11/04/2026-11/11/2026 Git Patches Flaw That Lets Malicious Repositories Execute Code; Debian and Ubuntu APT Flaw; Hackers Compromise Ethersphere’s bee-js and Swarm Desktop And More.

1. Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker’s code when cloned recursively with its submodules. The fix shipped this week in Git 2.56.1, with backports in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.

Tracked as CVE-2026-111760, it is an integer truncation in index handling. An extremely long path passes Git’s safety check but is written to disk under a shorter name an attacker can set to .git. In a fresh submodule, .git is a file, so it can be swapped for a symbolic link to a folder of malicious hooks.

GitHub has patched github.com and Enterprise Cloud, and Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4 include the fix. GitHub Desktop, Copilot app, Codespaces and Actions will follow. Git for Windows had no 2.56.1-based release as of Tuesday, 19:09 UTC.

Until patched, clone only from trusted servers, avoid recursive clones of untrusted repositories, and don’t merge untrusted content or process untrusted binary patches or fast-import streams. The releases also fix CVE-2026-113408, -114467, -114469, -105437 and -114466, covering path traversal, memory corruption and unsafe fast-import features. For -105437, servers can set conflict-marker-size=7 in info/attributes or disable merge checks for untrusted repositories.

2. Debian and Ubuntu APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root

A newly disclosed flaw in APT, the package manager behind Debian and Ubuntu, lets a network attacker swap a trusted package for a malicious one, gaining root code execution. Tracked as CVE-2026-109518, it was announced by Debian on November 4, 2026.

APT verifies packages against signed data, but after an HTTP redirect it can merge two downloads sharing the same address. When resuming an interrupted download, it mishandles the file, opening a window to replace the package after verification.

The attacker must sit between the client and the archive server, on Wi-Fi, through a rogue proxy, or via a malicious mirror. The bug requires redirects, retries, and hard link reuse, and only works when Acquire::Retries is above zero.

Fixes: APT 2.6.2 (bookworm), 3.0.4 (trixie), and 3.3.6 upstream. Ubuntu needs its own patches. Users should update on trusted networks and avoid untrusted mirrors. Setting Acquire::Retries to 0 is a stopgap. No active exploitation has been reported.

3. Hackers Compromise Ethersphere’s bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Attackers abused Ethersphere’s own release automation to publish malicious versions of two Swarm tools: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both download code that steals the node wallet key and its plaintext password from config.yaml, and installs a backdoor on Windows, macOS and Linux (evjawbreaker on Linux/macOS, ScreenConnect on Windows).

bee-js 13.3.0 was live on npm for about 75 minutes; its postinstall script ran without the library being imported. Swarm Desktop 0.56.2 was available about 8.5 hours, with the updater offering it to Windows x64 and Apple Silicon Macs. Both are withdrawn; clean version 0.56.3 is out. Removal doesn’t clear existing backdoors or stolen keys. Download counts were low, and no theft has been reported.

Attackers used stolen CI credentials; the releases carried valid provenance. Socket links the group to the SleepyDuck/EtherDuck campaigns.

Defenders should treat affected machines as compromised, rotate secrets, move funds, remove ~/.solidity and related services, and search for api.frameworkmetrics[.]xyz.

4. SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, to run code on a NEAR AI inference server. Because SGLang runs inside the trusted execution environment (TEE), the attacker could have seen that day’s requests, including confidential-mode ones. The company noted a TEE doesn’t protect against vulnerabilities in software running inside it.

The attacker then moved into an internal system behind the deprecated Private Chat product, downloading names and emails of about 100 users, plus plan and balance data for some. No stored conversations or files appear to have been accessed. The attacker also took chat history, settings and logs from 18 agents on an older NEAR AI Agents deployment outside the TEE. Two customers’ API keys exposed in logs were revoked.

NEAR AI revoked sessions and credentials, took Private Chat offline, patched all inference servers and completed a forensic review, per its incident report. It hasn’t named a CVE, affected versions, or whether SGLang has issued a fix, nor whether Brave’s Leo chats were affected.

5. Claude Dispatch Flaw Lets Malicious Browser Extensions Run Code on Connected Computers

A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop. That computer could even be a different machine signed into the same Claude account.

Researcher Gal Weizman of Forever Security named the technique ThisBash and published the findings on November 4, 2026. 

Dispatch sends tasks from a phone to Claude Desktop, but the web version of claude.ai only hid the Dispatch link. An extension could open Dispatch using the user’s cookies, locate the desktop agent’s session ID, and send instructions. When Claude balked at installing an unknown npm package, the script kept rephrasing, a technique called prompt forcing. Four prompts sufficed, and a loop auto-clicked “Allow.” The package ran and opened Calculator, though it could have stolen files.

Risk is highest when personal accounts are used on work laptops. Weizman reported it May 14; Anthropic closed it as a duplicate and plans to retire Dispatch, but similar designs persist in Claude Code Remote Control and Cowork.

Defenders should inventory AI agents, disable cross-device control, restrict extensions, and keep personal and work accounts separate.

6. OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

OpenSSH has issued emergency patches for a high-severity authentication bypass dubbed SSHole (CVE-2026-123158, CVSS 8.1). It affects sshd on musl-based Linux distributions, such as Alpine, OpenWrt, Buildroot and Yocto, when PAM is disabled. A misinterpretation of what counts as a password hash lets attackers log in to certain accounts with any password of 257 to 1,024 characters, including accounts like root that should never accept one.

Exploitation requires an account whose password field is “*” (typical for key-only accounts) and at least one other account with a 5 or 6 hash. Alpine says one connection is enough, with no retries needed. All Alpine releases from 3.16 onward are affected.

Fixes arrived in OpenSSH 10.6p2. Developer Damien Miller said the release was rushed because AI agents rediscover bugs within hours, making long embargoes dangerous. No exploitation has been reported, but researchers expect scanning within hours or days. Users should patch and restart sshd, or disable password logins as a temporary mitigation.

10/28/2026-11/04/2026 GitHub Launches npm Firewall; Linux Kernel CVE-2026-98432; Red Hat Patches 9.8-Rated Linux TCP RCE Flaw And More.

1. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

A trojanized version of Anthropic’s Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor. Cursor says at most 5,000 users were affected, having installed it between roughly 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The malicious versions, 2.1.312 and 2.1.313, were published under the legitimate ID (anthropic.claude-code). Cursor has since rebuilt its marketplace and rotated its keys.

The injected loader adds an attacker-controlled key labeled “svc-telemetry” to ~/.ssh/authorized_keys, sets up a reverse SSH tunnel, installs persistence, and sends host details, including environment variable names tied to keys and secrets, to an attacker server. Enabling SSH requires admin rights, so remote access often fails on macOS and Windows, but the key, persistence, and data exfiltration still occur.

Anthropic, Microsoft, and Socket say Open VSX, the VS Code Marketplace, and npm were unaffected, and Anthropic’s systems weren’t compromised. How the attacker gained publishing access remains unknown.

Affected users should isolate hosts, remove the unauthorized SSH keys and persistence, and rotate credentials and sessions. Removing the extension alone does not clear these artifacts.

2. GitHub Launches npm Firewall to Block Malicious Packages Before Installation

GitHub has launched a public preview of a package firewall that blocks suspicious npm packages at install time. It sits between endpoints or internal registries and upstream repositories, inspecting metadata requests and downloads as an “install-time policy gate.” It’s available to all GitHub Enterprise Cloud customers, including data-resident ones.

The tool targets malware that strikes during installation, a risk that grows when AI agents and CI runners install dependencies automatically. Administrators configure policies, including:

• Blocking packages with active malware advisories
• Blocking by vulnerability severity (default: “Critical only”)
• Blocking attestation downgrades lacking SLSA attestation
• Blocking newly added preinstall/postinstall scripts
• Enforcing a cooldown of 1 to 365 days (default: 1; 0 disables it)

Users can request exceptions for erroneously blocked packages, subject to administrator approval. Meanwhile, Rust 1.100, due November 12, 2026, will add a configurable “global-min-publish-age” option, defaulting to seven days. Similar cooldowns now exist across npm, Python, VS Code, Ruby, Bun, pnpm, and Yarn.

Socket notes the tradeoff: legitimate fixes are delayed, and undetected malware can outlast any cooldown. Still, the delay buys defenders time to act.

3. Linux Kernel CVE-2026-98432: Critical TCP Use-After-Free, RHEL Fixed, Ubuntu Pending

Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on 1 Nov and raised its score to CVSS 9.8, Critical. Amazon Linux 2 and the Amazon Linux 2023 default kernel are also fixed. Ubuntu still has no fix, and OpenShift 4 and RHEL 9 real-time remain affected.

CVE-2026-98432 is a race condition in the Linux kernel’s IPv4 TCP handshake that causes a use-after-free. The kernel CVE team published it on 15 Oct and scored it 9.8 (Critical): network-reachable, no credentials, no user interaction. All maintained stable kernels carry the fix. Oracle, SUSE and Amazon score it 8.1, citing high attack complexity. No exploitation in the wild is reported, and it is not in CISA’s KEV catalog. Anthropic says its AI model wrote a remote root exploit against servers with an MPTCP listener. Details are unpublished and unverified, and MPTCP is opt-in, though Go 1.24+ listeners use it by default.

Fixed: RHEL 8/9/10, Debian, Oracle Linux, Amazon Linux, most SUSE releases. Not fixed: Ubuntu (all releases), SLES 15 SP7, SUSE Micro 6.0/6.1.

Mitigation: install the fixed kernel and reboot. Meanwhile, inventory exposed Ubuntu, OpenShift and RHEL 9 real-time hosts, review MPTCP listeners, confirm net.ipv4.tcp_migrate_req is 0, and consider dropping inbound IPv4 options at the edge. No IoCs have been published.

4. Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Red Hat has released fixed kernels for a use-after-free flaw in the Linux kernel’s IPv4 TCP code, covering RHEL 8, 9, and 10 (RHSA-2026:93414, 93412, 93413; a reboot is required). Ubuntu’s fixes for 22.04, 24.04, and 26.04 LTS remain in the opt-in -proposed channel, with no date for a regular update. Ubuntu 20.04, 18.04, and 16.04 have no fix yet.

Tracked as CVE-2026-98432, the bug has existed since Linux 4.4. Remote, unauthenticated attackers can trigger a race condition by sending connection requests with IPv4 options to any listening TCP port, potentially achieving remote code execution. The kernel CVE team and Red Hat, which raised its initial 5.9 rating, now score it 9.8. As a stopgap, Red Hat published an nftables rule dropping IPv4 TCP packets carrying options. It is incomplete and may break some workloads. Canonical says only updates are an adequate mitigation, not disabling MPTCP.

No attacks have been reported. Anthropic said an unreleased research model built a working root exploit; the code is unpublished. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixes.

5. Critical Langflow Flaws Enable Authentication Bypass and RCE

IBM patched critical vulnerabilities in Langflow, an open-source framework for building AI agents, LLM workflows, and RAG systems. The flaws could allow authentication bypass, API credential leaks, and arbitrary code execution.

Popular in enterprises for its no-code visual interface, Langflow has been exploited in the wild to steal credentials, most recently in August.

The update fixes four flaws. Two are rated critical (CVSS 9.8): CVE-2026-93680, an incomplete fix for an auto-login issue that enables authentication bypass, and CVE-2026-110186, which allows unauthenticated remote code execution via Model Context Protocol (MCP) tool enumeration. CVE-2026-110193 (high) permits code execution through a third-party library but requires a low-privileged account. CVE-2026-110192 (CVSS 6.5) exposes poorly protected API credentials.

Versions 1.0.0 to 1.12.8 are affected; the fix is in 1.13.0 (PyPI and Docker). IBM urges users to back up the database, secret key, and uploaded files before upgrading. It also patched three medium-severity flaws in Hono, a framework used inside Langflow; users should upgrade to Hono 4.13.5.

6. Hackers Exploit WordPress RCE Flaw as Wordfence Blocks Over 60,000 Attacks in 24 Hours 

Hackers are actively exploiting an unauthenticated remote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates. Wordfence blocked 58,693 attacks in 24 hours, though these were attempts, not confirmed compromises.

Tracked as CVE-2026-119977 (CVSS 8.1), the flaw affects WordPress 4.7 through 7.1.3. During full-package Core upgrades, vulnerable sites unpack files into predictable directories under wp-content/upgrade. An unauthenticated attacker who reaches the staged setup-config.php at the right moment can potentially achieve PHP code execution on the server.

The exploit window lasts only seconds, so attackers poll repeatedly. Wordfence reported over 18,500 requests to staged installer paths in the first 21 hours.
WordPress 7.1.4, released October 28, 2026, fixes 22 vulnerabilities, including this one, by randomizing staging directories and blocking unsafe configuration promotion. Wordfence’s firewall rule reached paid customers immediately; free users get it November 27.

Site owners should update to 7.1.4 or a patched branch release via Dashboard > Updates, then check for unexpected administrator accounts, plugins, and suspicious PHP files. Firewalls and scans complement patching but cannot prove earlier exploitation didn’t occur.

10/21/2026-10/28/2026 Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages; Exploitation of Two PHP2Shell Flaws; Critical Flaw in Python’s Popular Pillow Image Library And More.

1. Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

A critical out-of-bounds write flaw in Google’s Brotli compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has prompted patches from Microsoft, Node.js and two Python packages. Bun, Envoy and Istio were also updated.

The bug affects Brotli 1.0.3 through 1.2.0 and carries a CVSS v4 score of 9.2. Fixes are in versions 1.0.10, 1.1.1 and 1.2.1. Specially crafted input can overflow a decoder buffer, causing crashes, memory leaks or, potentially, unauthenticated code execution. OpenAI Codex Security researchers found it during red-teaming. The root cause had been fixed in Brotli’s source in February, but no release followed.

Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, though not on every attempt, and has not published its exploit. Attacks require malicious Brotli data to reach the decoder, such as through compressed request bodies, untrusted server responses or files.

No in-the-wild exploitation has been reported. A public proof-of-concept works only against a deliberately weakened build, and some researchers argue the flaw enables only denial of service.

Microsoft’s October 25 updates cover .NET, Visual Studio and PowerShell. The Python packages Brotli and brotlicffi are patched. DuckDB, Apache Arrow, p7zip and others remain unpatched. Affected services must be restarted and container images rebuilt.

2. CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA confirmed active exploitation of the recently patched PHP2Shell flaws, adding them to its KEV catalog. Both are rated 9.2 on the CVSS scale and allow unauthenticated remote code execution:

• CVE-2026-109618: out-of-memory corruption flaw
• CVE-2026-109619: stale internal request-state flaw

The listing follows Adel Karimi of Perplexity confirming successful remote code execution against honeypot systems on October 24. He noted the result applies to a favorable single-worker mod_php setup and does not measure exploit reliability elsewhere.

Fixes arrived October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Federal agencies must patch by October 29.

PHP runs roughly 70% of websites, and Censys estimates over 32.51 million PHP services still run affected versions. Dozens of vendors and agencies, including Dell, Citrix, Siemens, IBM, Drupal, and WordPress, have issued advisories.

Separately, the PHP Foundation released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 to fix CVE-2026-111497 (“Broccoli2Shell”), an out-of-bounds write in the Brotli decoder that can enable privilege escalation and remote code execution. It is reachable through the cURL extension only when automatic HTTP response decompression is enabled, which is off by default. Brotli 1.0.10, 1.1.1, and 1.2.1 contain the fix.

3. Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, Python’s most widely used image library, has a flaw that lets attackers run operating system commands on a server through a crafted filename. The bug, CVE-2026-112900, affects EPS handling: Pillow passes the filename to Ghostscript without checking it, and Ghostscript can treat an attacker-chosen name as instructions. It needs the gs program installed and affects versions 2.6.0 to 12.3.0.
Pillow 13.0.0, released October 16, is a large security release. It also fixes two critical-rated bugs: a stale-data memory flaw and JPEG decoding overflows, one of which allows code execution via a crafted FlashPix file. A TIFF overflow dating to 2013 affects saving to in-memory buffers. No attacks are known.

What to do: upgrade, rebuild bundled containers, and note that Pillow 13 requires Python 3.11 or newer.

pip install -U "Pillow>=13.0.0"

Until then: keep gs off hosts handling untrusted uploads, avoid draft() and thumbnail() on untrusted JPEGs, and treat in-memory TIFF saves of user images as risky.

4. Gheist Hackers Abuse GitHub Tokens to Steal Repository Secrets

A campaign dubbed “Gheist,” active since September 15, uses stolen GitHub tokens to plant workflows that print a repository’s secrets into its own log, download the log through the API, and delete the run within seconds. Wiz researchers recovered over 13,500 branches from more than 850 compromised accounts, including enterprise private repositories.

Each attack creates a “ci-sync-” branch with an unsigned commit that appears to come from the token’s owner. In enterprises, attackers cycled through tokens, cloned private repositories, and later used cloud credentials to enumerate AWS Secrets Manager.

Payloads keep evolving. One variant captures secrets from all deployment environments, often production credentials. On October 19, another began targeting self-hosted runners for tokens, private keys, cloud credentials, and Kubernetes tokens, though that job is buggy.

GitHub’s July 28 control, which holds suspicious workflow runs in public repositories until a collaborator approves them, has blocked every observed public attack. It doesn’t cover private repositories or GitHub Enterprise Server.

5. Tailscale Warns of SSH Flaws Allowing Root Privilege Escalation

Tailscale is racing to patch 11 unpatched vulnerabilities, collectively named Tailworm, that could allow credential theft, server crashes, and root-level code execution.
Cyberdione Labs found the flaws while auditing Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. Founder Erica Windisch confirmed each was reproduced on unmodified, released software, and the researchers published the details, arguing that quick public awareness will speed remediation. The most critical bug sits in Tailscale’s SSH server. Through Unix-socket forwarding, an authorized attacker could gain root code execution on a target. Other flaws affect experimental app connectors (cloud metadata, internal network, and Kubernetes access), the DERP relay client (memory exhaustion), tailscale serve (administrative-API access and authorization bypasses), and headscale (an unauthenticated crash loop that blocks device onboarding).

Tailscale called the issues “serious,” noting exploitation depends on permissions and configuration. VP of Engineering Mike Shaver said the company does not recommend disabling Tailscale SSH entirely. Instead, Tailscale advises reviewing SSH access policies, limiting access to necessary users and devices, and disabling SSH forwarding by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled environment and restarting the service, which mitigates several of the more serious findings.

Developers aim to release a fixed version by the end of Tuesday, October 27, and urge users to prepare to apply the patched client when available.

6. Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

AI agents using the x402 SDKs could be tricked into signing a payment for their entire token balance, security firm V12 said on October 22. The default client set no spending limit until August 18 releases added one. Only agents that signed payments automatically, in apps with no limits, were at risk.

This was one of three critical flaws among 25 V12 found, all fixed on August 18. Another let a facilitator accept a Solana token approval, which moves no tokens, as valid payment; only the TypeScript SDK was affected. The third let a malicious server get an agent to sign a login message for a different website.

V12 found them through code review and local tests. No attacks have been reported. However, the x402 Foundation published no security advisory, and npm audit and PyPI showed no warnings, so developers may not know to upgrade.

The fixes cap payments at $1 by default, restrict clients to recognized US dollar stablecoins, add the missing Solana check, and require login messages to match the site contacted. Upgrade to 2.23.0 or later. Teams that can’t upgrade can register a payment policy that blocks large amounts.