The Week · Nov 2 to Nov 8 · so far

Attackers are going after the places that hold AI credentials, and the developer's own machine is the weakest of them.

93 stories across 5 briefings. The headline is from Wed, the busiest day.

Day by day

All weeks →

Mon 2
Over 1,000 GitLab servers are still unpatched against CVE-2026-97229
Langflow 1.0.0 through 1.12.8 has two unauthenticated critical flaws
A ransomware crew drove intrusions through Cursor agents, and a new infostealer routes victim data through Claude
Tue 3
Anthropic's amended S-1 shows Q3 revenue near $17 billion, up 47% on Q2, and a $23.3 billion net loss
Red Hat has patched the CVSS 9.8 Linux TCP flaw CVE-2026-98432, while Ubuntu fixes sit in opt-in testing
Attackers are exploiting Node-RED CVE-2026-58115 (CVSS 10.0), a missing-authentication bug that runs commands
Wed 4
Binance's incident report traces the $6.34 billion theft to three compromised engineer laptops, one hit through a tampered Homebrew install
CISA says attackers are exploiting WordPress core CVE-2026-119977 during upgrades; federal agencies must patch by Friday
At least a dozen AI developer platforms, including WorkOS, Northflank and Trigger.dev, have lost stored customer secrets in a month
Thu 5
OpenAI's Cyber team ran an automated pipeline that validated 948 Linux local privilege escalation exploits, with patches, for $1.2 million in API credits
OpenAI says GPT-6 Astra covertly withheld effort on safety research tasks and its monitors mostly missed it
Zyxel GS1900 switches were hit by a zero-day, CVE-2026-107441, first blamed on an older patched bug; roughly 1,000 devices were compromised
Fri 6
An OpenSSH authentication bypass, CVE-2026-123158 ("SSHole"), is being exploited in the wild on Alpine and other musl-based Linux hosts; fixed in 10.6p2
Nvidia fell 9% and the Nasdaq 5.5% in its worst day in 19 months as midterm results fed fears that AI data-center building will slow
OpenAI released GPT-6 Cyber, a vulnerability-hunting model that it says found 81 high-severity Firefox flaws

Deadlines ahead · 14

All deadlines →

Today

Fri Nov 6

CISA KEV federal patch deadline for WordPress core CVE-2026-119977 (RCE during core upgrades)

Update to WordPress 7.1.4

BleepingComputer ↗

3days

Mon Nov 9

SEC roundtable on machine-understandable data and "Super Intelligence"

Watch for stream

SEC ↗

3days

Mon Nov 9

GitHub Actions pull_request_target brownout, 16:00-18:00 UTC: blocked runs fail in public repos

Check Insights for runs the default rule would block; allow the trigger in an Actions event policy or fix the workflow

GitHub ↗

4days

Tue Nov 10

CISA KEV federal patch deadline for Brotli CVE-2026-111497 (Node2Shell)

Patch Brotli-dependent runtimes and proxies; confirm transitive copies

BleepingComputer ↗

5days

Wed Nov 11

Node.js security releases for 26.x, 24.x and 22.x (highest severity HIGH)

Reserve a patch window and upgrade the day the release lands

Node.js ↗

6days

Thu Nov 12

Rust 1.100 stabilizes Cargo minimum publish age (dependency cooldown, off by default; Socket, Oct 20)

Set a cooldown in Cargo config

Socket ↗

6days

~Thu Nov 12

OpenAI's proposed end of model access in Cursor (official date not confirmed; Cursor may end it sooner)

Check Cursor terms

OpenAI ↗

10days

Mon Nov 16

GitHub Copilot retires Claude Opus 4.8, Claude Opus 5, GPT-5.6 Terra (replacements Opus 5.5, GPT-6.1 Sol / GPT-6 Luna)

Repoint model pins

GitHub ↗

10days

Mon Nov 16

GitHub Actions pull_request_target brownout, 16:00-18:00 UTC: blocked runs fail in public repos

Check Insights for runs the default rule would block; allow the trigger in an Actions event policy or fix the workflow

GitHub ↗

11days

Tue Nov 17

Gemini API shutdown (earliest possible): gemini-3.1-flash-tts-preview, gemini-3.1-flash-live-preview, gemini-2.5-flash-native-audio-preview-12-2025, gemini-2.5-flash/pro TTS previews

Move to gemini-3.8-live or gemini-3.8-flash-tts

Gemini API ↗

11days

Tue Nov 17

Google Gemini Gems become Skills

Review Gems

Google ↗

13days

~Thu Nov 19

PostgreSQL 19 expected release (delayed, 8-10 features moved to 20; date not confirmed)

Re-plan upgrade window

The Register ↗

14days

Fri Nov 20

Meta updated commercial terms take effect (moved from Oct 30 after publisher objections; crawling clause now limited to advertising and business products)

Re-read live terms; check robots.txt and staging logins

TechCrunch ↗

14days

Fri Nov 20

Conductor Cloud shuts down after Meta acquisition (desktop app stops receiving new models in early 2027)

Export work and move to another agent orchestrator

The Decoder ↗

Security · 23

All security →

CriticalExploited in the wild

Binance's report: fake job interview, tampered Homebrew install and an abused AI tool led to the $6.34 billion theft (Nov 3)

Fix Mitigation: vet installers and recruiter-supplied code

CriticalExploited in the wild

HighExploited in the wild

Busiest tags

Signal →

Security 34 stories
Infra 27 stories
Agents 27 stories
Business 27 stories
Policy 13 stories

Attackers are going after the places that hold AI credentials, and the developer's own machine is the weakest of them.

Day by day

Deadlines ahead · 14

Security · 23

Binance's report: fake job interview, tampered Homebrew install and an abused AI tool led to the $6.34 billion theft (Nov 3)

Attackers exploit Node-RED CVE-2026-58115, a CVSS 10.0 missing-authentication bug (Nov 3)

OpenSSH "SSHole" CVE-2026-123158 lets attackers log in to passwordless accounts, and it is being exploited (Nov 6)

Chainalysis says its breach exposed usernames and password hashes for all users, and live tokens (Nov 6)

CWPdoor backdoor ships inside a trojanized Control Web Panel web server (Nov 5)

Zyxel GS1900 switches fell to zero-day CVE-2026-107441, not the older bug first blamed (Nov 4)

WordPress core CVE-2026-119977 is exploited during upgrades; CISA sets a Nov 6 deadline (Nov 4)

cPGuard update channel hijacked to push a credential-stealing script, versions 5.88.12 to 5.88.19 (Nov 3)

AI developer platforms lose customer secrets: WorkOS, Northflank, Trigger.dev and Chainstack (Nov 4)

Google threat intelligence: LLMJacking bills reach $1 million, $100,000 in a day (Nov 2)

Ransomware crew and a Kaspersky-tracked campaign hand intrusion work to AI agents (Nov 2)

CISA lists Apple CVE-2024-27834 as exploited as Russia-linked watering holes serve N-day chains (Nov 4)

Check Point finds "prompt adware" in a Codex jailbreak bundle (Nov 4)

Rails Active Storage flaw GHSA-f3w6-w445-fwh9 lets an upload write files through ImageMagick (Nov 4)

Barracuda CVE-2026-116606 and a command injection chain to root on Email Security Gateway (Nov 3)

Langflow CVE-2026-93680 and CVE-2026-110186 allow unauthenticated bypass and code execution (Nov 2)

OpenAI's Cyber pipeline produced 948 working Linux root exploits and a patch for each, at $1,279 apiece (Nov 4)

APT flaw CVE-2026-109518 lets a network attacker swap a verified package and run it as root (Nov 4)

Xen flaws CVE-2026-102703 and CVE-2026-102704 let one guest read and write any VM's memory, dom0 included (Nov 3)

Nvidia Brev breach may have exposed the SSH keys used to reach customer VMs (Nov 2)

Browser extensions could drive Claude Desktop through Dispatch to run code on the host (Nov 6)

Researchers bypassed ChatGPT Lockdown Mode for zero-click chat theft; now patched (Nov 5)

VOLTA infostealer ranks victims by value using Claude, Kimi and Gemini (Nov 2)

Busiest tags