Cognition says companies can protect themselves with basic security measures

Attacks can reach from developer machines to crypto wallets

According to a summary published by Cognition on November 3, several different security incidents in recent weeks have highlighted the importance of long-established defensive measures. The company says attackers do not need sophisticated artificial intelligence to exploit an unpatched server or a stolen credential. AI can make attacks faster and cheaper, but closing basic attack paths remains an effective defense.

The post highlights the attack on Binance. According to the company’s report, North Korean state-backed attackers obtained $6.34 billion. The attack began with a fake job interview and a modified installer that compromised developer laptops. An installation token found on one of the machines provided access to Binance’s wallet-signing service.

Cognition also says that on October 29, Cursor reported a malicious Claude Code extension. The extension attempted to install a persistent backdoor that could provide SSH access to the user’s machine. Fewer than 5,000 users installed the extension, and automatic updates meant that this did not necessarily require any separate user action.

Unpatched systems and faulty certificate management

The guide lists several critical vulnerabilities. According to Cognition, the PHP2Shell memory-safety flaw may have put millions of websites at risk, while PHP runs on approximately 70 percent of websites. In some configurations, a single unauthenticated request could trigger the flaw, even before application code ran.

The list includes an unauthenticated remote code execution flaw in GitLab, along with a series of critical vulnerabilities found in VPNs, firewalls and other internet-facing devices. Cognition also notes that the certificate authority eMudhra set its private key to the number 4, meaning anyone could have issued certificates in its name. A guest-to-host escape flaw found in KVM could have given code running in a virtual machine administrator access to the host.

A flaw in the Linux TCP stack, identified as CVE-2026-98432, could have allowed an unauthenticated remote attacker to gain administrator access on Linux systems running a Multipath TCP listener. Go 1.24 and later versions enable this by default.

Steps to take immediately and within 30 days

Cognition’s first recommendation is phishing-resistant multifactor authentication and device-bound sign-ins for corporate accounts, particularly Google Workspace, GitHub, cloud providers and identity providers. The company recommends using passkeys or hardware security keys instead of SMS, and accessing them only from managed devices.

Immediate tasks include assessing the public attack surface, introducing a password manager and a trusted ad blocker, and searching developer machines for secrets such as cloud credentials, API keys, SSH keys and environment files. Installed browser, editor and AI extensions should also be inventoried.

Within 30 days, Cognition recommends enrolling every corporate device in MDM and EDR systems, maintaining an allowlist for extensions, removing production secrets from developer machines and moving them to a secrets manager. The organization says remote development environments and cloud coding agents can reduce the impact of a compromised extension, package or agent. It also calls for codebases and dependency inventories to be reviewed, particularly systems exposed to the internet that handle authentication, payments or customer data.