The Hacker News
CompanySecurity timeline
- Vulnerability reported by The Hacker NewsDrupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
- Malware reported by GBHackersTrojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
- Activity reported by The Hacker NewsChinese state-linked group Vapor Panda uses AI-powered ARTEX framework against high-value targets
- Vulnerability reported by The Hacker NewsTeamViewer fixes flaw letting a remote host attack the computer controlling it
- Malware reported by The Hacker NewsAustralian Signals Directorate cuts criminal access to 180,000 computers infected with Amadey malware
Recent news
Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.
Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.
Chinese state-linked group Vapor Panda uses AI-powered ARTEX framework against high-value targets
CrowdStrike attributes use of ARTEX, a Go-based AI-powered penetration testing framework, to a China-based targeted intrusion adversary it tracks as Vapor Panda, previously VexatiousTemper. The headline refers to more than 200 organisations worldwide, but the supplied text is truncated and gives no detail on victims, sectors or techniques. The activity is described as aimed at high-value targets simultaneously.
TeamViewer fixes flaw letting a remote host attack the computer controlling it
TeamViewer has patched a vulnerability that allows a malicious or compromised host in a remote session to attack the viewer, the machine that connects and takes control. The host can exploit it to crash the viewer's TeamViewer, and depending on the platform may also run further actions. The available text is truncated, so the full consequences are unclear.
Australian Signals Directorate cuts criminal access to 180,000 computers infected with Amadey malware
The Australian Signals Directorate (ASD) says its operators gained access to the backend of an Amadey malware operation and disconnected the controller from roughly 180,000 infected computers worldwide, including some in Australia. As a result, the criminal using Amadey can no longer access those machines or steal data from them. The articles quote an ASD statement describing the disconnection as the next step after gaining access.