Skip to content
Monday, November 2, 2026Nov 2, 2026
Previous issue

Correction · Nov 3, 2026

Before publication, we corrected this edition’s source grouping and withheld a report that lacked corroboration.

  • The Claude Code extension story is corroborated by Cursor’s earlier account of the same incident. Unrelated VOLTA reporting was removed from its source group.
  • The BTCPay report and its associated action were withheld after unrelated Binance and Byoky articles were found in its source group.
  • Source-match counts describe the original generation and are not a factual certification of this review.

Vol. 1, No. 44Composed Nov 3 · 04:56 UTC

SitRep

Cybersecurity, in perspective.

3 elevated3 stories on the wire

Scale amplifies mistakes; measured choices preserve agency.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

Hackers Disrupt Supermarket Refrigeration Systems

Hackers changed supermarket refrigeration settings; separate reports cover product vulnerabilities and tampered developer extensions.

3 sources

BleepingComputer, SecurityWeek, CERT/CC Vulnerability Notes

BleepingComputer reports that hackers remotely changed freezer and cooling-system temperature settings, disrupting stores run by multiple supermarket chains across several European countries. Separately, SecurityWeek reports that around 5,000 developer systems may have downloaded tampered extension versions during an 11-hour period.

Context

BleepingComputer reports refrigeration-system disruption across multiple supermarket chains and several European countries. SecurityWeek reports that tampered Claude Code Extension versions were available in Cursor's marketplace for about 11 hours and that around 5,000 developer systems may have downloaded them; Anthropic said its official channels were unaffected.

“The reported download estimate is around 5,000 developer systems; the source does not say how many systems installed the extensions.”
From Senecowitz · Analysis

On the wire

  • 0critical
  • 3elevated
  • 0moderate
  • 0low
P1Operational

INFINITT PACS System Manager Has Code Execution Flaws

Versions 3.0.11.3 and 3.0.11.5 · INFINITT Healthcare remediated the issues

CERT/CC reports that INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare remediated the issues in System Manager versions.

CVE-2026-16305: CVSS 7.8; CVE-2026-16306: CVSS 9.8

CERT/CC VULNERABILITY NOTES · INFINITT PACS System Manager Code Execution Vulnerabilities

Copy link to “INFINITT PACS System Manager Has Code Execution Flaws”

P1Exploit

Ivanti Patches More Zero-days in Connect Secure Chain

Fixes in versions 25.1.1.3 and 22.8R2.6

Ivanti patched two additional Connect Secure zero-days, CVE-2026-111357 and CVE-2026-118527, which were added to the prior CVE-2026-104935 advisory. SecurityWeek reports that attacks chained all three flaws against a limited number of customers. The fixes are in versions 25.1.1.3 and 22.8R2.6.

Updated Since Oct 31: Ivanti Connect Secure Enables Unauthenticated Root · CVE-2026-111357, CVE-2026-118527, CVE-2026-104935 · New: bleepingcomputer.com, securityweek.com, helpnetsecurity.com

Timeline

  1. Oct 13Ivanti Connect Secure zero‑day CVE-2026-104935 Exploited in the Wild
  2. Oct 14Immediate Patch and Remediation for Ivanti Connect Secure CVE-2026-104935
  3. Oct 31Ivanti Connect Secure Enables Unauthenticated Root
  4. This edition

Added to CISA KEV: CVE-2026-104935 on 13 Oct 2026; CVE-2026-111357 on 30 Oct 2026; CVE-2026-118527 on 30 Oct 2026 · CVE-2026-111357: CVSS 7.0, EPSS <0.01 (FIRST); CVE-2026-104935: EPSS 0.87 (FIRST)

SECURITYWEEK · Ivanti Patches Two More Zero-Days in Connect Secure Chain

Copy link to “Ivanti Patches More Zero-days in Connect Secure Chain”

P1Supply Chain

Attackers Publish Tampered Claude Code Extensions

Versions 2.1.312 and 2.1.313 · About 11 hours · Around 5,000 potential downloads

SecurityWeek reports that attackers published tampered Claude Code Extension versions 2.1.312 and 2.1.313 in Cursor's VS Code Extension Marketplace for about 11 hours; around 5,000 developer systems may have downloaded them. The loader attempted host reconnaissance and SSH key actions. Anthropic said its official channels were unaffected.

SECURITYWEEK · Malicious Claude Code Extension in Cursor Supply Chain Attack

Copy link to “Attackers Publish Tampered Claude Code Extensions”

The wire, last 30 days

This edition has 3 stories rated critical or elevated (P0 or P1); the 22 daily editions from 5 Oct to 1 Nov averaged 3.7. 7 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
2 Nov (this edition)0300
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Google Disrupts XCPE Android Botnet, Bans Videostrong TV Box Maker

Google and partners dismantle the XCPE Android malware botnet, linked to Videostrong Technology Co., infecting over 1.3 million Android TV boxes. The backdoor enabled ad fraud, residential proxies, and additional malware via modules and an MQTT-backed C2. Disruption cut access to at least 10 million more compromised devices.

4 reports

Multipath TCP: Use and Detection

Multipath TCP use and detection explains MPTCP, enabling a single connection to switch between IP addresses (v0 and v1) to suit mobile handoffs. It covers MPTCP options MP_CAPABLE, MP_JOIN, DSS, ADD_ADDR/REMOVE_ADDR, and how to detect MPTCP via TCP Option 30 with tools like Wireshark, Suricata, Zeek.

3 reports

Chainalysis Discloses Data Breach From AI-Driven Cyberattack Incident

Chainalysis reports an AI-driven cyberattack with attackers using offensive agentic techniques to access systems and internal tools. Some non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels, were accessed. The breach is not tied to the Binance heist. Number of affected individuals not disclosed.

3 reports

FBI Flags TraderTraitor Addresses in Binance Heist

The FBI formally attributed the Binance hack to North Korea's TraderTraitor, pegged at about $6.3 billion. The alert lists 608 Ethereum addresses, 19 Bitcoin addresses, and 1 Solana address linked to the theft. Investigators urge industry actors to refuse transactions from these addresses as laundering proceeds continue.

3 reports

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI

Threat researchers identify VOLTA-AUTODOXER, a Windows infostealer that harvests credentials, tokens, wallets, and more, ranking victims by monetization value using an AI chain via OpenRouter. It collects data from browsers, Slack, Outlook, and Gmail receipts, then generates a monetized dossier with a ‘WHAT THEY’RE WORTH’ section. Exfiltration occurs in three stages over Telegram.

3 reports

Microsoft Windows Cloud Files Mini Filter Driver Type Confusion Vulnerability

Talos identifies CVE-2026-80093, a type confusion flaw in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affecting specific WinBuild versions. An attacker can exploit via a crafted Cloud Filter API sequence to trigger a kernel crash and potential write primitive. Exploitation involves CfAbortOperation and hydration/abort flows, with CVSS v3.1 score 8.8.

2 reports

BITTER APT Delivers PapRAT via Fake Diplomatic Documents

BITTER APT, active since at least 2013, targets South Asian government, energy, and engineering sectors. FortiGuard Labs links three infection chains delivering PapRAT to Windows. Chain one uses diplomatic-themed LNK shortcuts with ftp.exe, curl, PowerShell, and scheduled tasks exfiltrating to abc.pdf. Chain two mounts a VHDX and launches Visa_Details.msi.

2 reports

Also reported

End of the Monday, November 2, 2026 edition.

Colophon

SitRep · Vol. 1, No. 44

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.