CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Attackers spent the last 48 hours hitting the tools AI builders trust. A trojanized Claude Code extension on Cursor’s marketplace planted SSH backdoors on up to 5,000 developer machines, and uninstalling it does not remove the backdoor. Langflow 1.12.8 and earlier carry two unauthenticated CVSS 9.8 flaws, a public Metasploit module already exists, and 1.13.0 is the only fix. Chainalysis became the first prominent victim to name “offensive agentic techniques” in its own breach notice. Congress is also moving agent liability onto operators, and a second wave of refrigeration-controller sabotage across Europe shows how shared OT vendors produce correlated physical losses.
Overnight Research Output
Trojanized Claude Code Extension on Cursor’s Marketplace
CRITICAL URGENCY
Summary: Between roughly 09:27 and 20:35 UTC on October 29, Cursor’s marketplace served tampered builds of anthropic.claude-code (2.1.312 and 2.1.313). The builds contained an unobfuscated loader that ran on editor start, implanted an attacker SSH key, enabled sshd and opened a reverse tunnel. It also collected the names of secret-bearing environment variables. Anthropic did not build the code, and the official VS Code Marketplace, Open VSX and npm channels were clean. Cursor took its entire marketplace offline. Field Effect notes that whether a machine is affected depends on where the extension was downloaded and when, not on the version number alone.
Langflow 1.13.0: Two Unauthenticated Critical Flaws and an Unpatched 1.12 Branch
HIGH URGENCY
Summary: IBM’s October 28 bulletin discloses CVE-2026-93680 (authentication bypass, including MCP tool enumeration) and CVE-2026-110186 (code execution). Both score 9.8, and they sit alongside an 8.8 Agentic Assistant command-execution flaw and a credential-exposure bug. Every release from 1.0.0 through 1.12.8 is affected. Langflow 1.13.0 is the only fix, and IBM lists no workaround. A Metasploit module already opens unauthenticated MCP sessions. 1.13.0 turns auto-login off by default, so in-place upgrades need preparation (The Hacker News).
Agentic Intrusion Enters the Breach Record: Lessons from Chainalysis
HIGH URGENCY
Summary: Chainalysis disclosed on October 30 that an external actor used “offensive agentic techniques” to reach its systems and internal tools. User IDs, names, emails and organizational role labels were exposed. The company currently reports no evidence that investigation content, credentials, MFA secrets or session tokens were accessed. The notice says nothing about the initial access vector, the tools that were reached, how long the attacker had access, or which framework was used (BleepingComputer). Agentic frameworks such as ARTEX are spreading, but no public evidence links them to this intrusion.
Liability Reaches the Operator: Agent Accountability, CLAIM, and 48-Hour Reporting
HIGH URGENCY
Summary: The Hawley–Murphy AI Agent Accountability Act would expose operators who knowingly run an agent that recklessly causes hacking damage to CFAA liability. Developers without “reasonable safeguards” would face the same exposure. No bill text has been released. Rep. Trahan’s CLAIM Act draft treats AI conduct as tortious when the same conduct by a human would be. It exempts developers when intermediaries that modified or scaffolded the system were at fault, which puts deployers’ configuration records at issue. House ranking members asked five labs for incident notice within 48 hours, or 24 hours for critical infrastructure, with answers due November 11.
When Fridges Fail Together: Correlated OT Risk in Supermarket Refrigeration
HIGH URGENCY
Summary: Overnight into November 2, attackers changed setpoints and forced defrost cycles on internet-exposed Danfoss AK-SM/AK-SC and Copeland/Dixell xweb controllers. The attacks reached stores across Belgium, Ireland, Sweden, the Netherlands, Finland, Italy and other countries. They followed the October 11 wave against French supermarkets. The common factors were end-of-life devices, default credentials, and remote access set up by outside maintenance contractors. SuperValu pulled chilled food from 13 stores. Nobody has claimed the attacks and no ransom has been demanded. CERT-FR warns that a firmware update or reset alone will not secure exposed units.
Notable News & Signals
Record ~$6.3B Binance Theft Attributed to TraderTraitor
DPRK-linked actors drained Binance wallets in what is reported as the largest crypto heist to date. Binance has walked back its first “compromised DevOps laptop” explanation, so the root cause is still unsettled.
Maximum-Severity GitLab RCE Under Active Exploitation
Pre-authentication flaws in GitLab’s CI regex compiler score CVSS 10.0. Reports describe active exploitation, so self-managed instances should confirm the October fixed builds are installed.
Ivanti Connect Secure: Three Chained Zero-Days
Attackers chained three zero-days to get root on fully patched Connect Secure VPNs. One flaw in the chain had no fix when it was disclosed, and the in-memory implants evade Ivanti’s Integrity Checker.
Topics Already Covered (No New Action Required)
- Northflank PaaS breach and AI key abuse: Covered by “Black October Reaches PaaS: Northflank, Secret Stores, and AI Key Resale.”
- VOLTA LLM-ranked infostealer: Covered by “Appraisal by AI: VOLTA and LLM-Driven Infostealer Victim Triage.”
- ARTEX / Vapor Panda agentic campaign: Covered by the Oct 9 ARTEX note and the Oct 28 note on CyberStrikeAI and ARTEX.
- LXD/MicroCloud CVSS 10 certificate flaw: Covered by “Trusted by Certificate, Not by Key: CVE-2026-112816.”
- Canadian banks blocking personal AI agents: Covered by “Banks Block Personal AI Agents.”
- NIST/NSA/CISA incident-readiness practices: Covered by several October notes.
- DHS DeepSeek FASCSA exclusion order: Covered by the Oct 21 and Oct 24 notes.
- Anthropic S-1 risk disclosures: Covered by “Reading a Frontier Lab’s S-1 as a Third-Party Risk Document.”
- AISI Mythos 5 supply-chain incident: Covered by the August AISI incident notes.
- EU AI Act Digital Omnibus / Article 50 deadlines: Already covered.
- LiteLLM gateway issues: Covered by multiple 2026 notes. The Oct 23 release-pipeline compromise is pending an archive check.
- Microsoft October 2026 Patch Tuesday: Already covered.