Artrex OT Security Supply Chain Again

In EP6 the vendor was trusted and its app credential was stolen. This week the trusted channel itself was the attack surface: a marketplace, a management plane, a firmware stack, a refrigeration contractor, an identity directory, and a certificate revocation check.

Trojanized Claude Code extensions in Cursor’s marketplace

Sourcing: Cursor’s marketplace operator notice, threat intelligence from Microsoft and OX Security, a researcher advisory from Phorion, Anthropic’s statement to The Register, and the DoublePulsar post that brought it to us. Disclosure: the tampered package is Anthropic’s Claude Code extension, and Anthropic is cited here and in Patch watch below. Anthropic’s claims are attributed to Anthropic and kept separate from independent validation.

The case

• Affected versions: Anthropic.claude-code 2.1.312 and 2.1.313, macOS (darwin-arm64) and Windows (win32-x64), served only through Cursor’s VS Code extension marketplace. Cursor’s first notice named 2.1.313; it added 2.1.312 in an October 30 update.
• Window: October 29, about 02:27 to 13:35 PT (09:27 to 20:35 UTC), roughly 11 hours.
• Scale: Cursor says at most 5,000 users were affected and it is contacting them. That is an exposure ceiling, not 5,000 working backdoors.
• Publisher: the packages carried Anthropic’s real publisher ID. Cursor says Anthropic did not build them. Anthropic’s Felix Rieseberg says its systems and laptops were not compromised, and that a malicious actor used access to Cursor’s marketplace.
• Not affected, per Cursor, Anthropic and OpenSourceMalware: the Microsoft VS Code Marketplace build, the Open VSX listing, and the @anthropic-ai/claude-code npm CLI.
• Open question: what access let someone publish to Cursor’s marketplace. Neither company has said.

What the payload did

1. A loader prepended to extension.js ran as soon as the file loaded. No click needed.
2. It sent host details (hostname, username, OS, home and working directory, Git email, public IP) to 134[.]209[.]82[.]225 on port 8099.
3. Per Phorion, it also sent the names of up to 40 secret-looking environment variables. Names, not values.
4. It added an attacker SSH key labeled svc-telemetry to authorized_keys.
5. It tried to turn on the local SSH server and open a reverse SSH tunnel, retried about every 60 seconds.
6. It set persistence: a LaunchAgent (com.apple.sysmond) on macOS, a scheduled task with a Startup-folder fallback on Windows.

The important limitation

The tunnel mostly failed. Bugs in the malicious code plus missing admin rights meant the SSH step failed on most Mac and Windows machines, unless Cursor ran as admin. Cursor says on those hosts the attacker could not log in.

The rest still ran: host details sent, key planted, persistence installed. A Mac that already has Remote Login on, or turns it on later, is ready to use.

Timeline (2026)

Hype check: “Anthropic was hacked”

• Kevin Beaumont’s DoublePulsar headline says Anthropic was hacked and the extension reached tens of millions. Verified scope: one marketplace (Cursor’s), two versions, at most 5,000 users.
• His fair point: it shipped under Anthropic’s verified publisher identity, so “not developed by Anthropic” does not help a user who trusted the name.
• What is not established: a breach of Anthropic’s internal systems, or delivery to millions. The root cause is still undisclosed. Ask the question; do not pick a side.

What MSPs should do

• Hunt, do not just update. Uninstalling or moving to 2.1.314 does not remove persistence. Check authorized_keys (and C:\ProgramData\ssh\administrators_authorized_keys) for svc-telemetry, plus LaunchAgents, scheduled tasks, SSH tunnel processes and connections to the attacker IP. Cursor has one-line checks and cleanup scripts; Microsoft has hunting queries.
• If you find it: isolate the host, consider a rebuild, and rotate every credential and session it could reach, from a clean device.
• Extensions are software. Inventory IDE extensions, decide where auto-update stays on, and know which marketplace each VS Code fork pulls from.
• A verified publisher is not a behavior control. An editor writing SSH keys or creating LaunchAgents should page someone. Make sure EDR covers developer laptops.

CIS Controls: 2.1 and 2.5 (software inventory; allowlist authorized software), 16.4 and 16.5 (inventory third-party components; use up-to-date, trusted components), 10.1 and 13.2 (anti-malware; host-based intrusion detection), 4.8 (disable unnecessary services: SSH server off where it is not needed), 17 (incident response management).

NIS2 / ENISA: 5.1 (supply chain security) and 6.1 (security in acquisition of ICT services and products), 6.9 (protection against malicious and unauthorised software), 3.2 (monitoring and logging).

ARTEX, part two: Vapor Panda hits 200+ organizations in 11 days

Sourcing: CrowdStrike threat intelligence (October 29), an on-record interview with Adam Meyers in CyberScoop, and trade press in IT Brief.

The case

• The actor: CrowdStrike tracks Vapor Panda as China-nexus, focused since 2021 on government, think tanks, energy and extractives for long-term access.
• The tool: the same open-source ARTEX framework from EP6, run mainly on DeepSeek plus a second subscription model CrowdStrike could not identify. A main agent directs planner and worker agents over a shared graph of facts and goals. Humans set objectives and approved key decisions.
• The campaign: began October 17; 200+ organizations in at least 14 countries. Targets included foreign ministries, one European country’s presidency and PM’s office, defense and intelligence agencies, 19 US organizations (pharma, semiconductor, defense, nuclear, finance), and telecoms in the US, Belgium and the Philippines.
• Not Storm-0940. CrowdStrike says this is separate from the ARTEX activity Microsoft tied to Storm-0940 in EP6. Two crews, one tool.

Receipts

• Confirmed post-exploitation at 9 organizations: access, then the BLOODALCHEMY backdoor, credential spraying, scanning and recon. At least 12 more saw spraying or credential scanning with no confirmed follow-on.
• At one US pharma, an agent chained an unsigned SAML assertion with an XXE bug to reach cloud instance metadata. At another, web shells plus an unauthenticated orchestration service led to root in a production container.
• Tempo: Meyers says hands-on-keyboard operations historically ran up to about 40 commands an hour; ARTEX pushed past 1,500.
• One intrusion’s planning agents used about 1.4 billion input tokens.
• These are CrowdStrike’s observations for this campaign, not a benchmark for every AI-assisted attacker.

Hype check: “140 compromised”

• CyberScoop’s headline says about 140 targets compromised. That comes from Meyers saying roughly 70% were confirmed or showed moderate-confidence signs of intrusion.
• CrowdStrike’s written report confirms 9. Say both numbers and what each one means.
• DeepSeek was the backend. The report does not allege DeepSeek knowingly took part.
• Meyers’ own framing fits: nothing new in the techniques, just speed and scale.

What to do

1. Validate SAML signatures and assertions properly.
2. Fix XXE and other app-layer bugs; they are what the agents chain.
3. Lock down orchestration and management APIs.
4. Block cloud metadata access from workloads that do not need it (IMDSv2 or equivalent).
5. Use phishing-resistant MFA where you can, and detect password spraying.
6. Wire high-confidence detections to tested containment. Make it proportionate: a fast command rate alone does not justify pulling production offline.

CIS Controls: 6.3 and 6.5 (MFA for externally exposed apps; MFA for admin access), 7.7 (remediate detected vulnerabilities) and 16 (application software security), 13.3 and 13.6 (network intrusion detection; network traffic flow logs), 17 (incident response management).

NIS2 / ENISA: 3.2 and 3.4 (monitoring and logging; event assessment and classification), 6.7 and 6.10 (network security; vulnerability handling), 11.6 and 11.7 (authentication; multi-factor authentication).

Warp Panda and the 2.7-severity zero-day

Sourcing: CrowdStrike’s 2026 Legal Threat Landscape Report, the Broadcom advisory VMSA-2026-0006, the CISA KEV catalog addition on October 28, and tech press at The Hacker News and the Cloud Security Alliance.

The case

• CVE-2026-41709, VMware ESX, CVSS 2.7 (Low): someone who already has admin access can do certain things without them hitting the audit log. CrowdStrike calls it an ESXi command logging bypass.
• It is not a way in. It is a way to stay hidden after getting in.
• CrowdStrike says Warp Panda used it as a zero-day against US organizations, including law firms, as late as early 2026. Warp Panda is also tracked as UNC5221 / Armory Castle, Clay Typhoon and VerdantBamboo.

Timeline (2026)

Receipts

• Fixed builds per The Hacker News and the Cloud Security Alliance’s reading of VMSA-2026-0006: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, and VCF 5.2.4. Confirm against Broadcom’s matrix before you deploy. No workaround is listed.
• Broadcom’s matrix for this CVE does not list ESX 7.0. If you still run 7.0, ask Broadcom directly.
• CrowdStrike describes the wider pattern as edge-device zero-days, then vCenter, BRICKSTORM or SharpStorm for persistence, stolen M365 session tokens, and in at least one case a rogue MFA device so access survives a password reset. Not every step happened in every intrusion, and the logging bug did not enable the chain by itself.
• Why law firms: they hold privileged comms, M&A material and litigation strategy for many clients at once.

Hype check: why a 2.7 matters

• The low score fits the bug: it needs existing admin access.
• But CVSS measures what a bug lets you do, not what it lets you hide. Once an attacker is admin, blinding the logs wrecks detection and incident reconstruction.
• The KEV listing is the stronger signal here. Do not prioritize by CVSS alone.

What to do

• Patch ESX to the fixed builds, whatever the score says.
• Patching does not backfill logs that were never written. If your hosts were reachable before July 29, pre-patch logs may look clean and still be incomplete.
• Ship ESXi and vCenter logs somewhere ESX admins cannot edit, and keep them.
• Treat vCenter like a domain controller: no internet exposure, dedicated admin identities and workstations, MFA.
• Alert on new MFA device registrations for admin accounts.
• MSP angle: law firms are classic SMB clients. This report is a ready-made QBR agenda.

CIS Controls: 7.3 and 7.7 (OS patch management; remediate detected vulnerabilities), 8.2, 8.9 and 8.10 (collect, centralize and retain audit logs), 12.8 (dedicated computing resources for administrative work) and 5.4 (restrict admin privileges), 6.5 (MFA for administrative access).

NIS2 / ENISA: 3.2 (monitoring and logging, including log integrity and retention), 6.6 (security patch management), 11.3 and 11.4 (privileged accounts; administration systems).

Patch watch: Linux TCP and UEFI PXE

Sourcing: vendor trackers at Red Hat, Ubuntu, AWS and TianoCore, Anthropic’s vulnerability research post from October 27, and tech press at The Hacker News and Ars Technica. Disclosure: both bugs were found by Anthropic people or models. Status below leans on the distro and firmware vendors, not on the finder.

Part A: CVE-2026-98432, Linux kernel IPv4 TCP

• The bug: a use-after-free race in the IPv4 TCP handshake. IP options get handed to the new socket without a copy; if that socket dies while another CPU answers a resent SYN, the kernel reads freed memory. Outcomes range from a crash to memory corruption to code execution. Present since Linux 4.4. IPv6 is not hit by the main race.
• The exploit claim: Anthropic says an unreleased internal model wrote a remote, no-credentials root exploit in a test against a server with a multipath TCP (MPTCP) listener: 48 minutes to leak a kernel address, 5 more to run code. No exploit code or test config was published. No exploitation in the wild reported.
• Why MPTCP shows up: Go 1.24+ programs request MPTCP on listening sockets by default. But the bug itself is IPv4 TCP; the Go team and Red Hat say hosts without MPTCP can still be at risk.
• Severity is settled now: the kernel CNA scores it 9.8. Red Hat raised it to Critical, 9.8 on October 30 (it started at 5.9 Moderate). Ubuntu shows 9.8 with its own priority of High.

Patch status (as of November 2 to 3)

Upstream fixed kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3. Every fix needs a reboot.

Stopgaps if you cannot patch yet: Red Hat (bulletin RHSB-2026-016), Ubuntu and AWS publish a rule that drops inbound IPv4 TCP packets carrying IP options. All three say it reduces risk but does not fully prevent exploitation. It breaks anything that relies on IP options, including CIPSO security labels, so test before production. Disabling MPTCP (net.mptcp.enabled=0 or GODEBUG=multipathtcp=0 for Go) narrows the demonstrated path only.

Part B: CVE-2026-97631, EDK II UEFI network boot (PXE)

• The bug: a buffer overflow in EDK II’s PXE code. ICMP error messages get copied into a fixed 504-byte buffer with broken size checks, IPv4 and IPv6. In the code since November 2010. TianoCore rates it 9.5.
• Impact: a crafted ICMP message during a network boot can hang it. With work tailored to the exact firmware build, it can run code before Secure Boot, and that run can install something persistent.
• Exposure window: only while a machine is PXE-booting. Having EDK II-based firmware does not mean you are exposed all the time.
• Network reach: TianoCore describes an unauthenticated network attack. Red Hat and SUSE rate it adjacent-network. Real reach depends on your routing and filtering.
• Who: EDK II underpins AMI, Insyde, Phoenix and Microsoft’s Project Mu. Intel and Arm say their supported products are not directly affected. RHEL, SUSE and Debian edk2 packages (VM firmware) are listed affected.
• Patch status: fix merged October 15; no stable EDK II release has it yet. Project Mu tagged builds October 26. Operators wait for OEM BIOS updates.
• Went public early: a September 28 pull request signed off by an AMI engineer described the fix by CVE number, ahead of a planned January 2027 disclosure. Credit: Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google).

Hype check: Ars Technica’s headline says “most servers on planet Earth.” Large installed base, yes. But it takes PXE in use, the vulnerable code present, attacker traffic during boot, and a build-specific exploit. HD Moore’s realistic attacker is an insider or someone already on the LAN.

What to do

• Linux: inventory internet-facing Linux by distro and kernel package. Patch and reboot RHEL now. For Ubuntu and anything else unfixed, test the IP-options filter as a stopgap and track the vendor page daily.
• UEFI: turn off PXE where you do not need it. Where you do, isolate the provisioning network and watch for odd ICMP during boot. Track OEM firmware bulletins and include VM firmware packages.
• Both: a fix upstream is not a fix you can install. Track vendor status per platform, not the CVE.

CIS Controls: 1.1 and 2.1 (asset and software inventory), 7.2, 7.3 and 7.7 (remediation process; OS patching; remediate vulnerabilities), 4.8 (disable unnecessary services: PXE and MPTCP where unused), 12.2 (secure network architecture: isolate provisioning networks).

NIS2 / ENISA: 6.6 and 6.10 (security patch management; vulnerability handling and disclosure, where the early AMI pull request is the talking point), 6.8 (network segmentation) and 12.4 (asset inventory).

Fridge follow-up: a second European wave and a Pentagon inquiry

Sourcing: wire and network reporting from Bloomberg, CBS/Reuters/AFP, ABC News and Reuters via IBTimes, plus exposure research from Forescout, Claroty Team82, SOCRadar and Profundis. EP5 covered the first wave.

What is new: the November 2 wave

• Overnight into Monday, November 2, stores in Belgium, Luxembourg, the Netherlands, Sweden, Finland, Ireland and Estonia reported fridge and freezer temperature spikes. Outlets list slightly different countries.
• Belgium and Luxembourg: Ahold Delhaize (Delhaize) and Colruyt said an IT incident sent temperatures up in dozens of stores. The CEO of Sabcobel, which runs refrigeration for Delhaize and other chains, told Belga it was a cyberattack: evaporators were switched into defrost mode.
• Sweden: ICA said a small number of stores outside its central network were hit; its Sjöbo store posted that the units were set to 50°C. Coop said six or seven of its roughly 800 stores were affected (AFP and ABC differ by one).
• Scale: Bloomberg says the impact looks far smaller than France, potentially dozens of locations. Mostly smaller stores.
• No link established to France or between the new incidents. The same playbook (forced defrost, 50°C) is not proof of the same attacker.

The Pentagon inquiry

• Reuters reported October 29 that the Pentagon is investigating freezer failures at at least six commissaries in late August: Fort Huachuca, Fort Irwin, F.E. Warren AFB, Travis AFB, Naval Station Newport and Columbus AFB.
• US Cyber Command and Army CID’s Cyber Field Office are involved; Army CID says it is working with French law enforcement.
• Not established: that it was a cyberattack, which controllers were installed, or any link to Europe. A defrost cycle on its own is not proof.

How many are exposed?

• Use this number: Forescout found 12,976 exposed refrigeration management services on 6,017 IPs in 99 countries (about 7,075 Copeland/Dixell XWEB and 4,697 Danfoss StoreView).
• Those are services, not devices, and not proof of vulnerability. Profundis found three IP addresses made up about 45% of one Shodan result count. SOCRadar saw 2,898 Shodan results in France but only 881 unique hosts in Censys.
• The r/hacking post’s 6,628 is plausible as a raw Shodan count but unverified. Do not headline it.

Hype check: “hackers can melt every supermarket freezer”

• Reachable is not compromised. Whether someone can change temperatures depends on firmware, authentication and configuration.
• And a temperature spike is not automatically a hack. Several of the new reports are “suspected” for that reason.

The ownership gap

The store owns the equipment, a contractor runs the controller, IT runs the network, and nobody owns the combined risk. Ask clients:

1. What OT is connected, and who maintains it?
2. Who can administer it remotely, and how?
3. Is any management interface on the public internet?
4. Are end-of-life controllers scheduled for replacement?
5. Would an independent sensor catch unsafe temperatures if the controller lied?

Then fix it: pull interfaces off the internet, put contractor access behind VPN with MFA and named accounts, segment OT, patch what is supported (AK-SM 800A R4.3.1 or later), and bring refrigeration contractors into vendor risk reviews.

CIS Controls: 1.1 and 12.4 (asset inventory; architecture diagrams, with OT and contractor-managed devices included), 4.4 and 4.8 (firewalls; disable unnecessary services), 12.7 and 6.4 (remote access via VPN with enterprise auth; MFA for remote network access), 15.1 and 15.4 (service provider inventory; security requirements in contracts).

NIS2 / ENISA: 5.1 (supply chain security) and 12.4 (asset inventory), 6.7 and 6.8 (network security; network segmentation). Scope caveat: the implementing regulation binds MSPs and digital infrastructure, not supermarkets, so frame this as best practice for OT owners and check each client’s actual scope.

Icepick: when the identity directory is the breach

Sourcing: primary reporting from WIRED and TechCrunch, wire confirmation from Reuters via The Next Web, and summaries from Help Net Security and Bitdefender.

On-air note: the mechanics are the story. Motive claims are attributed to the group, and no records, names or contact details are displayed.

The case

• On October 28, DDoSecrets published Icepick: records on 41,000+ DHS employees and contractors, from a group calling itself the Department of Peace.
• Fields: names, job titles, work email and phone, office location, managers, and identity-provider group memberships that show which tools people can use (Palantir, PenLink, the Mobile Fortify face-matching app, AI tools). WIRED says records were last updated around August 19.
• Mix: more than half CBP. Counts for ICE vary (the Icepick site lists about 6,600; WIRED says roughly 10,000). The safe framing: 41,000+ records, including thousands tied to ICE and CBP.
• Claimed source: DHS’s Okta single sign-on. Okta says it is secure and has no evidence its systems were compromised. DHS says it is aware of a potential breach.

Receipts

• Reuters says three DHS employees in the data confirmed their names and contact details were real. That supports some records, not every record or the group’s account of access.
• DDoSecrets’ Emma Best says there are no home addresses; TechCrunch describes the phone numbers as work-issued.
• DHS filed a takedown through ZeroFox; Bluesky is blocking links.

Hype check: “Okta hack” and “just a directory”

• Nothing shows Okta’s platform was breached. A DHS account, token, over-broad permission or misconfiguration in DHS’s own tenant would fit both statements. None of those is confirmed.
• “Directory data” undersells it. An org chart shows who reports to whom; an IdP directory shows who can reach what. That is a targeting list for phishing and help-desk pretexting. It is still not credentials or admin control.

What MSPs should do

1. Limit who and what can enumerate users, groups and app assignments, including service accounts and API tokens.
2. Alert on bulk directory reads and privileged group changes.
3. Alert on new MFA authenticator registrations, the same lesson as Warp Panda above.
4. Use phishing-resistant MFA where you can, and require callback verification for help-desk resets.
5. Descriptive group names help attackers pick targets, but renaming is not access control. Least privilege and monitoring are.

CIS Controls: 3.3 (data access control lists: directory and group data is sensitive data), 5.1 and 6.8 (account inventory; role-based access control), 8.11 (audit log review) for bulk reads, 6.5 (MFA for administrative access) and 14.2 (social engineering training).

NIS2 / ENISA: 11.2, 11.5 and 11.7 (management of access rights; identification; multi-factor authentication), 8.1 and 8.2 (awareness raising; security training), 3.2 (monitoring and logging: identity-provider audit logs).

GoAhead: the web server inside everything

Sourcing: EmbedThis’s release notes and GitHub advisories, FoxIO’s researcher write-up, tech press at The Hacker News and SecurityWeek, and the post from John Althouse that brought it to us.

The case

• GoAhead is EmbedThis’ embedded web server, built into routers, firewalls, printers, OT and industrial gear. FoxIO says it runs in hundreds of millions of devices.
• FoxIO found three TLS bugs, one per TLS backend. Which one matters depends on the library the manufacturer compiled in and how it configured certificates.
• The fix exists, the device patch does not. GoAhead 6.1.1 went to device builders August 2. You get it only when your vendor ships firmware built on it.

Timeline (2026)

Hype check on the X post

Althouse’s post gets the big picture right: these sit inside a huge range of devices, and a library patch is not a device patch. Three claims need trimming.

• “Anyone can decrypt” DHE traffic, “extremely likely”: only on Mbed TLS builds, only TLS 1.2 DHE_RSA, and only if the client accepts a one-byte modulus. OpenSSL, current Go and Java, and mainstream browsers refuse it and fall back to a stronger key exchange. ECDHE and TLS 1.3 are not affected. Rated Medium for a reason. The risk is real for embedded or homegrown clients with no minimum-size check.
• “LibreSSL mTLS completely bypassed”: it is a chain-depth limit bypass on older LibreSSL, and only where issuer checking is already off. Builds that check the issuer, and builds on OpenSSL, BoringSSL, AWS-LC or LibreSSL 4.x, were not exposed.
• “CRLs not enforced”: accurate, and the most serious of the three. You revoke a stolen device’s cert, the config and logs look fine, and it still gets in.
• The vendor list (Palo Alto, Siemens, Boeing and others) reflects who uses GoAhead, not confirmed vulnerable builds. Whether a given product is exposed depends on its backend and config. Check each vendor’s own advisory before naming one.
• His one-byte value of “04” is not in the sources we could read. If you cite the eMudhra callback from EP6, confirm the value with FoxIO’s write-up first.

What to do

• Inventory what is inside the box. Ask vendors whether products embed GoAhead, which TLS backend, and when firmware with 6.1.1 ships. This is why SBOMs matter.
• If you rely on device mTLS with revocation, assume revocation has not worked until the vendor confirms 6.1.1. Rotate the CA or reissue certs if a revoked device is a real threat.
• Turn off TLS 1.2 DHE suites where the device lets you, and prefer ECDHE and TLS 1.3 on the clients that talk to it.
• Keep management interfaces off the internet. Same lesson as the refrigeration story above.

CIS Controls: 1.1 and 2.1 (asset and software inventory, including embedded components), 16.4 (inventory third-party software components) and 15.4 (security requirements in service provider contracts, including firmware timelines), 3.10 and 4.1 (encrypt sensitive data in transit; secure configuration, meaning kill weak cipher suites), 7.7 (remediate detected vulnerabilities).

NIS2 / ENISA: 5.1 (supply chain security) and 6.1 (security in acquisition, for example requiring SBOMs), 9.1 (cryptography: key exchange and certificate lifecycle), 6.6 (security patch management).

Three things to do before Monday

1. Hunt the extension backdoor, then govern IDE extensions (CIS 2.1, 2.5, 10.1, 13.2; NIS2 5.1, 6.9). If anyone on your team runs Claude Code in Cursor, check for 2.1.312 or 2.1.313 installed on October 29. Do not stop at uninstalling: look for the svc-telemetry key, the persistence, and the attacker IP. If it ran, treat it as an endpoint incident and rotate credentials.
2. Patch by exploitation and exposure, not by score (CIS 7.3, 7.7, 8.9; NIS2 6.6, 3.2). Get ESX onto the fixed builds; it is in KEV even at 2.7. Patch and reboot RHEL for the Linux TCP bug now, since Red Hat shipped November 1. Ubuntu is still in progress, so test the IP-options filter as a stopgap. Turn off PXE where you do not need it.
3. Find the interfaces and identity data you forgot about (CIS 1.1, 3.3, 6.8, 8.11, 12.4, 15.1; NIS2 6.7, 11.2). Scan client ranges for refrigeration and building controllers, hypervisor management and admin UIs. Then ask: who can enumerate your IdP, who can register a new MFA device, and would you know if someone downloaded the directory?

Sources

Claude Code extension

• Cursor: security notice, Anthropic.claude-code 2.1.312 and 2.1.313
• Microsoft: inside the malicious Claude Code-branded Cursor extension
• OX Security: compromised Claude Code extensions 2.1.312 and 2.1.313
• Phorion: official Claude Code extension compromise
• The Register: Anthropic says it was not its systems
• Help Net Security: Claude Code extension poisoned with SSH backdoor
• DoublePulsar (Kevin Beaumont)

Vapor Panda and ARTEX

• CrowdStrike: Vapor Panda uses ARTEX
• CyberScoop: interview and reporting
• IT Brief: CrowdStrike uncovers China-linked AI campaign

Warp Panda and VMware ESX

• CrowdStrike: 2026 Legal Threat Landscape Report
• CISA: two KEV additions, Oct 28
• The Hacker News: VMware ESX zero-day
• Cloud Security Alliance: Blind Hypervisors

Linux TCP and UEFI PXE

• Red Hat: CVE-2026-98432
• Ubuntu: CVE-2026-98432
• AWS: security bulletin 2026-160
• NVD: CVE-2026-98432
• Anthropic: discovering vulnerabilities with Claude
• The Hacker News: Linux kernel TCP flaw
• TianoCore: GHSA-99cj-7hg9-mp4m
• The Hacker News: 16-year-old UEFI flaw
• Ars Technica: UEFI code-execution flaw

Refrigeration

• Bloomberg: new suspected freezer hack across Europe
• CBS News: more grocery stores report temperature spikes
• ABC News: European grocery chains targeted
• IBTimes (Reuters): Pentagon investigates commissary freezer failures
• Euronews: why are supermarket fridges online?
• Claroty Team82: Danfoss research
• SOCRadar: exposed OT in France
• Profundis: three IPs, 45% of Shodan results
• r/hacking: 6,628 Danfoss interfaces (unverified)

Icepick

• WIRED: leak exposes 41,000 DHS workers
• TechCrunch: personnel data on thousands of DHS staff
• The Next Web (Reuters): Icepick
• Help Net Security: Icepick DHS leak
• Bitdefender (Graham Cluley): hackers leak 41,000 DHS staff records

GoAhead

• EmbedThis: GoAhead v6.1.1 release notes
• EmbedThis: GHSA-5m75-xq69-c3c5 (CVE-2026-115881)
• EmbedThis: GHSA-r392-vqwx-3r4g (CVE-2026-115884)
• EmbedThis: GHSA-fmvx-2xfx-2gq4 (Mbed TLS DH)
• FoxIO: three TLS bugs in GoAhead
• The Hacker News: GoAhead TLS flaws
• SecurityWeek: TLS flaws in GoAhead
• oss-security: GoAhead advisories
• John Althouse (@4A4133) on X