Summary
A ransomware attack has turned Pedigo Products’ internal network into a source of risk for thousands, with Interlock exfiltrating 1.3 terabytes of sensitive business and personal data. The breach, which forced the medical equipment maker to shut down systems and call in outside experts, exposed everything from trade secrets and payroll records to Social Security numbers. Cyware.com notes that affected employees and customers now face a two-year window of identity monitoring as the company works to contain the fallout.
A critical zero-click Linux kernel flaw, CVE-2026-98432, has demonstrated how a single race condition can hand remote attackers root access on exposed servers. The bug, discovered and exploited by Anthropic’s AI model, targets Multipath TCP listeners and highlights the growing risk of automated vulnerability discovery in widely used infrastructure. With no patches yet from major distributions like Ubuntu and RHEL, organizations are urged to update as soon as fixes become available.
Lazarus Group is actively scanning for PHP2Shell vulnerabilities, using 21 compromised nodes to quietly probe government, financial, manufacturing, logistics, and aviation targets across the US, Japan, and South Korea. The campaign leverages memory corruption flaws to establish persistent access, raising the specter of credential theft and espionage. This low-volume, targeted approach underscores the evolving tactics of state-linked threat actors.
Top Malware Reported in the Last 24 Hours
Interlock ransomware hits Pedigo Products data
Interlock ransomware was tied to a breach at Pedigo Products Inc., a medical and healthcare equipment manufacturer, after attackers infiltrated its corporate network in July 2026 and launched the attack on September 15, 2026. The company said it shut down systems and brought in outside cybersecurity specialists, but the gang later claimed it had stolen 1.3 terabytes of data. The exposed material spans sensitive business records—such as customer-specific pricing, contracts, FDA quality records, CAD files, trade secrets, payroll, bank details, and legal documents—as well as personal data including names, addresses, dates of birth, financial account information, and Social Security numbers. For employees and customers, that mix can translate into identity theft risk and long-lasting business disruption if proprietary documents or financial records are abused. Pedigo Products is offering 24 months of identity monitoring and said affected people can seek identity restoration help by calling 833-931-9222; enrollment is open until January 31, 2027.
Polymarket web malware drains $2M+
Polymarket users lost more than $2 million after malware was embedded in a third-party script that ran automatically when visitors loaded Polymarket[.]com. Hudson Rock said it found the malicious code inside a DebugBear script used for website performance monitoring, turning a common site dependency into a delivery mechanism. Once executed, the malware compromised user positions and transferred funds to an attacker-controlled wallet, turning routine trading activity into direct financial loss. DebugBear acknowledged a security incident but did not provide further details, while Polymarket said affected users will be reimbursed. Users were advised to monitor their accounts for unauthorized transactions and change their passwords.
Backdoored Claude extension hits Cursor users
A backdoored version of Anthropic's VS Code extension for the Claude model was distributed through Cursor, potentially reaching up to 5,000 developers before it was removed. The malicious release was available for nearly 12 hours and attempted to install a persistent SSH backdoor, while also collecting host and user information and trying to set up a reverse SSH tunnel. It also stole variable names in an apparent effort to inventory cloud credentials and API tokens, meaning a single poisoned developer tool could put downstream systems and secrets at risk. Neither Cursor nor Anthropic has explained how attackers gained control of the account, and the report noted Anthropic had not issued a public warning at the time. Cursor said it worked with its cloud provider to block infected devices from reaching the server and shut down the VS Code Marketplace to rotate keys and audit access controls; users who installed or updated during the affected window were told to check for indicators of compromise, review unauthorized SSH keys, and audit cloud credentials and API tokens.
Top Vulnerabilities Reported in Last 24 hours
Zero-click Linux bug enables remote root
A critical zero-click Linux kernel vulnerability (CVE-2026-98432) lets remote, unauthenticated attackers execute commands with root privileges on exposed servers, with demonstrations focusing on systems running Multipath TCP (MPTCP) listeners. Anthropic reported the bug as a race-condition-induced use-after-free in the kernel networking stack, triggered by mishandling of IP options during TCP connection establishment, which can be turned into remote code execution. No active exploitation has been reported in the provided source; the coverage describes a demonstrated exploit and warns about impact at internet scale. Anthropic’s researchers highlighted the finding as an example of an AI model (Claude) identifying and exploiting a flaw in widely used software. Apply security updates for the listed fixed kernel versions (5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7) and consider disabling MPTCP if it is not required; as of October 30, Ubuntu and RHEL had not released patched kernels, according to the report.
CISA flags exploited Ivanti gateway bugs
CISA added two Ivanti Connect Secure vulnerabilities—CVE-2026-111357 and CVE-2026-118527—to its Known Exploited Vulnerabilities (KEV) Catalog after confirming attackers are exploiting them. In plain terms, the issues can enable unauthorized access and control because they involve Missing Authentication for Critical Function and Generation of Predictable Numbers or Identifiers, according to CISA’s alert. Attackers are already exploiting this in the wild. CISA tied the urgency to Binding Operational Directive 26-04, which requires federal agencies to prioritize remediation—an indicator the agency believes exploitation risk is immediate and real. The affected product is Ivanti Connect Secure.
BeyondTrust Remote Support bug enables RCE
An unauthenticated file upload flaw in BeyondTrust Remote Support (CVE-2026-102764) can let an internet-based attacker run code remotely as the site’s operating-system user, turning a support appliance into a foothold for deeper compromise. Rapid7’s analysis says the attack starts by opening an anonymous session and then forging a message the appliance treats as local, manipulating the internal message router (brain) and the appliance-side customer worker (thin-scc) to reach the native file-transfer service and convert a file write into PHP execution. A working exploit has been publicly released in the form of a Metasploit module described in the write-up. Rapid7 published the technical breakdown and highlighted that attackers can control file contents and destinations, including retrieving sensitive data such as /proc/self/environ. Monitor logs for unexpected PHP files under the site’s public directory and receive files ending in .php.n$t, and ensure vulnerable systems are patched or upgraded to supported versions.
Top Threat Actors Reported in Last 24 hours
Lazarus Group-linked scans probe PHP2Shell
Lazarus Group (suspected North Korea-linked) is being tied to an active hunt for internet-exposed systems vulnerable to the so-called PHP2Shell flaws, a campaign that could quickly turn routine web servers into long-term access points. They are scanning for CVE-2026-109618 and CVE-2026-109619, described as memory-safety issues in the PHP runtime involving memory corruption and use-after-free conditions that can enable remote code execution. The activity has been observed across government, financial, manufacturing, logistics, and aviation targets in regions including the United States, Japan, and South Korea—raising the risk of credential theft, data collection, and persistent access that could feed espionage or even infrastructure compromise in logistics and aviation environments. The group is keeping a low profile by using 21 compromised nodes to run low-volume scans, and the scanning setup is reported to be separate from previously identified staging addresses. The advisory’s recommended actions include verifying the PHP version used by active web-serving processes, applying patches for affected versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and enhancing monitoring for unusual PHP session behavior and memory errors.
North Korean front firms push interview malware
North Korean operators (suspected state-linked) are using a corporate-looking cover story to get malware onto victims’ machines, leaning on US-registered front companies such as BlockNovas, Angeloper Agency, and SoftGlide. They distribute malicious tooling through fake job interviews, positioning the campaign as a pipeline into crypto platforms like Bybit and Binance rather than a one-off infection wave. For people working in crypto—especially engineers and operations staff—this turns routine recruiting outreach into a pathway for theft and unauthorized access that can ripple into customer funds and platform integrity. The operators also use residential proxy networks to obscure where connections are coming from, complicating efforts to trace and contain intrusions. Silent Push said its Indicators of Future Attack (IOFA) feeds identified 206 Binance-named domains as high risk, with 64 returning live pages in recent scans, and noted recruitment of IT workers via platforms like Discord.
Warp Panda abuses ESXi logging gap
Warp Panda is exploiting a low-scored but practical weakness in VMware ESXi that lets an administrator perform actions without leaving an audit trail. By using CVE-2026-41709, they can operate in virtualized environments while reducing the forensic evidence that typically helps defenders reconstruct what happened. For businesses that rely on ESXi to run critical workloads, that missing visibility can translate into longer dwell time, slower incident response, and greater uncertainty about what systems were touched. CISA reported active exploitation and said the flaw was identified and reported with CrowdStrike, underscoring that “low severity” scores don’t always reflect real-world attacker value. Broadcom released security updates dated July 29 for the issue.
Frequently Asked Questions
What is Interlock? Interlock ransomware was tied to a breach at Pedigo Products Inc., a medical and healthcare equipment manufacturer, after attackers infiltrated its corporate network in July 2026 and launched the attack on September 15, 2026. The company said it shut down systems and brought in outside cybersecurity specialists, but the gang later claimed it had stolen 1.3 terabytes of data.
What is Polymarket? Polymarket users lost more than $2 million after malware was embedded in a third-party script that ran automatically when visitors loaded Polymarket[.]com. Hudson Rock said it found the malicious code inside a DebugBear script used for website performance monitoring, turning a common site dependency into a delivery mechanism.
What is Anthropic's VS Code extension? A backdoored version of Anthropic's VS Code extension for the Claude model was distributed through Cursor, potentially reaching up to 5,000 developers before it was removed. The malicious release was available for nearly 12 hours and attempted to install a persistent SSH backdoor, while also collecting host and user information and trying to set up a reverse SSH tunnel.
What is CVE-2026-98432? A critical zero-click Linux kernel vulnerability (CVE-2026-98432) lets remote, unauthenticated attackers execute commands with root privileges on exposed servers, with demonstrations focusing on systems running Multipath TCP (MPTCP) listeners. Anthropic reported the bug as a race-condition-induced use-after-free in the kernel networking stack, triggered by mishandling of IP options during TCP connection establishment, which can be turned into remote code execution.
What is CVE-2026-111357? CISA added two Ivanti Connect Secure vulnerabilities—CVE-2026-111357 and CVE-2026-118527—to its Known Exploited Vulnerabilities (KEV) Catalog after confirming attackers are exploiting them. In plain terms, the issues can enable unauthorized access and control because they involve Missing Authentication for Critical Function and Generation of Predictable Numbers or Identifiers, according to CISA’s alert.
What is CVE-2026-102764? An unauthenticated file upload flaw in BeyondTrust Remote Support (CVE-2026-102764) can let an internet-based attacker run code remotely as the site’s operating-system user, turning a support appliance into a foothold for deeper compromise. Rapid7’s analysis says the attack starts by opening an anonymous session and then forging a message the appliance treats as local, manipulating the internal message router (brain) and the appliance-side customer worker (thin-scc) to reach the native file-transfer service and convert a file write into PHP execution.
What is Lazarus Group? Lazarus Group (suspected North Korea-linked) is being tied to an active hunt for internet-exposed systems vulnerable to the so-called PHP2Shell flaws, a campaign that could quickly turn routine web servers into long-term access points. They are scanning for CVE-2026-109618 and CVE-2026-109619, described as memory-safety issues in the PHP runtime involving memory corruption and use-after-free conditions that can enable remote code execution.
What is Warp Panda? Warp Panda is exploiting a low-scored but practical weakness in VMware ESXi that lets an administrator perform actions without leaving an audit trail. By using CVE-2026-41709, they can operate in virtualized environments while reducing the forensic evidence that typically helps defenders reconstruct what happened.
What is US-registered front companies? North Korean operators (suspected state-linked) are using a corporate-looking cover story to get malware onto victims’ machines, leaning on US-registered front companies such as BlockNovas, Angeloper Agency, and SoftGlide. They distribute malicious tooling through fake job interviews, positioning the campaign as a pipeline into crypto platforms like Bybit and Binance rather than a one-off infection wave.