Check Point gateways opened the door to an ESXi wiper; Cursor traces its breach back to Fireworks
Saturday, November 14, 2026 · 10 min
An attacker chained PHP2Shell and a Check Point zero-day to wipe VMware ESXi hosts, and Cursor says a key exposed at Fireworks led to a poisoned Claude Code extension in its marketplace. Also: a reported malicious update at German drone maker Quantum Systems, implanted Trezor wallets, and a mass email-platform breach hitting Osaka.
Listen
Show notes
An attacker chained PHP2Shell and a Check Point zero-day to wipe VMware ESXi hosts, and Cursor says a key exposed at Fireworks led to a poisoned Claude Code extension in its marketplace. Also: a reported malicious update at German drone maker Quantum Systems, implanted Trezor wallets, and a mass email-platform breach hitting Osaka.
In this episode
- Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper — BleepingComputer
“The attacker used PHP2Shell to gain access through the gateways’ Mobile Access portal, then exploited a newly disclosed zero-day vulnerability tracked as CVE-2026-123039 to gain root privileges. Then they abused the privileges to install PHP webshells and the TSGA backdoor,…”
- An update on our recent security incident · Cursor — Cursor Team
“A small number of those traces contained credentials that had not been redacted; less than 0.01% of customers had API credentials exposed. Starting with those credentials, the attacker reached select SaaS tools used by Cursor.”
- German military drone operations disrupted by cyberattack — BleepingComputer
“QBase is Quantum Systems’ ground-control and mission-planning software, so the point of the compromise was the vendor’s update distribution server. Der Spiegel identified the Vector reconnaissance drone, known as Falke in German military service, as one of the aircraft whose…”
- Trezor confirms crypto-stealing implants in three wallets, releases fix — BleepingComputer
“The implant consists of an additional circuit board installed between the Safe 5's main board and display, allowing it to monitor screen activity without modifying the device's legitimate firmware or Secure Element.”
- City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents | The Record from Recorded Future News — Jonathan Greig
“The attack on Arara has had a cascading effect on dozens of large businesses and governments in Japan. The company said a November 2 cyberattack exposed 77 million email addresses from nearly 400 customers, including TKC, gaming giant Sega and others.”