Threats Day Bulletin: AI Prompt RCE, Claude 0-Click, Ren Engine Loader, Auto 0-Days & 25+ Stories

Summary: Microsoft patched a command injection flaw in Windows Notepad (CVE-2026-20841, CVSS 8.8) that allows remote code execution when a user opens a malicious Markdown file containing 'file://' links or special URIs, fixed in this week's Patch Tuesday update. LayerX reported a zero-click RCE (CVSS 10.0) in Claude Desktop Extensions affecting more than 10,000 active users and 50 DXT extensions, where a benign prompt like 'take care of it' lets the assistant execute instructions embedded in a Google Calendar event, and Anthropic has opted not to fix it.
Bottom line: Claude DXT extensions run unsandboxed with full system privileges, so a single calendar event and a routine prompt can hand an attacker code execution on a user's machine - and the vendor has declined to patch it, leaving over 10,000 users to decide their own exposure.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20841
Related: Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026