Sana Ullah Khan
English

All security news

Daily brief

Daily Security Brief: Ivanti Exploitation, Trezor Hardware Implant, and WordPress RCE

Written automatically by AI from the day's headlines. Check the linked sources before you act on it.

Ivanti Connect Secure Flaws Exploited for Root Access

The U.S. Cybersecurity and Infrastructure Security Agency has added Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog following active exploitation. Attackers are reportedly chaining three security flaws to gain unauthenticated root access to affected devices. Administrators managing Ivanti Connect Secure appliances should apply available vendor updates immediately to block compromise.

Sources: The Hacker News, CISA advisories

Hardware Crypto-Theft Implant Discovered in Trezor Safe 5 Wallet

Hardware wallet manufacturer Trezor warned customers of a suspected hardware implant found in a Trezor Safe 5 device purchased through reseller CryptoBilis in Southeast Asia. The modified device reportedly contains an unauthorized circuit board that transmits the user’s recovery seed phrase over a cellular network. Users who bought devices from this reseller should verify their hardware integrity and avoid using compromised units.

Sources: BleepingComputer, The Hacker News

Malicious Cursor Extension Drops SSH Backdoors on Developer Systems

A rogue version of Anthropic’s Claude Code extension was briefly hosted on Cursor’s extension marketplace for roughly 11 hours. Up to 5,000 developers who downloaded the malicious extension were exposed to malware designed to plant persistent SSH backdoors on their systems. Affected developers should audit their SSH authorization files and remove any unauthorized keys immediately.

Source: BleepingComputer

Security researchers demonstrated that a malicious ChatGPT share link could execute attacker code within a victim’s active user session. This vulnerability reportedly allowed unauthorized access to read private chat conversations of users who opened the compromised link. Users should avoid clicking shared chat links from untrusted sources while interacting with AI platforms.

Source: The Hacker News

High-Severity WordPress Vulnerability Triggers Mass Exploitation Wave

Attackers have launched tens of thousands of automated exploits targeting a newly disclosed high-severity vulnerability in WordPress Core. The flaw stems from an unauthenticated race condition that can allow remote code execution on unpatched installations. Site administrators should immediately update their WordPress installations to the latest version to prevent automated takeover.

Sources: The Hacker News, SecurityWeek

Florida Financial Aid Data Breach Leaks 4.9 Million SSNs

Florida’s Department of Education revealed that a security breach on the Florida Student Financial Aid website compromised sensitive personal data. The incident exposed the Social Security numbers of approximately 4.9 million individuals. Affected state residents and student applicants should monitor their financial accounts and consider placing a fraud alert or credit freeze.

Source: The Record

What to do this week

  • Update WordPress core installations and Ivanti Connect Secure appliances to the latest versions immediately.
  • Verify hardware crypto wallets and avoid entering recovery seed phrases into unvetted or tampered devices.
  • Audit IDE extensions and remove unauthorized SSH keys if you downloaded recent tools from third-party marketplaces.
  • Avoid opening untrusted shared AI conversation links to protect your account session and privacy.

Stories this brief is based on