Uncategorized

Cato AI Labs disclosed DuneSlide — two CVSS 9.8 vulnerabilities in Cursor IDE used by more than half the Fortune 500. Zero-click prompt injection from a poisoned MCP server response or web search result escapes Cursor’s terminal sandbox and runs arbitrary code on the developer’s machine. CVE-2026-50548 abuses the working_directory parameter to overwrite the cursorsandbox binary. CVE-2026-50549 abuses a symlink canonicalization fallback. Both patched in Cursor 3.0 (April 2, 2026). Every version before 3.0 is vulnerable. Cato says similar flaws exist in all popular coding agents — the problem is structural.

MiniPlasma is a public Windows privilege escalation zero-day targeting the Cloud Filter driver (cldflt.sys). A standard user runs the exploit and gets a SYSTEM shell — confirmed on fully patched Windows 11 running May 2026 Patch Tuesday updates. No patch exists. Microsoft is investigating. This is the sixth zero-day dropped in six weeks by the same rogue researcher, after the first three were confirmed exploited in real attacks.

CVE-2026-20182 is a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller and Manager. No credentials. No complexity. No user interaction. An attacker sends four crafted DTLS packets, becomes a trusted control-plane peer, and gains full administrative access to enterprise network infrastructure. Actively exploited by UAT-8616 and 10 additional threat clusters. CISA Emergency Directive 26-03 mandates federal agency remediation by May 17. Patch now.

A stealthy supply chain campaign using the GitHub account BufferZoneCorp published malicious Ruby gems and Go modules disguised as trusted developer tools — silently stealing SSH keys, AWS credentials, GitHub tokens, and more from developer machines and CI runners the moment the packages were installed.