The Hacker News (3 hours ago)
The compromise of Anthropic’s official Claude Code extension on Cursor’s extension marketplace was the result of the theft of an access key that was exposed in the wake of a breach targeting Fireworks AI.
Read the full story on The Hacker News.
This latest exploit is called SignDrop. It comes from Abdelhamid Naceri, a former Microsoft employee who has been dumping unpatched Windows bugs online under the name Nightmare Eclipse since April.
The directive protects smartphones as part of a person’s private sphere and requires “free and informed consent” for such access, the authority said.
Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.
This is a current list of where and when I am scheduled to speak: I’m speaking at the Catalyst Summit in Brampton, Ontario, Canada, on Wednesday, November 18, 2026. I’m speaking at QT Qonference 2026 in Toronto, Ontario, Canada, on Thursday, November 19, 2026. The list is maintained on this page.
Uber sends warning to drivers whose information was stolen in a data breach.
The U.S. government has disrupted a North Korean social engineering campaign called ‘FaceStealer’, responsible for stealing more than $400 million in cryptocurrency.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity security flaw impacting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the server.
Two attacks made public this week allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines (VMs), which are built to keep the server’s operator out. One of them, Mior, can also modify a VM’s memory and fake the signed report confirming which software it runs.
The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People’s Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering scheme codenamed FaceStealer in the last 18 months.
The Guardian Technology
65 active sources
20 Turkish · 45 English
All sources
