
Tech & cybersecurity journalist @InfosecurityMag Also behind @coupecircuit_ đ«đ·đŹđ§
London, United Kingdom
Joined October 2011
- Tweets5.8K
- Following2K
- Followers1.6K
- Likes6K
Kevin Poireault retweeted
Of all the vulnerabilities (CVEs) published so far in 2026, 4% have been reported as exploited in the wild (by @VulnCheckAI ). The last 2 years, it was 7%.
â ïž Ciblage de tĂ©lĂ©phones Apple đ± â ïž
Le CERT-FR a connaissance de notifications envoyĂ©es par Apple le 29 octobre 2026 Ă des utilisateurs ciblĂ©s par des logiciels espions. Si vous en avez Ă©tĂ© destinataire, contactez le CERT-FR au plus vite —ïž
cert.cyber.gouv.fr/cti/CERTFâŠ
Kevin Poireault retweeted
Agentic money laundering
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binanceâŠ
Kevin Poireault retweeted
Massively underreported: an official Claude Code extension was compromised and installed backdoors on developer machines.
Could it be behind the Binance hack?
Kevin Poireault retweeted
Today's Claude extension compromise is a good reminder to do this. If you're using VSCode @code, Cursor @cursor_ai, or any other IDE built on VSCode, I would immediately enable extensions.installCooldownHours.
I've set this setting to 72 (hours), which is a much safer delay to install new updates to extensions than the default setting of 0 (immediate updates).
This prevents extension updates from getting installed for 3 days, which would hopefully eliminate most of the risk from compromised updates. It's not foolproof, but it's better than no delay.
Heck, set it to something even higher to be safer, like 336 (2 weeks).
Kevin Poireault retweeted
Thereâs misinformation circulating about the Claude Code incident.
The confirmed incident involved a tampered copy distributed through Cursorâs own marketplace. A compromise of Anthropicâs official distribution, Microsoftâs VS Code Marketplace or Open VSX has not been established.
cursor.com/blog/claude-code-âŠ
âŒïž Anthropic's official Claude Code extension was distributed with an SSH backdoor via Cursor's marketplace.
A trojanized update (v2.1.313) targeted up to 5,000 users, according to Cursor.
How attackers pushed it under the legitimate extension's identity remains unclear.
Read: thehackernews.com/2026/10/ofâŠ
Kevin Poireault retweeted
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-âŠ
Kevin Poireault retweeted
The game has changed đ
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binanceâŠ
Kevin Poireault retweeted
I want to speak to you directly about what happened.
Bottom line - your money is safe, and we're covering every loss.
Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.
To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.
So far, we have found no evidence of any wallet private key leak.
We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete.
What you need to know:
âą Your funds are safe
âą Binance will cover all losses from the SAFU fund and company funds
âą Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners
âą No evidence of any wallet private key leak
âą Deposits are unaffected and operating as normal
What we've done:
âą Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses
âą Revoked the affected address authorizations
âą Engaged law enforcement and blockchain intelligence partners to trace and recover funds
Our team hasn't stopped. We're working closely with law enforcement to ensure the matter is handled appropriately - and I'll share what I can, as soon as I can.
Global cryptocurrency giant @binance has confirmed it suffered the largest cyber-attack in history, resulting in $6.3bn of cryptocurrency being stolen.
infosecurity-magazine.com/neâŠ
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-securityâŠ
BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu
Cybersecurity professionals will be able to take the first @ISC2-approved AI security exam in early 2027.
infosecurity-magazine.com/neâŠ
Coupure des réseaux sociaux. J'ai contacté les 4 opérateurs télécoms concernés. Réponses :
@free : pas de commentaire
@bouyguestelecom : pas de commentaire
@SFR : pas de réponse
@orange : pas de commentaire, si ce n'est qu'« Orange exerce ses activités dans un cadre légal et réglementaire. Comme tout opérateur, nous sommes tenus de nous conformer aux obligations qui nous sont légalement notifiées par les autorités compétentes, dans le respect du droit applicable. »
@FFTelecoms (BT, Orange, SFR) : pas de commentaire.
"On laisse le gouvernement s'exprimer", me glisse en parallĂšle une source
Information exclusive BlastâŻ: le Premier ministre a prĂ©parĂ© la coupure des rĂ©seaux sociaux pour le 24 octobre
Deux jours avant la manifestation du 24 octobre, le Premier ministre SĂ©bastien Lecornu a demandĂ© Ă Orange, SFR, Free et Bouygues Telecom de se tenir prĂȘts Ă couper lâaccĂšs Ă TikTok, Instagram ,Snapchat et X. Blast rĂ©vĂšle la lettre et le compte rendu de la rĂ©union qui a suivi, oĂč les opĂ©rateurs ont exprimĂ© leurs doutes. Le gouvernement avait dĂ©jĂ utilisĂ©e cette mesure liberticide en Nouvelle-CalĂ©donie en 2024, avant dâĂȘtre dĂ©savouĂ© par le Conseil dâĂtat.
Par @yanmdi.
blast-info.fr/articles/2026/âŠ
Kevin Poireault retweeted
Sorry folks, we have a confirmed PHP compromise with post-exploit activity. Still not the widespread outbreak we all braced for, but itâs actively exploited in the wild. Updated threat brief:
unit42.paloaltonetworks.com/âŠ
Kevin Poireault retweeted
Ah bah voilà , c'est parfait ça pour un vendredi !!
Allez hop, on remet ça.
âŒïž BREAKING âŒïž PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.
New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.
Full details â thehackernews.com/2026/10/urâŠ
Kevin Poireault retweeted
Evolving threat đš CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into âHTTP2Shell.â
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.


































