🚨 ACTIVE EXPLOITATION
CISA: max-severity GitLab CVE-2026-97229 RCE now exploited in the wild
CISA has added the maximum-severity GitLab CI/CD Regular Expression Compiler flaw CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after active attacks began.- Affects GitLab Community Edition (CE) and Enterprise Edition (EE); GitLab's platform is used by over 50% of Fortune 100 companies and 70+ million registered users.
- CVE-2026-97229 (10/10 CVSS) stems from an integer overflow in the CI/CD Regular Expression Compiler, letting unauthenticated attackers run arbitrary code via a crafted regular expression in pipeline configuration files.
- Patched in GitLab CE/EE versions 19.4.2, 19.3.5, and 19.2.8; GitLab released threat detections for self-managed instances after spotting exploitation attempts.
- CISA added the flaw to its KEV catalog on Thursday and ordered federal agencies to patch by Sunday under BOD 26-04; Shadowserver tracks nearly 2,800 Internet-exposed GitLab CE instances.
Attackers race to exploit unauthenticated WordPress core update RCE patched in 7.1.4
Threat actors are actively exploiting a high-severity unauthenticated race condition in the WordPress core update process that was patched in WordPress 7.1.4.- Affects all WordPress sites running versions before 7.1.4; fixes were backported to branches through WordPress 4.7.
- The flaw is a race condition in the core update process: files unpack into predictable, web-accessible staging directories, allowing unauthenticated RCE if attackers hit the seconds-long window during a full-package update.
- Attackers repeatedly poll vulnerable staged setup-config.php installer paths; Wordfence recorded over 18,500 such requests in the first 21 hours, with the first hit nine minutes after its firewall rule deployed.
- No CVE identifier has been assigned yet; no successful compromises have been reported.
- WordPress 7.1.4 also patches 22 total vulnerabilities, including XSS flaws, an information disclosure bug, and an authorization weakness.
Zero-click Coruna and DarkSword iOS exploit kits steal iPhone data at scale
Zimperium researchers found widespread zero-click use of the Coruna and DarkSword iOS exploit kits that compromise iPhones via a single web page visit and steal sensitive data.- Applies to iPhones: devices on iOS 17.2.1 or older are served the Coruna kit, while iOS 18 devices get a DarkSword-based chain; 608 domains delivering Coruna-family code were found, 93 matched to 21 tracking servers.
- Coruna exploits CVE-2022-48503, a Safari WebAssembly memory flaw, plus a pointer authentication bypass, then gains kernel read/write and alters code-signing settings while deleting crash logs and Safari data.
- DarkSword escapes the browser via the GPU process into mediaplaybackd; in testing on iOS 18.6.2 the phone made 144 C2 check-ins, pulled seven modules including one targeting Telegram's local storage, and exfiltrated Apple Notes data and 214 installed apps.
- Lures include dating sites for Brazil, Nigeria, and Indonesia, AI-companion chats, crypto promotions, and casino pages with hidden frames; some pages tell TikTok users to tap "Open in browser" to reach Safari.
- Coruna code was also delivered via a backdoored art-template npm package and a fake jquery.min.js from look-alike domain ajax[.]googleapls[.]com; notable IOCs include ccsigen321qc[.]com, ssc[.]vever3eds[.]com, and loader hash cecd08aa6ff548c2.
Sources 📄 Source: zimperium.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)kairos-ddos-botnet-telnet — Cyber Security News
💥 BREACHES & INCIDENTS
Reddit post claims Northflank breach, urges users to rotate environment variables
An unverified Reddit post claims Northflank was breached and that stored environment variables may have been decrypted, while Northflank's security page states it has had no breach.- A Reddit post on r/cybersecurity titled 'Northflank breached - Rotate environment variables immediately' claims customers' environment variables were decrypted.
- The post advises affected users to assume all environment variables are compromised and to disable and rotate all keys.
- The claim concerns Northflank customers using the platform's managed secrets and variables features, on both multi-tenant PaaS and BYOC deployment models.
- Northflank's official security page states the company 'has not experienced a security breach since the company's formation on April 1st, 2019'; no official breach notice appears on its status page.
- No independent confirmation, technical details, or IOCs about the alleged incident are available in the available material.
Revolve Group discloses breach exposing customer names and saved payment card data
Fashion retailer Revolve Group disclosed a cyber incident in which an unauthorized actor may have obtained customer names, contact information, and payment card numbers.- Affects Revolve Group (NYSE: RVLV) customers who saved payment information in their online shopping accounts.
- An unauthorized actor may have obtained names, contact information, payment card numbers, and card expiration dates via automated means.
- The company remediated the unauthorized activity, implemented enhanced security measures, notified federal law enforcement, and engaged external cybersecurity experts.
- No operational disruption or customer service interruption occurred; as of October 29, 2026, Revolve did not believe the incident would materially impact its business.
Syrian Electronic Army hacker 'Th3Pr0' sentenced to 42 months for Assad-era hacking spree
Syrian hacker Ahmad Umar Agha of the Syrian Electronic Army was sentenced to 42 months in U.S. prison for hacking on behalf of Assad's regime.- Ahmad Umar Agha, aka 'Th3Pr0,' hacked ~47 Western media outlets, businesses, NGOs, and U.S. and allied government entities from Aug. 2011 to Jan. 2024
- His 2013 hijack of the Associated Press Twitter account posted a fake Obama injury report, triggering a $136 billion flash crash in the Dow
- The Syrian Electronic Army used phishing emails to steal employee passwords, then defaced websites, redirected traffic, and hijacked social media accounts
- He redirected ~3,500 visitors from the U.S. Marine Corps recruiting site to an image urging Marines to refuse orders, and twice stole White House staff email credentials
- Co-defendant Firas Dardar remains a fugitive; victims included a publisher-services firm losing ~$35,000/day for six months and an NGO with $480,000 in losses
🔓 CVEs & KEV
CVE-2026-93680 — Langflow Langflow — CVSS 9.8 — IBM Langflow OSS Improper Authentication Enables Remote Security Bypass
CVE-2026-82104 — Teltonika Networks RUT — CVSS 9.4 — API permission bypass via logic bugIn Teltonika Networks RUTOS devices runnin...
CVE-2026-111585 — TeamViewer Full Client — CVSS 8.8 — TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
🕵️ RESEARCH & DEEP DIVES
EMBRACE flaws let attackers execute code or steal files via AI assistants' embedded browsers
Forever Security found that embedded browsers in Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop can be abused for code execution, file theft, or address-bar spoofing, with Codex and VS Code still unpatched.- Affects the embedded browsers of five AI coding assistants: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code, and Anthropic Claude Desktop.
- Cursor allowed a web page to inject hidden instructions into the agent's composer, enabling prompt injection that led to host code execution via an npm command and a sandbox bypass.
- GitHub Copilot let pages spoof their own address bar, enabling fake github.com/login phishing pages shown to user and agent.
- Claude Desktop and VS Code enforced folder limits on local pages but not in Web Workers; Codex had no folder check, letting one local HTML file read the whole disk — researchers collected SSH keys, .env files, and npm tokens on macOS using .DS_Store metadata.
- Delivery requires clicking a local HTML link, often generated by the assistant itself; Cursor patched October 1 and Copilot 1.1.29 on October 13, while Codex and VS Code remained unpatched as Microsoft and OpenAI dismissed or did not respond to the reports.
EMBRACE flaws let web pages execute code or steal files in Cursor, Copilot, Codex, VS Code, Claude Desktop
Researchers disclosed separate embedded-browser flaws in five AI coding assistants enabling code execution, local file theft, and address-bar spoofing.- Affects users of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop; researchers named the attack class EMBRACE.
- Cursor's window.cursorBrowser.send() bridge let any loaded page inject instructions into the agent, leading to host code execution via an npm package preinstall script.
- GitHub Copilot's browser preview accepted page-supplied address updates, enabling address-bar spoofing such as a fake github.com/login form; fixed in version 1.1.29.
- Codex, VS Code, and Claude Desktop allowed local HTML previews to read files beyond the project folder,