The Critical Stack

47 Episodes

Reverse

Oct 31: Attackers chain three Ivanti Connect Secure flaws for unauthenticated root access

2026-10-3105:16

Edge and developer infrastructure (Ivanti, GitLab, Linux MPTCP) is being exploited or weaponized within days of patches, so patch internet-facing and CI/CD systems first and treat AI chat tooling as part of your attack surface.

Oct 30: Official Claude Code VS Code extension compromised to install persistent SSH backdoor

2026-10-3005:20

Binance traces a roughly $6.3 billion crypto theft to a single compromised DevOps laptop, and the rest of today's briefing points the same way: developer tooling, AI model repositories and the software supply chain are where attackers are getting in, so treat engineer endpoints and extensions as tier-zero assets.

Oct 29: Cisco SD-WAN flaw exploited to plant KeyDrift malware that steals traffic encryption keys

2026-10-2905:17

Attackers are going after the network and virtualization layer (SD-WAN, ESX, firewall management planes) to take encryption keys and blind your logs, so take management interfaces off the internet and assume edge devices can be compromised.

Oct 28: ShinyHunters' Oracle PeopleSoft zero-day is actually three chained flaws

2026-10-2805:17

Enterprise edge and business-app stacks (Oracle, Adobe Commerce, Node) are being mass-exploited while AI-driven offense and agent-related exposure keep rising, so patch internet-facing systems and audit what your AI agents and vendors can reach.

Oct 27: CISA confirms PHP2Shell flaws are now exploited in attacks

2026-10-2705:07

Exploitation windows keep shrinking (PHP2Shell is already under attack, and exploitation averages three days after disclosure), so patch internet-facing PHP, edge and identity components first, and treat AI sandbox and reasoning-boundary failures as live risks.

#box-pro-ellipsis-179351782203597{-webkit-line-clamp:2;}The Critical Stack