Blog

Executive Summary On 29 October 2026, Cisco Talos Intelligence identified NIK C2, a Go-based Windows command-and-control framework that combines credential theft, surveillance, remote access, lateral movement, defense evasion, and screen-locking ransomware capabilities within a single implant, which can utilize OpenAI capabilities. The malware integrates the OpenAI Chat Completions API through an ai_generate command, allowing operators…

Executive Summary On 29 October 2026, the official Anthropic Claude Code extension was compromised on the Cursor Marketplace and used to install a persistent SSH backdoor on infected hosts.  The issue was traced to a compromise of the Cursor Marketplace, and Cursor briefly took down the service to remove the malware. Cursor says the incident…

Executive Summary CISA added the critical PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) Catalog following confirmation of in-the-wild exploitation. In-the-wild RCE was confirmed after honeypot activity recorded successful exploitation against an Apache mod_php installation running PHP 8.4.26. This represents an escalation from earlier reporting in which Cloudflare, Amazon, Hadrian, watchTowr, Previdian,…

Executive Summary A critical flaw dubbed “HTTP2Shell” in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. Tracked as CVE-2026-111497s the vulnerability is also known as “Broccoli2Shell” and “Node2Shell.” Node.js says the flaw can crash the process, expose memory, and enable remote code execution (RCE), and…

Executive Summary PHP has released an advisory on 21 October 2026 detailing the vulnerabilities listed above, confirming the severity of CVE-2026-109618 and CVE-2026-109619. PHP is encouraging affected users to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older will not receive relevant update packages to mitigate CVE-2026-109618 and CVE-2026-109619, but some distributions…