 71.0% on CWE-bench for patching. These are Google's own figures.

Why it matters for IT: Models that find and patch bugs well can also help attackers find them, which is why releases like this are being limited. Expect the pace of new vulnerability disclosures to stay high, and keep patching cycles short.

Source: The Hacker News

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs