IT Security News Roundup: 2026-11-14 Evening

IT Security News: Evening roundup, 2026-11-14

Summary

This period was dominated by software supply chain and developer tooling risk. Cursor's breach let attackers push a malicious Claude Code extension, and the ChainDrop attack hit open-source maintainers. These stories sit alongside state-linked crypto theft by North Korea, an extortion claim against Expedia through a third-party provider, and a record PostgreSQL patch batch. Together they show attackers targeting the trusted tools, suppliers, and data stores that organizations depend on daily. Several items had little source detail, so those summaries stick closely to what the excerpts state.

1. The SANS Internet Storm Center published its Stormcast for November 13, 2026, with its InfoCON status at green. The post has no text preview, so no further details of the episode can be confirmed here.
2. Malware-Traffic-Analysis.net documented a SmartApeSG ClickFix campaign that delivers the CNCmachineRMS remote access trojan. ClickFix lures trick victims into running malicious commands themselves, giving attackers remote control of the infected machine.
3. US authorities seized infrastructure tied to the North Korean group APT38, which contained footage used to fool victims over video calls. The action is linked to roughly $1.2 billion in cryptocurrency stolen from Binance, according to CyberScoop.
4. Cursor confirmed that hackers stole credentials from AI infrastructure provider Fireworks AI and used them to distribute a malicious Claude Code extension through Cursor's marketplace. The incident shows how extension marketplaces can become a supply chain attack surface.
5. In this episode of the OpenSourceMalware Show, Jared Wray, maintainer of Keyv and Cachable, describes what it was like to be at the center of the ChainDrop software supply chain attack. It offers a first-hand view of how an open-source maintainer experiences such an incident.
6. Transportation Secretary Sean Duffy blamed a "routine" equipment upgrade for grounding flights nationwide, according to TechCrunch. FAA administrator Bryan Bedford said there was "zero evidence of anything AI-related."
7. A newly formed Russian extortion group called n0n claims it stole data on nearly one billion travelers from Expedia through a compromised third-party provider. Expedia confirmed an incident to Skift, but the scale of the claim is not verified in the source.
8. Bruce Schneier's speaking schedule lists appearances at the Catalyst Summit in Brampton, Ontario, on November 18, 2026, and at QT Qonference 2026 in Toronto on November 19. It is a scheduling notice with no security news content.
9. PostgreSQL's largest-ever security release fixes 52 flaws across all five supported major versions. The top bug, CVE-2026-6460, lets a low-privilege database user run arbitrary OS code and dates back to a 2004 commit.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. ISC Stormcast For Friday, November 13th, 2026 https://isc.sans.edu/podcastdetail/10178, (Fri, Nov 13th)
2. 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT
3. US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance
4. Cursor confirms security breach led to malicious Claude Code extension
5. The OpenSourceMalware Show #29
6. Transportation secretary blames ‘routine’ equipment upgrade for grounding flights nationwide
7. Extortion Group Claims Theft of Nearly One Billion Expedia Traveler Records
8. Upcoming Speaking Engagements
9. PostgreSQL’s Largest Ever Security Release Patches 52 Flaws, Including a 22-Year-Old Bug Any Logged-In User Could Weaponize