Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On October 29, 2026, Cursor reported that a malicious version of Anthropic’s Claude Code extension (2.1.313) was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC. Cursor identified impacted macOS and Windows packages and estimates that up to 5,000 users were affected.

In May 2026, Counter Threat Unit (CTU) researchers published a report on an AI-assisted post-exploitation framework that tested the capabilities of multiple vendors’ endpoint detection and response (EDR) solutions, including the Sophos agent. Following a testing phase, Sophos analysts observed the same infrastructure hosting Cobalt Strike in support of Aur0ra ransomware (also known as Aurora ransomware) operations.

This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. Every physical penetration test starts with the same quiet hope: that somewhere, between the polished lobby, the badge readers, the CCTV domes, and the confident hum of office life, there is a tiny gap no one has noticed.

On October 21, 2026, Node.js released updates to address multiple vulnerabilities, including an issue in Brotli decoder (CVE-2026-111497). This critical buffer overflow vulnerability (CVSS score of 9.2) has become widely known as Node2Shell but has also been referred to Broccoli2Shell and HTTP2Shell. The issue exists in the Brotli decoder (c/dec/decode.c) in multiple Google Brotli versions, and products that rely on Brotli implementations are vulnerable.

In the world of cyber incident response, experience teaches one truth over and over again: speed matters, precision matters, and coordination matters. But perhaps one of the most overlooked lessons, often learned the hard way, is this: Choosing the right legal counsel is just as critical as selecting the right Digital Forensics and Incident Response (DFIR) firm.

It's just hard to measure.

SIEM-less security may sound like an escape from traditional SIEM complexity and costs, but the underlying capabilities still have to exist somewhere. A SIEM is a multipurpose tool. It brings together cyber and physical security use cases; drives threat detection, investigation, and response (TDIR); serves as a system of record for governance, regulatory, and compliance needs; and supports observability use cases tied to resilience and service degradation. The list goes on.