Threats Day: Ghost Jacking AI Attacks, Ether Hiding Click Fix, Cursor CLI Flaw + 17 More Stories
Summary: This week's ThreatsDay Bulletin rounds up 20 short security updates, including a City-Forum campaign pulling records from unauthenticated guest access in Salesforce Experience Cloud and ServiceNow Service Portals from IP 158.220.87[.]79, and a Cursor CLI flaw that let a cloned repository run any command before the workspace-trust prompt and outside an enabled sandbox, patched three days after July 20, 2026 disclosure. Other items cover GhostJacking attacks that trick AI agents into running code via poisoned logs, an EtherHiding ClickFix campaign using the Polygon blockchain to rotate command-and-control domains, a fake CCleaner page installing the GhostDesk Chrome extension, and a $150,000 Apple bounty for CVE-2026-20685 in Private Cloud Compute.
Key Takeaway: Reco recorded more than 560,000 events from the attacker's single IP against its busiest target, almost all guest Aura enumeration, and the campaign reached telecoms, banks, and security and data-privacy vendors through endpoints with almost no public documentation. The Cursor flaw ran from an ordinary tracked file, .cursor/worktrees.json, arriving with a plain git clone, and executed before any trust dialog appeared.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026