CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Attacks on the tools AI builders rely on dominated the last 48 hours. Cursor’s marketplace served a trojanized Claude Code extension that plants SSH backdoors which survive uninstall. Langflow has two new unauthenticated CVSS 9.8 flaws with a public Metasploit module, and only 1.13.0 fixes them. Chainalysis became the first prominent victim to blame “offensive agentic techniques” in its own breach notice. Congress is moving agent liability toward the operators who run them, and a second wave of refrigeration controller attacks hit stores in nine European countries.
Overnight Research Output
Trojanized Official Extension: The Claude Code Build on Cursor’s Marketplace
CRITICAL URGENCY
Summary: From 09:27 to 20:35 UTC on October 29, 2026, Cursor’s internal marketplace distributed tampered Claude Code extension builds (2.1.312/2.1.313) for macOS and Windows. Anthropic did not build them. A loader that runs when the editor starts adds an attacker SSH key, collects host details including credential variable names, and tries to open a reverse SSH tunnel. Cursor took its marketplace offline and rebuilt it. Exposed hosts need scoping, persistence cleanup or a rebuild, and credential rotation. How the attacker got into the publishing pipeline has not been disclosed.
Key Sources:
The Hacker News — Official Claude Code VS Code extension trojanized on Cursor
Help Net Security — Claude Code extension SSH backdoor
Field Effect — Trojanized Claude Code extension distributed via Cursor marketplace
Langflow 1.13.0: Two More Unauthenticated Critical Flaws and an Unpatched 1.12 Branch
HIGH URGENCY
Summary: IBM’s October 28–29 bulletin covers CVE-2026-93680 (authentication bypass, including MCP tool enumeration without credentials) and CVE-2026-110186 (code execution), both rated 9.8. It also covers CVE-2026-110193, an Agentic Assistant code-generation flaw that can run OS commands, and CVE-2026-110192, a credential exposure. Every release from 1.0.0 to 1.12.8 is affected, IBM offers no workaround, and 1.13.0 is the only fix. A Rapid7 Metasploit module targets CVE-2026-93680. Treat internet-reachable instances as an emergency patching priority.
Key Sources:
IBM — Security Bulletin: Langflow OSS affected by multiple vulnerabilities
The Hacker News — Critical Langflow flaws
Rapid7 Metasploit — langflow_auth_bypass_cve_2026_93680 module
“Offensive Agentic Techniques” Enter the Breach Record: Lessons from the Chainalysis Intrusion
HIGH URGENCY
Summary: On October 30–31, Chainalysis disclosed that an external actor used offensive agentic techniques to reach its systems and internal tools. Customer user IDs, names, emails and organization role labels were exposed. The company says investigation content, credentials and session tokens were not accessed. This appears to be the first time a prominent security-adjacent firm has named agentic AI as the intrusion method in its own disclosure. The notice has no technical detail, so defenders get a warning but nothing to act on. The most likely near-term harm is social engineering against law-enforcement and exchange users.
Key Sources:
Chainalysis — Security incident disclosure (Oct 30)
BleepingComputer — Chainalysis discloses breach from offensive agentic techniques
SecurityWeek — Chainalysis breach following AI-driven attack
The Hacker News — Chinese hackers use AI-powered ARTEX (context)
Liability Follows the Operator: The AI Agent Accountability Act, CLAIM Act, and 48-Hour Incident Demands
HIGH URGENCY
Summary: The Hawley–Murphy AI Agent Accountability Act (Oct 1) would expose operators who knowingly run a reckless agent to CFAA liability. Rep. Trahan’s CLAIM Act discussion draft would treat AI conduct as negligent or tortious if the same conduct by a human would be. On October 28, Pallone, Lofgren and Raskin asked five labs to report incidents within 48 hours (24 hours where critical infrastructure is involved), with responses due November 11. The Cantwell framework adds further reporting and preemption proposals. For enterprises, records of how agents are configured, scoped and overseen are becoming legal evidence.
Key Sources:
Axios — Hawley–Murphy AI liability bill
Rep. Trahan — CLAIM Act discussion draft (PDF)
Politico — Dem trio demands faster AI incident disclosures
When Fridges Fail Together: Correlated OT Risk in the European Supermarket Refrigeration Attacks
HIGH URGENCY
Summary: Overnight into November 2, attackers changed setpoints and forced defrost cycles on internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell xweb controllers. Stores were hit in Belgium, Luxembourg, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal and Italy, three weeks after a first wave struck hundreds of French supermarkets. Retailers pulled chilled and frozen food, and Belgium’s prosecutor opened a criminal investigation. No zero-day was needed: end-of-life units, default credentials and remote access set up by maintenance contractors were enough.
Key Sources:
The Hacker News — Second wave of cyberattacks hits supermarkets
CERT-FR — Alert CERTFR-2026-ALE-012
AP News — Europe supermarket freezer cyberattacks
Irish Times — SuperValu removes food from 13 stores
Claims Journal — Insurance coverage of refrigeration attacks
Notable News & Signals
Binance $6.3B Theft Attributed to DPRK TraderTraitor
The largest crypto theft on record. About $3B is frozen, and Binance has walked back its initial “compromised DevOps laptop” explanation while the facts are still changing.
Max-Severity GitLab RCE Under Active Exploitation
A CVSS 10.0 GitLab regex/CI configuration RCE is reported as exploited and in KEV. Confirm that self-managed instances are on the October fixed releases.
Ivanti Connect Secure: Three Chained Zero-Days
Volexity saw UTA0576 chain three zero-days to get root on fully patched appliances. One flaw still has no fix, so hunt for compromise as well as patching.
Topics Already Covered (No New Action Required)
- Northflank PaaS breach and AI key resale: Covered by “Black October Reaches PaaS: Northflank, Secret Stores, and AI Key Resale.”
- VOLTA LLM-ranked infostealer: Covered by “Appraisal by AI: VOLTA and LLM-Driven Infostealer Victim Triage.”
- ARTEX / CyberStrikeAI agentic offense: Covered by the Oct 9 ARTEX note and the Oct 28 multi-agent offensive frameworks note.
- LXD/MicroCloud certificate flaw (CVE-2026-112816): Covered by “Trusted by Certificate, Not by Key.”
- Canadian banks blocking personal AI agents: Covered by “Banks Block Personal AI Agents.”
- NIST/NSA/CISA incident readiness practices: Covered by several October notes.
- DHS DeepSeek FASCSA exclusion order: Covered by the Oct 21 and Oct 24 notes.
- Frontier lab S-1 risk disclosures: Covered by “Reading a Frontier Lab’s S-1 as a Third-Party Risk Document.”
- EU AI Act Digital Omnibus / Article 50 deadlines: Covered by existing CSA notes.
- Microsoft October 2026 Patch Tuesday: Covered by the Nov 2 CSA Slack research note.