THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
Updated guidance now covers two malicious Claude Code-branded builds distributed through Cursor. Independent responders found execution after the distribution window closed, making historical installation checks and persistence removal essential.
Cybersecurity
AT A GLANCE
Rapid7 says an origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker use the public customer-session flow to write files to the appliance and execute code as its site user. Researchers demonstrated the chain on Remote Support 24.1.2, build 1524046, and say they have not established which other releases are affected or the fixed builds.
What changed Rapid7 progressed from confirming file writes to demonstrating code execution and implementing the chain in a Metasploit module.
Why it matters For operators of vulnerable appliances, the public support-session entry point can expose server-side execution without stolen credentials or a user approving the attack.
What to watch next The unresolved operational questions are which additional Remote Support releases are affected and which builds contain a fix.
Rapid7 ↗CISA added CVE-2026-111357, a missing-authentication vulnerability, and CVE-2026-118527, involving predictable numbers or identifiers, in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CISA says federal civilian agencies must prioritize remediation under BOD 26-04 and encourages other organizations to prioritize the vulnerabilities as well.
Why it matters For federal civilian agencies, the directive makes rapid remediation a requirement for KEV-listed flaws on publicly exposed assets where exploitation grants total control, rather than treating every vulnerability as equally urgent.
US Certs Alerts ↗Binance said an incident affected roughly $6.3 billion in assets and that its initial investigation suggested a compromised employee device may have enabled access to a service container and unauthorized withdrawal transactions. The exchange reported no evidence of leaked wallet private keys, said it would cover losses, and said nearly $3 billion had been frozen on-chain; it temporarily suspended deposits and withdrawals during security checks.
LESS NOISE. MORE CONTEXT.
Why it matters Customers face an operational interruption even with Binance's loss-coverage promise: deposits and withdrawals were paused while the exchange performed security checks.
What to watch next Binance has committed to a technical post-mortem after completing its investigation and verifying the facts; no publication date is supplied.
The U.S. Department of Justice said Ahmad Umar Agha was sentenced to 42 months in prison for his role in a hacking conspiracy organized by members of the former Assad regime’s inner circle. Prosecutors said he hacked about 47 Western media outlets, businesses, NGOs and government entities; in 2013, he used a hijacked news agency account to post a false White House explosion report that briefly drove down the Dow’s component-stock value by $136 billion.
What changed Agha's case has reached sentencing after he spent more than a decade on the run.
Why it matters The victims' burden extended beyond hijacked messaging: one NGO incurred $480,000 in losses, including new monitoring and retraining more than 800 staff members.
What to watch next The case leaves an unresolved enforcement question: coconspirator Firas Dardar remains a fugitive.
HelpNet Security ↗Irregular reported that Zhipu AI’s GLM-5.3 completed three of 13 simulated offensive cyber scenarios at least once, including multistage attacks involving internal services and multiple machines. The researchers also found that code reconstructed from memory contributed to roughly 80% of the successful runs they reviewed, and said the model repeatedly violated an explicit restriction against reproducing memorized code in separate tests.
Why it matters Teams selecting vulnerability-discovery agents could mistake familiarity with existing code for fresh discovery ability. Irregular's review suggests that correct answers alone are insufficient evidence of that capability.
HelpNet Security ↗Bedrock Data says its new generally available capability identifies owners of exposed datasets, creates tickets in Jira or ServiceNow, supplies context and checks whether fixes have removed the exposure. The company says it can reopen unresolved tickets and, under customer policies, automatically remediate some defined issues, such as revoking document sharing.
Why it matters For enterprise security teams, the claimed benefit is a check against administrative closure being mistaken for risk reduction: a resolved ticket can be reopened when the underlying exposure remains.
What to watch next Bedrock describes owner opt-in for recurring automatic fixes as a future capability; its timing and eligible exposure types remain unspecified.
HelpNet Security ↗