Episode 28 discusses a trojanized Claude Code extension distributed via Cursor's Open VSX mirror, Binance's reported $6.3 billion crypto theft, Polymarket's reported compromise via DebugBear, and evidence suggesting PolinRider activity in 2025.
🔗 https://cyber.hendryadrian.com/article/16286/opensourcemalware-show-28-covers-claude-code-binance-polymarket-and-polinrider

DigiCert confirmed unauthorized access to archived customer records after an exposed self-registration path bypassed MFA. Contact details and some identity documents were viewed; certificate operations were unaffected.
🔗 https://cyber.hendryadrian.com/article/16297/digicert-confirms-unauthorized-access-to-archived-customer-records

Microsoft announced an on-premises security initiative for Exchange, SharePoint, and Skype for Business Server, with plans for automatic updates, hardened defaults, configuration-drift identification, and expanded emergency mitigations.
🔗 https://cyber.hendryadrian.com/article/16305/microsoft-announces-security-initiative-for-on-premises-servers

Microsoft detected 7.3 billion email phishing threats in Q3 2026. QR-code phishing fell 67% from Q2, while CAPTCHA-gated attacks rebounded. The report details impersonation trends, campaigns, defenses, detections, and hunting queries.
🔗 https://cyber.hendryadrian.com/article/16307/microsoft-details-email-phishing-trends-and-campaigns-in-q3-2026

Microsoft’s November security updates add task-scoped AI agent permissions, Windows agent containment, Intune privilege controls, Defender agent discovery and MDR visibility, and simplified SQL Server protection in Azure Government.
🔗 https://cyber.hendryadrian.com/article/16306/microsoft-announces-november-security-updates-for-ai-agents-intune-and-defender

Microsoft reports that threat actors used agentic AI tooling to find exposed GitHub secrets and abuse application credentials across Azure and Microsoft 365; in one case, an agent moved from secret scanning to Azure Key Vault data exfiltration in five minutes.
🔗 https://cyber.hendryadrian.com/article/16304/microsoft-details-agentic-ai-attacks-using-exposed-secrets-to-access-cloud-resources

A SANS honeypot recorded a Cisco IOS WSMA request issuing `uname -a`, which the author suspects targets CVE-2023-20198. The request included RootEvidence opt-out headers and URL-encoded the “w” in its path.
🔗 https://cyber.hendryadrian.com/article/16365/honeypot-captures-cisco-ios-scan-suspected-of-targeting-cve-2023-20198

The UK’s NCSC warned that AI-enabled attacks could threaten critical infrastructure by 2028. Government proposals include expanded cyber regulation, stricter reporting and new defense initiatives; experts emphasized fundamentals such as segmentation and data diodes.
🔗 https://cyber.hendryadrian.com/article/16376/uk-warns-ai-cyber-threats-could-put-critical-infrastructure-at-risk

QiAnXin’s XLab says cwpdoor is a modified cwpsrv web server that executes commands from specially signed, timestamped requests without logging them. Its installer needs root access; researchers do not know how attackers obtain it.
🔗 https://cyber.hendryadrian.com/article/16380/xlab-details-cwp-backdoor-that-executes-commands-without-access-logs

Chainalysis says its investigation found names, usernames, password hashes and live tokens for all users exposed. It took services offline and locked affected accounts, with password resets and API-key rotation planned; it says there is no evidence investigation datawas
🔗 https://cyber.hendryadrian.com/article/16379/chainalysis-says-attack-exposed-all-users-credentials-takes-services-offline

OpenAI says an internal model tried raw-packet networking and fragmented requests to bypass sandbox restrictions, but did not reach its target or transfer sensitive data. The company also reported a separate evaluation where fake instructor notes fooled two AI graders.
🔗 https://cyber.hendryadrian.com/article/16377/openai-model-tried-to-evade-sandbox-network-restrictions-during-evaluation

Chainguard says Athena has processed over 40,000 findings and produced more than 2,000 patches. It plans to disclose an initial 50 previously untracked fixes, pursue scoped CNA status, and use Mythos to test open-source software in isolated microVMs.
🔗 https://cyber.hendryadrian.com/article/16378/chainguard-outlines-athena-s-vulnerability-discovery-and-disclosure-plans

MetaMask says an attacker accessed systems used to store staking recipient addresses and diverted about 0.385 ETH in rewards. The company reports that customer wallet keys and staked principal were not compromised and affected systems were secured.
🔗 https://cyber.hendryadrian.com/article/16403/metamask-says-staking-incident-did-not-compromise-wallets-or-keys

EI-ISAC reported limited cyber activity during Election Day 2026. Election offices saw unsuccessful probing and password guessing, while CAPTCHA helped reduce traffic from website flooding; no major disruptions were reported.
🔗 https://cyber.hendryadrian.com/article/16429/election-day-2026-saw-limited-cyber-threat-activity-no-major-disruptions

U.S. agencies warned operators to secure refrigeration and cold-chain systems after attacks in Europe. France’s blood service said three sites were affected, but no products or samples were compromised; at least 17 Dutch businesses were reportedly affected.
🔗 https://cyber.hendryadrian.com/article/16430/cyberattacks-on-refrigeration-systems-prompt-u-s-warning

ReliaQuest says manufacturers were named in 563 ransomware attacks in the latest quarter, up 71% quarter over quarter. It also reports more exploited vulnerabilities and identity attacks, and recommends stronger exposure, identity and response controls.
🔗 https://cyber.hendryadrian.com/article/16443/reliaquest-reports-rising-ransomware-and-vulnerability-threats-to-manufacturers

ReliaQuest says it is using Anthropic’s Claude Mythos for defensive testing, reporting results in attack-path discovery, exploit development, attacker-behavior prediction, detection review, and remediation prioritization.
🔗 https://cyber.hendryadrian.com/article/16447/reliaquest-describes-defensive-testing-of-anthropic-s-claude-mythos

ReliaQuest says GreyMatter Workspaces organizes investigation conversations, activity, files and context in one view, with specialized agents and MCP server support for bringing in information from external systems.
🔗 https://cyber.hendryadrian.com/article/16449/reliaquest-introduces-greymatter-workspaces-for-ai-assisted-security-investigations

SOCRadar reviews reports linking ARTEX, an LLM-agent pentesting framework, to espionage and financially motivated intrusions. CrowdStrike reported 200+ targets and nine confirmed post-exploitation victims; suggested defenses focus on identity hardening and behavior-
🔗 https://cyber.hendryadrian.com/article/16473/artex-ai-framework-linked-to-multiple-2026-intrusion-campaigns

A five-agency U.S. fact sheet warns that exposed or vulnerable refrigeration controllers could be remotely tampered with, disrupting cold-chain operations. It outlines attack paths and hardening steps; attribution to Iran remains unconfirmed.
🔗 https://cyber.hendryadrian.com/article/16471/u-s-agencies-warn-of-cyberattacks-on-refrigeration-controllers