· Newsroom · curated
Cyber news
What our editors flagged from vendor blogs, government advisories and independent newsrooms.
Trojanized Claude Code extension update on Cursor Marketplace tried to plant SSH backdoor
A tampered version 2.1.313 of Anthropic’s Claude Code extension reached Cursor users as a routine update and tried to install a persistent SSH backdoor on developer machines.
Critical GitLab CI flaw targeted at Alpine Linux, added to CISA exploited list
An attacker tried to exploit CVE-2026-97229, a CVSS 10.0 GitLab code execution flaw, on Alpine Linux’s server; CISA now lists it as exploited, alongside a Cisco firewall bug.
Regional energy operator contains ransomware attack, restores grid control systems
Operations moved to standby control systems after a 19-hour disruption. The operator says no customer data left its network.
Typosquatted packages target observability libraries to steal cloud tokens
Researchers found 37 look-alike packages on a public registry. Each was live for under four hours before it was taken down.
Three actively exploited flaws added to the known-exploited list, patch deadline set
The additions include an unauthenticated remote code execution bug in a widely deployed mail server. Agencies have three weeks to patch.
State-linked group rebuilds proxy botnet on home and small-office routers
New infrastructure has appeared across three regions. Command traffic now hides behind anonymising relays.
Annual threat report: stolen identities remain the top way in
Credential phishing and session theft explain about half of the incidents studied. Abuse of cloud tokens grew 41% in a year.
Ransomware affiliate sentenced to 11 years and ordered to repay proceeds
The defendant admitted unauthorised access and laundering. The court also ordered the confiscation of seized crypto assets.
New reporting rules give critical operators 24 hours to flag major incidents
Operators of essential services must send an early warning within a day and a full report within a month.