The box you bought to keep attackers out turned out to be the way in. And behind it, a wiper. This is Lantern Cybersecurity Daily, with a Saturday edition for November 14. Today is about things you trust by default: a perimeter gateway, an AI vendor, a drone maker's update server, a hardware wallet, and a city's email service.
BleepingComputer, on research from Check Point:
The attacker used PHP2Shell to gain access through the gateways’ Mobile Access portal, then exploited a newly disclosed zero-day vulnerability tracked as CVE-2026-123039 to gain root privileges. Then they abused the privileges to install PHP webshells and the TSGA backdoor, which embeds a networking component called TSProxy to listen for attacker commands concealed within regular traffic.
Who's affected: organizations running Check Point Security Gateways with the Mobile Access portal exposed. Check Point says a first wave began October 30 against Israeli organizations, and a second on November 2 hit companies in multiple countries and sectors. In the Israeli attacks, the actor moved on to VMware ESXi hosts and ran a wiper called destroy_v6. And this wasn't ransomware dressed up. The note left on the hosts, DREAM_ANNEXATION.txt, carries political messages and explicitly rejects ransom negotiations. When the attacker refuses your money, the backups had better be somewhere the gateway can't reach. Attribution is unsettled. Check Point tentatively links the backdoor to PhiliKit, a framework ESET associated with the Chinese cluster UNC5221, but says it couldn't attribute the attacks with confidence, and researchers raise the possibility of a false flag. For the second wave, Check Point saw no destructive activity, and what the attackers did next is unclear. Confirmed exploitation, a vendor fix, an edge box: this one earns the interruption. Check Point says install the November Jumbo Hotfix on all Management Servers and Security Gateways, internet-facing Mobile Access first. Then hunt: session files containing upload_progress_pwn, unexpected CPconfigdaemon processes or binaries, unexplained gaps in firewall logs, and any SSH from the gateway to your ESXi hosts. Patching the gateway closes the door; it doesn't tell you who already walked through.
From the Cursor team's incident update, published Friday:
A small number of those traces contained credentials that had not been redacted; less than 0.01% of customers had API credentials exposed. Starting with those credentials, the attacker reached select SaaS tools used by Cursor.
This is the next chapter of the Fireworks AI breach we've followed since Tuesday, November 10, and it's the most detailed downstream account yet. Cursor says an attacker obtained an access key Cursor had issued to Fireworks, which Fireworks exposed, and used it to copy a read-only bucket of coding agent traces, mostly from 2025, from sessions not in Privacy Mode. Then it escalates. Credentials sitting unredacted in those traces got the attacker into SaaS tools Cursor uses, and from there into archived non-production repos, some support emails, usage metrics, and credentials users had sent to Cursor support. Pasting a key into a support ticket: still a bad idea. The part that reaches developer machines: on Thursday, October 29, using a stolen credential, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension on the cache serving Cursor's VS Code extension marketplace. Cursor says Anthropic didn't publish it, and the upstream source, Open VSX, never had the malware. At most 5,000 users may have received it during a window of about eleven hours. So the action item is narrow. If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor's marketplace in that window, follow the steps in Cursor's October 30 security notice. Cursor says uninstalling alone may not be enough. Cursor says customer repositories and its official releases weren't affected, and the last attacker activity it saw was November 1. And Cursor isn't the only downstream victim this week. TechCrunch's Zack Whittaker reports Uber is notifying drivers that their personal and driver's license information was stolen at a tech provider, which TechCrunch learned is Fireworks. Filings in just three states already count nearly 8,000 drivers. Notion, Cursor, Uber, one AI vendor. Data you share for training is still your data when someone steals it.
BleepingComputer, on German drone maker Quantum Systems:
QBase is Quantum Systems’ ground-control and mission-planning software, so the point of the compromise was the vendor’s update distribution server. Der Spiegel identified the Vector reconnaissance drone, known as Falke in German military service, as one of the aircraft whose missions are planned with QBase.
What's confirmed: in a statement dated Thursday, November 12, Quantum Systems said it identified a cyberattack by hostile actors at the end of October and worked with authorities so its unmanned systems could safely resume operations. Its drones serve with Germany's military. The company believes it was targeted for its support of Ukraine, but makes no specific attribution. What's reported but not confirmed by the company: Der Spiegel and the Financial Times, citing internal sources, say the attack came through a malicious QBase update file. Other reports say the German armed forces grounded the drones as a precaution. It's also unclear how many customers installed that unscheduled update. That number is what decides whether this was a scare or a compromise in the field. The general lesson travels well beyond defense. If your update server can push to the field, it's the most privileged system you run. An unscheduled update is reportedly what raised the alarm here, so make sure somebody would notice one.
BleepingComputer, on Trezor's investigation:
The implant consists of an additional circuit board installed between the Safe 5's main board and display, allowing it to monitor screen activity without modifying the device's legitimate firmware or Secure Element.
Trezor has now confirmed three Safe 5 wallets with malicious implants, all bought from the Southeast Asian reseller CryptoBilis between August 20 and September 23. The implant captures recovery words and passphrases as they appear on screen, encrypts them, and sends them out over a cellular network. No affected customers have reported losing funds. A hardware wallet with its own cell plan. That's a feature nobody asked for. Trezor shipped firmware 2.13.1 on Wednesday, November 11, which it says stops the implants it found from capturing anything. But it can't protect a recovery phrase captured before the update. So anyone who bought from CryptoBilis is advised to move funds to a new wallet with a new recovery phrase. The bigger change is structural. Trezor says it cut its global reseller network by about 80 percent and is putting stricter controls on how devices are sourced, stored and accessed. That follows confirmed implants in Ledger devices from the same reseller. A secure chip doesn't help if someone adds a board next to it.
Jonathan Greig, writing in The Record:
The attack on Arara has had a cascading effect on dozens of large businesses and governments in Japan. The company said a November 2 cyberattack exposed 77 million email addresses from nearly 400 customers, including TKC, gaming giant Sega and others.
The newest casualty is the City of Osaka. It says hackers reached the Arara email distribution service used by TKC, the contractor that maintains its online administrative services platform. Anyone who got an email from that system between July and October 31 had their address leaked, more than a million addresses in all. And the stolen list is the smaller problem. Arara says the hackers used its service to send millions of malicious emails posing as card companies and financial institutions. Phishing with a legitimate sender reputation. Osaka is telling its 2.8 million residents not to open links or attachments in suspicious emails that claim to come from the city. It's part of a wider surge: NTT's Mihoko Matsubara told The Record that October alone saw 58 percent of this year's reported incidents in Japan. For builders: if a third party sends mail as you, its compromise becomes a phishing problem with your name on it.
Quick ask before we go. If this briefing saves you some scrolling, leave a rating or a short review in your podcast app. It helps other builders find the show.
Sources for every segment are in the show notes. Our next episode is Monday, November 16. Until then, check your gateway logs and your vendor list. Lantern Cybersecurity Daily is a Lantern Podcast.