The Fine Print

The key is the product

Cursor’s incident report, published November 13, says a stolen Fireworks AI access key exposed a read-only bucket of coding-agent traces — mostly from 2025, from users not in Privacy Mode. Fewer than 0.05% of users had traces exposed, and fewer than 0.01% had API credentials compromised. Those are small numbers, and Cursor leads with them. The part that matters more is what the key enabled. Malicious Claude Code versions 2.1.312 and 2.1.313 sat on the Cursor marketplace cache from October 29, live about eleven hours, reaching up to 5,000 users. The payload tried to install a persistent SSH backdoor: attacker key, SSH enabled, persistence. Coding errors likely stopped it on many Windows and macOS machines where SSH wasn’t already on. The last attacker activity was November 1, now blocked. Anthropic’s legitimate extension and Open VSX were not compromised, and Cursor moved inference off Fireworks and rebuilt the marketplace. The same Fireworks breach is the one behind the Uber drivers’ license exposure, and the Railway incident — $740,000 in fraudulent AI charges — belongs to the same campaign of AI-key theft. Cursor/Fireworks

Zeabur tells the same story from the other side of the table. The cloud platform’s own preliminary report, dated October 19, describes an attacker using a leaked admin token — created January 10, 2024, never expired, never rotated, stored in plaintext in a private config repo — from October 14 to October 15. It was detected from a user report, about 36 hours in, and no alert fired. What was read: 3,218,965 environment-variable records, 321,810 account records, 566 zSend API keys in plaintext, 11,536 access tokens. One hundred and one GCP dedicated servers were signed into with root, and SSH keys were planted on 50 of them. The attacker mainly hunted API keys, especially AI-service keys, and tried calling Amazon Bedrock with Zeabur’s AWS keys. Every attempt failed, and there were no charges. Zeabur announced shutdown on October 17; services stop December 31, 2026. This was the second breach in two months. The token was two years old. The plaintext was the policy. Zeabur

The FBI’s FLASH on ARTEX, dated November 13, is the framework version of the same shift. ARTEX is an open-source, LLM-driven pentest framework written in Go, published on GitHub in July by “Autumn-27”, the repo removed October 8. The forks and archived copies circulate, plus ARTEX PRO, and threat actors have been weaponizing it since at least August, automating intrusions from recon through exfiltration at machine speed. Some intrusions went from first targeting to privileged access in under three hours. Actors with minimal expertise can run complex multi-target operations at once, and more than 1,600 ARTEX consoles were publicly exposed as of early November. The models in use include Claude, GPT, DeepSeek, GLM, Grok, and Kimi; Chinese models are the most common in attacker instances. The campaigns named: a South Korea financial campaign affecting about 67,000 people, and a ConnectWise Cloud Backup supply-chain campaign reaching more than 2,250 downstream tenants. The framework doesn’t need an expert anymore. It is the expert. FBI ARTEX

And the quiet version of the same problem is shadow AI. Akamai’s Enterprise AI Usage Risk Report, from August, is still the clearest picture: nearly half of enterprise AI usage bypasses corporate security, and the most active 5% of users generate the majority of interactive AI prompts. About 75% of AI extensions request high or critical permissions, and 16.3% contain known vulnerabilities. Three techniques are named in the report: vibe hacking, tampering with local markdown instruction files; CursorJacking, rogue browser extensions harvesting API keys, code, and conversations; and CometJacking, indirect prompt injection via public webpages, aimed at Perplexity Comet. The prescription is single sign-on across AI platforms, continuous discovery of unapproved apps, and real-time inspection of prompts, pasted text, and uploads. The AI your teams use isn’t the AI you approved. The gap between those two is the risk. Shadow AI

The vendor is the breach

Four breaches today share one shape: the organization that lost the data wasn’t the one that was attacked. The intrusion at Coinone hit at about 04:00 KST on November 12 — not at the exchange, but at MetaM, its outsourced customer-support contractor. Coinone’s notice went out 08:00 KST on November 15. Eleven field types were potentially exposed: phone, name, email, date of birth, bank account number, password, resident registration number, ID issue date, home address, wallet address, transaction ID. Only customers who interacted with support are affected. Core systems — accounts, trading, wallets — were not directly compromised. Support has switched to email-only, and the incident was reported to KISA, the privacy commission, and the financial regulator, with a phishing and identity-theft warning. No affected-customer count was disclosed. The exchange wasn’t breached. The help desk was — and the help desk had everything. Coinone

A mid-September attack on Maileva, La Poste’s subsidiary, affected about 22 million people — first and last names plus postal addresses of recipients of Maileva client companies. About 39 million mail references sat in the compromised database; duplicates removed, 22 million. Bank details were not compromised. Some letter contents — invoice numbers, care dates, amounts — may have been accessible through clients including Hôpital Foch and Kiwee.care. Services were suspended September 23 at 7 AM and resumed September 29. CNIL was notified, a criminal complaint filed, a judicial investigation is underway, and La Poste confirmed to AFP on November 14. The envelope was the data. The address was the exposure. Maileva

A Metabase vulnerability gave unauthorized access to Dorsata’s database platform from August 10 to 12. Dorsata was notified on August 12 and patched immediately. The count reported to the Texas attorney general: 58,246 people, including 8,943 Texans. The data may have included names, date of birth, addresses, vitals, treatment information, medications, vaccines, health insurance information, and medical history. Social Security numbers were not involved, and there is no evidence of misuse. The BI tool was the database. The database was the patient record. Dorsata

And in Brazil, an unauthorized intrusion at Caixa Vida e Previdência was detected on Friday, November 6, and publicly disclosed on November 12 by Caixa Seguridade. Registration data was copied for the full active customer base — 7.6 million people — plus former customers, whose count is undisclosed. The fields: names, CPFs, and for some records addresses, phone numbers, emails, and date of birth. There is no indication financial or authentication data was compromised — no policy values, pension balances, bank details, or passwords. ANPD and other authorities were notified on November 11. The attacker, the method, and whether the data was published are unknown. Seven point six million records. The registration table was the whole customer base. Caixa Vida

The device is the delivery

Three stories today are about the device itself doing the attacker’s work. Three Trezor Safe 5 devices, bought from Southeast Asian reseller CryptoBilis between August 20 and September 23, carried a malicious hardware implant: an extra circuit board between the main board and the display that copies everything on screen — recovery words, passphrases — encrypts it, and sends it over cellular to an attacker server. It holds the data and retries if offline. Forty-eight CryptoBilis customers came forward. One device was lab-examined; two more were identified from owner photographs. Firmware 2.13.1, released November 11, blocks the implants — but it can’t protect phrases already captured. No funds have been reported stolen, and the same reseller previously had confirmed Ledger implants. The wallet was genuine. The board inside it wasn’t. Trezor

Quantum Systems confirmed it detected an incident in late October as part of an active cyberattack by “hostile actors,” and unmanned systems have resumed safe operations. Per Der Spiegel and the Financial Times, citing internal sources: a malicious file disguised as a QBase ground-control software update reached the update server. QBase plans missions for the Vector reconnaissance drone. The Bundeswehr was the only customer to ground its drones, as a precaution — and the grounding kept Quantum out of a recent military exercise. The response involves MAD, the military counterintelligence service, BfV, domestic intelligence, and BSI, the federal cybersecurity agency. No actor has been named, and no data theft is confirmed. The company links the targeting to its Ukraine support. The update server is the supply chain now — even for drones. Quantum Systems

ArcticRAT is the software version of the same idea. Zimperium’s zLabs team tracked it from targeted crypto-stealer to full Android RAT: 78 samples, 42 droppers, 36 payloads, 21 command-and-control IPs, 129 commands. It began as spyware aimed at users of eleven crypto apps. The signature move is a hidden VNC session behind a black, un-dismissible overlay with the brightness dropped to zero. The phone looks locked or off while the attacker drives banking apps on it. And it uses xAI’s Grok model to triage stolen SMS — keeping one-time codes, balance changes, and transfer notices, and estimating the victim’s financial standing. Infection runs through fake Google Play landing pages, malvertising, smishing, third-party forums, and AWS buckets, with Amazon, TikTok, and crypto apps among the impersonated brands. A fake VPN tunnel blinds Play Protect telemetry while the malware stages. The screen goes dark. The phone keeps working — for someone else. ArcticRAT

The npm story is smaller and sharper. GitHub advisory GHSA-vp2q-gp5r-xh5j, published November 13: the npm package @claudecode/cli is malicious. All versions are affected, and there is no patched release. The advice is blunt — treat the machine as fully compromised and rotate every secret and key from a different computer, because uninstalling the package can’t guarantee other malicious software is gone. The name differs from Anthropic’s legitimate @anthropic-ai/claude-code, and Anthropic’s npm install is now deprecated. The advisory names no victims, download counts, or specific payload. The package name was the trap. The install was the compromise. npm @claudecode/cli

The patch queue

Three items for the queue, in the order I’d take them. CVE-2026-129349, rated Critical by Apache: when authentication caching is enabled on DefaultLdapRealm or JndiLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password. A cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default accepts any credentials, so an attacker who knows a valid username can authenticate as that user. It affects all Shiro versions through 3.0.0 — but only when authenticationCachingEnabled is set to true, which is not the default. The fix is 3.0.1, and the workaround is to disable caching or configure a credentials matcher. The cache remembered the user. It forgot to check the password. Apache Shiro

A correction worth making plainly: the GiveWP item is the Give – Peer-to-Peer add-on, not core GiveWP. CVE-2026-82663, an authorization bypass scored CVSS 7.5, affects all versions up to 2.9.5. Unauthenticated attackers who know a campaign and team ID can modify team name, story, goal, access, and notification settings, set the profile image URL, and upload WordPress-allowed media files as parentless attachments. It is reported to chain with a time-based SQL injection flaw, CVE-2026-82568, to unauthenticated remote code execution. Published November 15, and no exploitation is known. The add-on was the door. The campaign ID was the key. GiveWP Peer-to-Peer

And a cluster of criticals in end-of-life routers, with public exploits available. CVE-2026-129444: D-Link DSL-6740C FTP daemon, hard-coded credentials, CVSS 10.0, remotely exploitable, no patch confirmed. CVE-2026-129353 and CVE-2026-129354: D-Link DIR-600L stack overflows, CVSS 10.0, public exploits, end of life and unpatched. CVE-2026-129452: DrayTek Vigor2960 remote command injection, public exploit, patch 1.5.1.7, with two path-traversal flaws fixed in the same release. CVE-2026-129445: D-Link DIR-850L hard-coded credentials, CVSS 8.4, local access. End of life doesn’t mean end of exposure. It means end of fixes. D-Link / DrayTek

The rules are moving

The last thread is the rules, and all four items in it are about what the law and the state will and won’t do. The Garante, Italy’s privacy regulator, fined Meta €805 million — about $887 million — on November 14. The Facebook Android app accessed photos, videos, and metadata on Italian users’ phones without specific consent or proper information. The feature, “Get tips from your gallery while browsing Facebook,” has run since 2023, on by default, reaching about 20 million Android users in Italy. A single app-wide permission plus a generic notice didn’t let users understand they were authorizing gallery suggestions. Meta must disable the feature by default and seek separate, specific consent within 60 days, reporting to the Garante at 30, 60, and 90 days. The fine is about 0.47% of Meta’s worldwide turnover, and AI-training use was not examined. The permission was for the app. The gallery was the price. Italy Meta fine

CISA 2015 — the law shielding voluntary threat sharing — expires December 11, 2026. A November 1 letter from the OT Cybersecurity Coalition and 34 critical-infrastructure organizations urges long-term reauthorization in the final FY2027 NDAA, backing a 10-year extension through 2035. The protections at stake: liability shield, FOIA exemption, non-waiver of privilege, antitrust exemption for sharing threat indicators and defensive measures. The history is a series of short extensions — the original 10-year authorization lapsed September 30, 2025, and the current bridge runs only to December 11. Sharing stops being safe the day the shield lapses. The shield has a date on it. CISA 2015

The White House AI task force met Thursday, November 12, and its recommendation runs in the same direction: federal agencies should limit regulatory liability for good-faith voluntary reporting of cyber vulnerabilities and incidents for at least 12 months, extendable on continuing risk assessment — and no enforcement against companies whose defenses were overwhelmed by AI-driven attacks. It also backed long-term reauthorization of CISA 2015 and proposed a voluntary AI incident-reporting channel, with the government analyzing submissions and sharing defensive information back. Members include Commerce Secretary Howard Lutnick, National Cyber Director Sean Cairncross, Pentagon research chief Emil Michael, and OPM Director Scott Kupor. A recommendation only — not an executive order or a law — and no agency has committed. The ask is simple: report what happened, and the report won’t be the thing that hurts you. White House AI task force

Gibraltar closes the day on a smaller, steadier note. HM Government of Gibraltar confirmed on November 10 that unauthorized access to its Microsoft cloud environment — Outlook, Teams, SharePoint, OneDrive — is contained. Microsoft alerted the government; ITLD worked with Microsoft and the UK’s NCSC, with a specialist team on site from November 2. Some services were suspended November 6 for forensic investigation. There are no signs of successful access to cloud accounts since, though access attempts continue and are being blocked. The principal databases holding residents’ personal records are separate, in the government’s own data centre, and the forensic investigation continues on whether any information was accessed or extracted. Contained is not the same as finished. The investigation is the part that tells you what happened. Gibraltar

Today’s through-line is unglamorous and worth sitting with: the key, the vendor, the device, and the rulebook all failed in ordinary ways. A token that never expired. A help desk that held everything. A board inside a genuine wallet. A permission nobody understood. None of it needed a zero-day. It needed the ordinary things to be looked after, and they weren’t.