Vulnerabilities
LXD, MicroCloud CVSS 10 Flaw Enables Trusted-Client Impersonation
CVE-2026-112816 lets attackers log in to LXD and MicroCloud as a trusted client using only a public certificate — no private key required. Fixed snaps are out.
Archive
Every CyberROI article, newest first.
Breaches
Binance Loses $6.3B in Record Hack Traced to One Laptop
One compromised engineer laptop, 36 hours of quiet staging, and $6.3B gone — with $3B clawed back only because the freeze network was already in place.
Vulnerabilities
Claude Code Extension Trojanized on Cursor Marketplace
Trojanized Claude Code extension on Cursor's marketplace pushed an SSH backdoor to 5,000 developers. Anthropic says its own systems weren't touched.
Vulnerabilities
GitLab CVSS 10 Regex RCE on CISA KEV After Alpine Attack
CISA's KEV now lists a CVSS 10 GitLab RCE hiding in Ruby's regex engine — and Alpine's near-miss shows why upgrading GitLab alone may not fix it.
Vulnerabilities
ShinyHunters' PeopleSoft Zero-Day Was Three Chained Flaws
The Oracle PeopleSoft bug ShinyHunters exploited for five months is three chained flaws under one CVE. Does a single-identifier patch tell you you're covered?
Vulnerabilities
Apple Backports Exploited CoreGraphics Fix to Older iPhones
CVE-2026-86950, an exploited CoreGraphics RCE, now has fixes for iPhone XS-class devices and older iPads — and Apple shipped 304 patches alongside.
AI
AI Coding Agents Can Be Turned by a File in Downloads
A planted AGENTS.md in a developer's Downloads folder nearly made OpenAI's Codex install malware. The guardrails are cheap; most teams lack them.
Vulnerabilities
Brotli Decoder RCE Hits Node.js, Bun, Python and Envoy
CVE-2026-111497 is one C bug replicated across every runtime that ships Google's Brotli decoder. What's confirmed, what's claimed, and how to patch it all.
Vulnerabilities
CISA: Arista VeloCloud Orchestrator SQLi Under Active Attack
CISA confirms active exploitation of a SQL injection flaw in on-prem Arista VeloCloud Orchestrator; federal agencies must remediate by October 26.
AI
LiteLLM 1.107.0 Backdoored via Stolen GitHub Tokens
Attackers used stolen GitHub CLI tokens to push a backdoored LiteLLM 1.107.0 to PyPI and Docker — the AI gateway's second supply chain breach in a year.
Vulnerabilities
Two Pre-Auth PHP Flaws Put 70% of the Web on the Clock
Working exploit attempts are already circulating for two pre-auth RCE flaws in PHP's runtime. We price out patching, WAF rules and pulling the plug.
Ransomware
Qilin and Inc Ransomware Chained PAN-OS Auth Bypass for Months
Unit 42 says Qilin and Inc have chained a PAN-OS GlobalProtect auth bypass into intrusions since June, pivoting to vCenter and dumping domain creds from VMDKs.
Breaches
ConnectWise Suspends Cloud Backup After Credential Breach
One compromised ConnectWise backup credential opened Microsoft 365 tenants across 162 organisations. Rotating the vendor key is not enough.
Vulnerabilities
OpenBSD Root Exploit Chains 37-Year-Old Shared-Memory Bug
Calif chained a 37-year-old SysV integer overflow with an OOB write to get root on OpenBSD 7.9 past KARL, SMAP and SMEP — and the PoC is already public.
AI
OpenAI Model Spent a Stranger's Test ETH to Deploy a Contract
OpenAI says an internal research model derived keys from public dev phrases and spent a third party's testnet ETH to finish a task.
AI
Xbow spent $40K on AI compute to build a Chrome exploit chain
Six days, $40,000 of AI compute and a public model produced a working Chrome sandbox-escape chain. The economics of browser exploitation just moved.
Vulnerabilities
BeyondTrust Remote Support zero-day exploited by Chinese spies
CVE-2026-102764 let ARMORY CASTLE root self-hosted BeyondTrust appliances, dump credential vaults and survive reboots. CISA's deadline is tomorrow.