{"title":"Desktops, browsers and mobile advisories","description":"Windows, macOS, browsers, Android, iOS and remote-access clients: exploited flaws and updates.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/the420in-reports-microsoft-confirms-windows-11-november-2026-update-errors/","title":"The420.in reports Microsoft confirms Windows 11 November 2026 update errors","url":"https://vulnpocalypse.dev/advisories/the420in-reports-microsoft-confirms-windows-11-november-2026-update-errors/","date":"2026-11-12","summary":"The420.in reports Microsoft says some Windows 11 PCs fail to install KB5132061; an automatic fix is due within 48 hours, so wait for it.","tags":["ecosystem","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/security-affairs-reports-europe-spyware-victims-face-little-accountability/","title":"Security Affairs reports Europe spyware victims face little accountability","url":"https://vulnpocalypse.dev/advisories/security-affairs-reports-europe-spyware-victims-face-little-accountability/","date":"2026-11-12","summary":"Security Affairs reports on an IrpiMedia investigation saying European spyware victims get few answers; no CVE or patch is named.","tags":["ecosystem","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/hudson-rock-reports-school-bomb-threat-sender-accounts-in-infostealer-data/","title":"Hudson Rock reports school bomb threat sender accounts in infostealer data","url":"https://vulnpocalypse.dev/advisories/hudson-rock-reports-school-bomb-threat-sender-accounts-in-infostealer-data/","date":"2026-11-12","summary":"Hudson Rock reports two university accounts tied to school bomb threats appear in old infostealer data; check and reset exposed credentials.","tags":["breach","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/hkcert-reports-multiple-google-chrome-vulnerabilities-fixed-in-1570810378/","title":"HKCERT reports multiple Google Chrome vulnerabilities, fixed in 157.0.8103.78","url":"https://vulnpocalypse.dev/advisories/hkcert-reports-multiple-google-chrome-vulnerabilities-fixed-in-1570810378/","date":"2026-11-12","summary":"HKCERT reports multiple Google Chrome vulnerabilities rated medium risk; update to 157.0.8103.78 or later on Linux, Mac and Windows.","tags":["exploited","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/darktrace-says-stolen-claude-api-keys-can-steer-claude-code-as-implant/","title":"Darktrace says stolen Claude API keys can steer Claude Code as implant","url":"https://vulnpocalypse.dev/advisories/darktrace-says-stolen-claude-api-keys-can-steer-claude-code-as-implant/","date":"2026-11-12","summary":"Help Net Security reports Darktrace showed stolen Claude API keys can steer Claude Code in a lab test; scope and rotate keys.","tags":["ai-tools","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/castlerat-stealc-gootloader-bleepingcomputer-reports-europol-takedown/","title":"CastleRAT, StealC, Gootloader: BleepingComputer reports Europol takedown","url":"https://vulnpocalypse.dev/advisories/castlerat-stealc-gootloader-bleepingcomputer-reports-europol-takedown/","date":"2026-11-12","summary":"BleepingComputer reports Europol seized servers tied to CastleRAT, StealC and Gootloader; check if your credentials were exposed.","tags":["breach","endpoint","web"]},{"id":"https://vulnpocalypse.dev/advisories/akamai-reports-strikestub-a-clickfix-powershell-malware-and-rat/","title":"Akamai reports StrikeStub, a ClickFix PowerShell malware and RAT","url":"https://vulnpocalypse.dev/advisories/akamai-reports-strikestub-a-clickfix-powershell-malware-and-rat/","date":"2026-11-12","summary":"Akamai reports on StrikeStub, a ClickFix PowerShell malware and modular RAT; only the headline was reviewed, so read Akamai's full post.","tags":["exploited","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/","title":"Intelbras IP cameras: Kaspersky reports DoS flaw in firmware update endpoint","url":"https://vulnpocalypse.dev/advisories/intelbras-ip-cameras-kaspersky-reports-dos-flaw-in-firmware-update-endpoint/","date":"2026-11-12","summary":"Kaspersky reports an unauthenticated DoS flaw in Intelbras IP camera firmware, update affected cameras to firmware R.260804 as soon as possible.","tags":["exploited","network-edge","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/cursor-2026-cves/","title":"Cursor 2026 CVEs: DuneSlide sandbox escapes, Git hook and Claude hook RCE, and an unpatched Windows git.exe plant","url":"https://vulnpocalypse.dev/advisories/cursor-2026-cves/","date":"2026-11-12","summary":"Seven 2026 Cursor CVEs let prompt injection or a cloned repo run code outside the sandbox. Update to 3.1.2 or later; the Windows git.exe bug has no stated fix.","tags":["ai-tools","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/signdrop-windows-clfs-exploit-researcher-claims-system-access-no-patch/","title":"SignDrop Windows CLFS exploit: researcher claims SYSTEM access, no patch","url":"https://vulnpocalypse.dev/advisories/signdrop-windows-clfs-exploit-researcher-claims-system-access-no-patch/","date":"2026-11-11","summary":"Cyber Security News reports a researcher claims SignDrop gives Windows SYSTEM via CLFS; no CVE or patch, so limit local code execution.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/","title":"SecurityWeek reports Zoom Workplace and Asus router patches","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-zoom-workplace-and-asus-router-patches/","date":"2026-11-11","summary":"SecurityWeek reports Zoom patched two Workplace for Windows flaws in 7.1.8 and later, and Asus issued a router advisory; update both.","tags":["exploited","endpoint","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-intel-and-amd-addressed-over-200-flaws/","title":"SecurityWeek reports Intel and AMD addressed over 200 flaws","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-intel-and-amd-addressed-over-200-flaws/","date":"2026-11-11","summary":"SecurityWeek reports Intel and AMD published over 50 advisories covering over 200 flaws; check vendor advisories and apply available updates.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-says-prisma-browser-needs-chromium-fixes-pan-sa-2026-0014/","title":"Palo Alto says Prisma Browser needs Chromium fixes (PAN-SA-2026-0014)","url":"https://vulnpocalypse.dev/advisories/palo-alto-says-prisma-browser-needs-chromium-fixes-pan-sa-2026-0014/","date":"2026-11-11","summary":"Palo Alto Networks says Prisma Browser builds below 157.19.4.39 lack Chromium fixes; it reports no exploitation. Update Prisma Browser.","tags":["exploited","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/","title":"Microsoft reports threat actors using GSocket for persistent Linux C2","url":"https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/","date":"2026-11-11","summary":"Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.","tags":["ecosystem","web","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/","title":"Kaspersky reports Citrus ransomware using VLESS tunnels and Sn00py","url":"https://vulnpocalypse.dev/advisories/kaspersky-reports-citrus-ransomware-using-vless-tunnels-and-sn00py/","date":"2026-11-11","summary":"Kaspersky reports Citrus ransomware group uses VLESS tunnels and Sn00py; review contractor VPN and RDP access and GHOST machine accounts.","tags":["breach","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/iverify-reports-leaked-darksword-and-coruna-kits-hit-employee-iphones/","title":"iVerify reports leaked DarkSword and Coruna kits hit employee iPhones","url":"https://vulnpocalypse.dev/advisories/iverify-reports-leaked-darksword-and-coruna-kits-hit-employee-iphones/","date":"2026-11-11","summary":"Help Net Security reports iVerify says leaked DarkSword and Coruna kits infect employee iPhones; check iOS versions and work access.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/hkcert-reports-adobe-november-2026-security-update-for-nine-products/","title":"HKCERT reports Adobe November 2026 security update for nine products","url":"https://vulnpocalypse.dev/advisories/hkcert-reports-adobe-november-2026-security-update-for-nine-products/","date":"2026-11-11","summary":"HKCERT reports Adobe released its November 2026 monthly update covering nine products rated Medium; apply the vendor fixes.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/","title":"GBHackers reports fake Cloudflare CAPTCHA lures hide malware in PNG images","url":"https://vulnpocalypse.dev/advisories/gbhackers-reports-fake-cloudflare-captcha-lures-hide-malware-in-png-images/","date":"2026-11-11","summary":"GBHackers reports Huntress research on fake Cloudflare CAPTCHA ClickFix lures that run PowerShell; never paste commands from a web page.","tags":["ecosystem","endpoint","web"]},{"id":"https://vulnpocalypse.dev/advisories/fortiguard-labs-reports-tinstaporn-android-casino-app-malware/","title":"FortiGuard Labs reports TinstaPorn Android casino app malware","url":"https://vulnpocalypse.dev/advisories/fortiguard-labs-reports-tinstaporn-android-casino-app-malware/","date":"2026-11-11","summary":"Hackread reports FortiGuard Labs found TinstaPorn, a fake Macau casino Android app that collects phone and location data; avoid sideloading it.","tags":["ecosystem","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/bitlocker-bypass-flaws-cyber-security-news-reports-microsoft-disclosure/","title":"BitLocker bypass flaws: Cyber Security News reports Microsoft disclosure","url":"https://vulnpocalypse.dev/advisories/bitlocker-bypass-flaws-cyber-security-news-reports-microsoft-disclosure/","date":"2026-11-11","summary":"Cyber Security News reports Microsoft disclosed two BitLocker bypass flaws needing physical access; check the KB updates for your Windows build.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/","title":"ASEC reports SnakeKeylogger phishing disguised as quote requests","url":"https://vulnpocalypse.dev/advisories/asec-reports-snakekeylogger-phishing-disguised-as-quote-requests/","date":"2026-11-11","summary":"ASEC reports phishing emails posing as quote requests deliver SnakeKeylogger through a JavaScript attachment; do not open such attachments.","tags":["ecosystem","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/","title":"Microsoft November 2026 Patch Tuesday: exploited Outlook zero-day","url":"https://vulnpocalypse.dev/advisories/microsoft-november-2026-patch-tuesday-exploited-outlook-zero-day/","date":"2026-11-11","summary":"Microsoft's November 2026 Patch Tuesday fixes an exploited Outlook NTLM hash flaw, CVE-2026-124194; install the November updates.","tags":["exploited","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/","title":"Chrome CVE-2026-125350 zero-day: update to 157.0.8103.50","url":"https://vulnpocalypse.dev/advisories/chrome-cve-2026-125350-zero-day-update-to-1570810350/","date":"2026-11-11","summary":"Google patched an actively exploited Chrome XML use-after-free, CVE-2026-125350; update Chrome to 157.0.8103.50 or later and relaunch.","tags":["exploited","web","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/","title":"Check Point reports three China-nexus campaigns linked via Sparrow malware","url":"https://vulnpocalypse.dev/advisories/check-point-reports-three-china-nexus-campaigns-linked-via-sparrow-malware/","date":"2026-11-11","summary":"The Hacker News reports Check Point links three China-nexus espionage clusters via Sparrow malware; review indicators and sideloading alerts.","tags":["breach","endpoint","network-edge","web"]},{"id":"https://vulnpocalypse.dev/advisories/apple-ios-2721-and-macos-patches-fix-imessage-and-bluetooth-flaws/","title":"Apple iOS 27.2.1 and macOS patches fix iMessage and Bluetooth flaws","url":"https://vulnpocalypse.dev/advisories/apple-ios-2721-and-macos-patches-fix-imessage-and-bluetooth-flaws/","date":"2026-11-11","summary":"Apple fixed iMessage group chat, Bluetooth and AirPlay pairing flaws in 27.2.1 and sibling releases; update your Apple devices.","tags":["exploited","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/","title":"N-able takes N-central offline after 33 alleged zero-days are published (Able2Shell)","url":"https://vulnpocalypse.dev/advisories/n-able-n-central-offline-33-alleged-zero-days-able2shell/","date":"2026-11-11","summary":"A researcher published exploit code for 33 unpatched N-central flaws; N-able took hosted N-central offline and told on-prem users to shut down pending a fix","tags":["exploited","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","title":"Fake GitHub security tool repos spread AsyncRAT, Doctor Web reports","url":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","date":"2026-11-11","summary":"Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.","tags":["supply-chain","open-source","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/","title":"Armorsteal Python malware kit steals data and mines crypto, Seqrite reports","url":"https://vulnpocalypse.dev/advisories/armorsteal-python-malware-kit-steals-data-and-mines-crypto-seqrite-reports/","date":"2026-11-11","summary":"Seqrite reports Armorsteal, a Python kit that steals data and mines crypto on Windows; check for its scheduled tasks and Defender exclusions.","tags":["ecosystem","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/claude-dispatch-unpatched-rce/","title":"Anthropic won't fix a Claude Dispatch flaw that lets browser extensions run commands on connected computers","url":"https://vulnpocalypse.dev/advisories/claude-dispatch-unpatched-rce/","date":"2026-11-11","summary":"A browser extension on claude.ai can drive Claude Dispatch to run commands on connected desktops. Anthropic closed it as a duplicate and won't fix it.","tags":["ai-tools","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/tata-motors-connected-car-app-flaws/","title":"CERT-In flags four flaws in Tata Motors iRA connected-car apps that let attackers impersonate owners","url":"https://vulnpocalypse.dev/advisories/tata-motors-connected-car-app-flaws/","date":"2026-11-11","summary":"CERT-In CIVN-2026-0537 details four high-severity flaws in Tata Motors iRA apps that let attackers impersonate car owners. Patched in iRA 2.0 26.8.2 / iRA.ev.","tags":["exploited","endpoint","web"]},{"id":"https://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/","title":"OpenAI's GPT-6 Cyber model generated 948 working Linux kernel root exploits and reported 81 Firefox flaws","url":"https://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/","date":"2026-11-11","summary":"OpenAI's GPT-6 Cyber built 948 working Linux kernel root exploits and reported 81 high-severity Firefox flaws, all disclosed for patching.","tags":["ai-tools","ai-tools","open-source","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/","title":"Fake GTA VI download sites push malware and crypto scams ahead of the November 19 launch","url":"https://vulnpocalypse.dev/advisories/fake-gta-vi-download-sites-push-malware-and-crypto-scams-ahead-of-the-november-1/","date":"2026-11-11","summary":"Netcraft found fake GTA VI leaked builds, early access and mobile downloads that deliver flagged malware or demand crypto before the November 19 launch.","tags":["ecosystem","endpoint","crypto","web"]},{"id":"https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/","title":"APT29 watering hole campaign serves n-day iOS and Android exploits via hacked sites and Plerdy","url":"https://vulnpocalypse.dev/advisories/apt29-watering-hole-campaign-serves-n-day-ios-and-android-exploits-via-hacked-si/","date":"2026-11-11","summary":"Russia-linked APT29 used hacked sites, cloned domains and the Plerdy tracker to serve patched-flaw exploits to out-of-date iPhones and Android phones.","tags":["supply-chain","endpoint","web"]},{"id":"https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/","title":"Chrome 157 fixes 213 security bugs, 7 rated critical, in desktop and Android builds","url":"https://vulnpocalypse.dev/advisories/chrome-157-fixes-213-security-bugs-7-rated-critical-in-desktop-and-android-build/","date":"2026-11-11","summary":"Google released Chrome 157 with 213 security fixes, seven rated critical, and has not said any of them are exploited in the wild.","tags":["exploited","web","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/","title":"3AM ransomware encrypts 37 machines in UK school estate in suspected AI-assisted attack","url":"https://vulnpocalypse.dev/advisories/3am-ransomware-encrypts-37-machines-in-uk-school-estate-in-suspected-ai-assisted/","date":"2026-11-11","summary":"A 3AM ransomware affiliate encrypted 37 machines in a UK school estate in September 2026, with Bitdefender suspecting AI-assisted command retries.","tags":["ai-tools","enterprise","endpoint","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/","title":"Bitter APT drops a new PapRAT backdoor on South Asian targets using malicious VHDX disk images","url":"https://vulnpocalypse.dev/advisories/paprat-bitter-espionage-south-asia/","date":"2026-11-11","summary":"Fortinet says the Bitter espionage group is spreading a new backdoor, PapRAT, in South Asia using malicious VHDX disk images, shortcut files and MSI installers.","tags":["breach","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/","title":"Google disrupts XCPE Android botnet of 1.3 million set-top boxes and bans TV box maker Videostrong","url":"https://vulnpocalypse.dev/advisories/google-xcpe-android-botnet/","date":"2026-11-11","summary":"Google and partners took down XCPE, a firmware backdoor that turned over 1.3 million Android set-top boxes into a botnet, and banned maker Videostrong.","tags":["breach","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/","title":"Android November 2026 update fixes critical zero-click RCE CVE-2026-58868 in Framework","url":"https://vulnpocalypse.dev/advisories/android-november-2026-update-fixes-critical-zero-click-rce-cve-2026-58868-in-fra/","date":"2026-11-11","summary":"Google's November 2026 Android bulletin fixes 216 flaws, including critical zero-click RCE CVE-2026-58868 on Android 14 through 17.","tags":["exploited","endpoint","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/volta-ai-infostealer/","title":"VOLTA infostealer asks an AI which victims are worth robbing, then doxes them from their own Gmail","url":"https://vulnpocalypse.dev/advisories/volta-ai-infostealer/","date":"2026-11-11","summary":"Cisco Talos found VOLTA, a Windows infostealer that grabs credentials, crypto wallets and Gmail data, then asks Claude, Kimi or Gemini to rank the victim.","tags":["ai-tools","endpoint","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/","title":"SolanaCry: fake Solana GitHub repo lures AI coding agents, Hackread reports","url":"https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/","date":"2026-11-11","summary":"Hackread reports a fake GitHub Solana starter kit tells AI agents to install NetSupport RAT; review commands before agents run them.","tags":["supply-chain","ai-tools","open-source","crypto","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/","title":"Apple warns iPhone users in 99 countries of mercenary spyware targeting, including German lawmakers","url":"https://vulnpocalypse.dev/advisories/apple-warns-iphone-users-in-99-countries-of-mercenary-spyware-targeting-includin/","date":"2026-11-11","summary":"Apple began sending new mercenary spyware threat notifications in 99 countries, including to German lawmakers; vendor and exploit are not confirmed.","tags":["ecosystem","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/","title":"Trojanized Claude Code extension (2.1.312, 2.1.313) on Cursor marketplace installs persistent SSH backdoor","url":"https://vulnpocalypse.dev/advisories/trojanized-claude-code-extension-21312-21313-on-cursor-marketplace-installs-pers/","date":"2026-11-11","summary":"A tampered anthropic.claude-code build on the Cursor marketplace planted an SSH key, a reverse tunnel and persistence on up to 5,000 developer machines.","tags":["supply-chain","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/","title":"Sophos reports GOLD OGRE used AI agents in Aur0ra ransomware intrusions","url":"https://vulnpocalypse.dev/advisories/sophos-reports-gold-ogre-used-ai-agents-in-aur0ra-ransomware-intrusions/","date":"2026-11-11","summary":"Sophos reports the GOLD OGRE group used Cursor and AI models to run Aur0ra ransomware intrusions, so check for its indicators and tighten AD defenses.","tags":["ai-tools","ai-tools","enterprise","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","title":"Trojanized Claude Code extension on Cursor's marketplace planted an SSH backdoor (2.1.312, 2.1.313), plus","url":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","date":"2026-11-11","summary":"Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.","tags":["supply-chain","ai-tools","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/claude-code-extension-cursor-trojanized/","title":"Trojanized Claude Code extension on the Cursor marketplace planted a persistent SSH backdoor","url":"https://vulnpocalypse.dev/advisories/claude-code-extension-cursor-trojanized/","date":"2026-11-11","summary":"A tampered Anthropic.claude-code extension (2.1.312/2.1.313) was live on Cursor's marketplace ~11 hours, planting an SSH backdoor. Rotate keys, remove it.","tags":["supply-chain","ai-tools","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/","title":"Android \"SMS of Death\": a zero-click WAP push SMS crashes the phone process and drops calls (CVE-2026-58882","url":"https://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/","date":"2026-11-11","summary":"One crafted WAP push SMS crashes com.android.phone on Android 12 to 16, dropping calls. Install the October 2026 patch; Android 12 and 13 get no fix.","tags":["exploited","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/","title":"Anthropic AI model chained flaws into Chrome, Safari, Android, Windows and Linux exploits","url":"https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/","date":"2026-11-11","summary":"Anthropic says an unreleased model chained flaws into five working exploits for Chrome, Safari, Android, Windows and Linux, all reported and patched.","tags":["ai-tools","ai-tools","web","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/apple-backports-fix-for-exploited-coregraphics-zero-day-cve-2026-86950-to-older/","title":"Apple backports fix for exploited CoreGraphics zero-day CVE-2026-86950 to older iPhones and iPads","url":"https://vulnpocalypse.dev/advisories/apple-backports-fix-for-exploited-coregraphics-zero-day-cve-2026-86950-to-older/","date":"2026-11-11","summary":"Apple backported the fix for exploited CoreGraphics flaw CVE-2026-86950 to iOS 18.7.11 and iPadOS 18.7.11 for older iPhones and iPads.","tags":["exploited","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/","title":"Popcorn Time fork updater left devices open to hijacking, Malwarebytes reports","url":"https://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/","date":"2026-11-11","summary":"Malwarebytes reports an abandoned Popcorn Time fork updater could run attacker code, so remove Popcorn Time or Time4Popcorn from old devices.","tags":["exploited","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/","title":"Attackers abuse Microsoft Teams external chat for IT-support impersonation and malware delivery in under 15","url":"https://vulnpocalypse.dev/advisories/attackers-abuse-microsoft-teams-external-chat-for-it-support-impersonation-and-m/","date":"2026-11-11","summary":"Arctic Wolf saw over 400 incidents where attackers used external Teams chats and email bombing to get remote access and run payloads within 15 minutes.","tags":["ecosystem","enterprise","endpoint","cloud"]}]}