Jerry: Counting the company's USB sticks is a chore. One spy agency has been putting it off for years. This is the daily DefSec brief for Monday, November 2nd, 2026. 1. Attackers are already exploiting a flaw in Drupal Commerce, the shopping cart module. Any visitor to the site can use it. Drupal rates it highly critical. The CVE record scores in a medium, and scanners sorting by score will rank it below the criticals. Update Commerce Core, the fix has been out since October 28th. Two, if your developers use Cursor, a tampered Claude Code extension went out through Cursor's marketplace for about 11 hours on October 29th. It came from Anthropic's own account there and it planted an attacker's SSH key. Cursor said at most 5,000 users got it. Neither company has said how the attackers got publishing access. Uninstalling the extension leaves the key and its persistence behind. Find the cursor machines that installed it and treat them as compromised. Three, an update on Ivanta Connect Secure, which attackers are already exploiting. In early October, attackers chained flaws in the VPN to get root on it from the internet. The october thirteenth patch fixed the first one. Ivante has now fixed the other two. Unless you're on the newest release line, patch again. Four. Microsoft investigated two break ins that started with a fake help desk call on Teams. Through Active Directory Certificate Services, the attackers then got certificates for admin and domain controller accounts. Microsoft says a password reset doesn't revoke those certificates. Audit your certificate templates and lock down web enrollment. The template flaw and the enrollment flaw both got their names in 2021. They're about ready for kindergarten. Five, Northlank, a hosting platform for developers told customers to assume every stored secret has been decrypted. Some are already seeing their AI keys used by someone else. Rotate every secret you keep there. Six, no attacks yet, but if your technicians use TeamViewer, the machine they connect to can attack them. When a technician connects to it, a malicious host can crash the viewer. On Windows, researchers showed it running code on the technician's computer. Update TeamViewer on every technician machine. It turns out remote support works in both directions. 7. Debug Bear makes a page speed monitoring script and it says attackers changed its DNS through its registrar. That let them swap the copy polymarket loaded. The swap script used the sessions of logged in traders to move about $2.7 million. Inventory the third party scripts on your logged in pages. It was a performance monitor and it certainly performed. Eight. Sometimes starting with stolen credentials, several crews now run open source AI pen test frameworks through most of an intrusion. Google's threat team says the techniques are the old ones, run in bursts of a few seconds. Alert on accounts acting faster than any person could type. Nine, no attacks yet, but a maximum severity flaw. It's Canonical's LXD and MicroCloud and the Incas Fork. An attacker can log in as any trusted client using that client's public certificate. They have to reach its API, which a standalone LXD server keeps off by default. Upgrade all three. Public key infrastructure with the emphasis on public. ten. Exploit code is public for a flaw that lets one text message crash an Android phone's cellular service and drop its calls. That includes emergency calls. Google's fix covers Android 14 through 17 and phones on 12 or 13 stay exposed. Require company phones to run a supported Android version. 11 No attacks yet on a new request tracker flaw. Attackers can plant a script in a request tracker ticket by sending an email to a public queue. The script runs as whoever opens the ticket. Upgrade request tracker. Nice of the attacker to file a ticket first. Twelve, a ransomware crew targeted 23 organizations and every break-in the researchers documented used weak or stolen passwords or keys. The crew spent more than $7,000 on AI services while it went after these organizations. It also left its own server exposed, which is how the researchers saw all this. Require MFA on every VPN login. 13. Britain's signal intelligence agency can't immediately locate a large number of its USB sticks, drives, disks, and memory cards. GCHQ estimates the number is in the thousands. Its watchdog says some may hold surveillance data, and the problem was first raised several years ago. Block USB storage by default and keep an inventory of the approved devices. So the next time someone asks you to count the USB sticks, tell them GCHQ is still working on it. That's the show. Thanks for watching. Sources are in the show notes. subscribe and share the show with a friend who'd use it. I'm Jerry Bell and we'll be back again tomorrow.