A record $6.3bn theft from Binance, attributed to North Korea, dominates the day, alongside two exploited Ivanti VPN flaws, a CVSS 10.0 GitLab remote code execution flaw used against Alpine Linux, and an unpatched Linux kernel bug that gives remote attackers root.
🔴 CRITICAL (4)
Binance loses $6.3bn in record hot wallet theft, analysts attribute it to North Korea Confirmed
On 29 October attackers drained about $6.3bn from Binance hot wallets across 11 blockchains, the largest crypto theft on record. On Ethereum they abused an EIP-7702 delegation so the exchange’s own signing infrastructure authorised a sweeper contract, emptying wallet Binance 14 of roughly $2.5bn in about four minutes and pulling $823m in USDC from a linked wallet. Binance links the breach to a compromised DevOps laptop and says it will cover all losses, with about $2.8bn frozen so far. Chainalysis, TRM Labs and Elliptic attribute the theft to North Korea’s TraderTraitor group with high confidence, though no government has confirmed it. Treat funds that passed through the flagged addresses as tainted.
Sources Chainalysis|CoinDesk|BleepingComputer|Elliptic
CISA adds two exploited Ivanti Connect Secure flaws to KEV catalog Confirmed
CISA added CVE-2026-111357, a privilege escalation in Ivanti Connect Secure 22.8R2.4, and CVE-2026-118527, a predictable identifier flaw that lets an authenticated attacker upload attacker controlled files to a known path, after evidence of exploitation in October 2026. The two chain with each other and with CVE-2026-104935, so a low privileged foothold on an internet facing VPN appliance can become root plus dropped content on disk. Federal agencies must remediate by 2 and 13 November; everyone else should patch now, then hunt for unexpected files and local accounts on gateways and assume credentials seen on the appliance are exposed.
Maximum severity GitLab flaw exploited in attempted hit on Alpine Linux's own server Confirmed
CVE-2026-97229, an integer overflow in GitLab’s CI/CD regular expression handling, is rated 10.0 and allows unauthenticated remote code execution on self managed GitLab servers with a crafted pipeline configuration. GitLab fixed it in mid October, then on 20 and 21 October an attacker used it against Alpine Linux’s GitLab instance, a week after the patch. Alpine says the attempt came close to succeeding but left no evidence of compromise, and CISA added the flaw to KEV on 29 October. Administrators should confirm they are on a fixed release, review CI configuration changes and rotate secrets and SSH host keys if exploitation is suspected.
Sources The Hacker News|SecurityWeek|Alpine Linux
Unpatched Linux kernel TCP flaw, CVSS 9.8, allows unauthenticated remote root Confirmed
CVE-2026-98432 is a use after free in the Linux kernel TCP stack that the kernel CVE team rates 9.8 and Red Hat rates critical for default enterprise configurations. Anthropic said on 27 October that one of its models wrote an exploit that gives an unauthenticated remote attacker root on servers running the affected code. Ubuntu and Red Hat had not shipped stable fixes when the reports landed, and the severity labels diverge sharply between distributions. Patch vendor kernels as soon as they appear, reduce exposed TCP services, and watch for unexplained kernel crashes.
Sources The Hacker News|BleepingComputer|Red Hat
🟠 HIGH (10)
China linked Warp Panda exploited VMware ESX zero-day to hide its activity Confirmed
CrowdStrike reports that a China nexus group it calls Warp Panda, also tracked as Vapor Panda, used a zero-day in Broadcom VMware ESX to reduce audit trail visibility in attacks on the US legal sector. CISA added CVE-2026-41709 to KEV on 28 October. The flaw lets an attacker with existing access blunt logging before the operating system layer, which slows incident response considerably. Apply the vendor update on ESXi hosts and treat gaps in hypervisor logs as possible tampering rather than an accident.
Sources The Hacker News|CISA KEV
Drupal Commerce Core authorisation bypass exploited against online stores Confirmed
Drupal warns that CVE-2026-118539, a missing authorisation check in Commerce Core versions up to 2.41 and 3.0.0 to 3.3.13, is being exploited in the wild. The flaw lets an attacker reach order and customer data they should not see, and Drupal is telling store owners to audit orders for tampering and data exposure rather than only patching. Update Commerce Core immediately and review access logs for unusual order or cart endpoints.
WordPress core update flaw draws 63,000 exploit attempts in a day Confirmed
A high severity remote code execution flaw in WordPress Core versions 4.7 to 7.1.3, patched in 7.1.4 on 28 October, is being probed aggressively. Wordfence says the issue is a race window in full package upgrades, where the installer is unpacked into a predictable, web accessible staging directory under wp-content/upgrade, so an unauthenticated attacker who hits the installer at the right moment can run code. Wordfence blocked 62,969 attempts in 24 hours. WordPress sites should be on 7.1.4 or later, and hosts should check for stray files in wp-content/upgrade.
Sources The Hacker News|SecurityWeek|Wordfence
UAT-11473 used Cisco SD-WAN bug to plant KeyDrift key stealing malware Confirmed
Cisco Talos has detailed UAT-11473, a sophisticated group that exploited CVE-2026-20127, an authentication bypass in Catalyst SD-WAN Controller fixed in February, to deploy a custom framework called KeyDrift. KeyDrift copies the keys that encrypt traffic between sites and stores them for later use, meaning past session traffic can be decrypted once the keys are taken. Talos calls the intrusions historical but gives no dates. SD-WAN controllers should be on a fixed release, and organisations should rotate IPsec and control plane keys where compromise is plausible.
Cisco patches actively exploited ASA and FTD SSL VPN denial of service flaw Confirmed
Cisco has fixed CVE-2026-76418, an 8.6 rated flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software, which it says has been exploited in the wild and added to KEV. An unauthenticated remote attacker can send a crafted request that reloads the device, dropping VPN sessions and interrupting inspection. Apply the fixed release or disable the affected feature where patching cannot happen quickly, and expect repeated outage style denial of service if the device stays exposed.
Sources The Hacker News
PHP2Shell flaws exploited against internet exposed Palo Alto management interfaces Confirmed
Palo Alto Networks says attackers are exploiting CVE-2026-109618 and CVE-2026-109619, two 9.2 rated PHP flaws, against management interfaces exposed to the internet. Unit 42 and SecurityWeek put the number of potentially exposed instances at over 22 million, and successful chains have rooted Palo Alto firewalls, though the same payloads failed against WordPress. Restrict management access to a trusted network or jump host, apply the vendor update, and check firewalls for unexpected local users and scheduled jobs.
TeamViewer fixes flaw that lets a remote host attack the technician's machine Confirmed
TeamViewer has fixed CVE-2026-111585, an 8.8 rated integer overflow in screen processing, plus a related out of bounds write, CVE-2026-92372, in version 15.83. A malicious or compromised host can crash the viewer and, depending on platform, run code with the viewer’s privileges once a technician connects to it, a realistic risk for support teams that connect to customer supplied machines. There is no workaround; update clients and hosts to 15.83 or later, including older maintenance branches.
Sources The Hacker News|TeamViewer|SecurityWeek
Trojanized Claude Code extension shipped through Cursor Marketplace with SSH backdoor Confirmed
A malicious build of Anthropic’s official Claude Code extension, version 2.1.313, was distributed through the Cursor Marketplace for about 11 hours on 29 October under the legitimate publisher identity, reaching up to 5,000 developers. It attempts to install a persistent SSH backdoor, and Cursor shut the marketplace briefly while it responded. Developers who installed or updated the extension in that window should check authorised_keys, scheduled tasks and outbound SSH connections, then rotate credentials used from that machine.
UEFI flaw in EDK II PXE boot allows code execution before Secure Boot, no tagged fix yet Confirmed
CVE-2026-97631, a 9.5 rated buffer overflow in the EDK II PXE boot driver, lets an attacker on the local network send a crafted ICMP error during network boot and execute code before Secure Boot or measured boot runs. TianoCore published the advisory on 22 October; the fix exists only in the main branch, and no tagged release contains it, though Microsoft’s Project Mu has backported it. Disable PXE boot where it is not required, because machines that boot only from disk are not exposed.
Sources Ars Technica|Binarly|WIRED
Vapor Panda uses AI powered ARTEX framework against more than 200 organisations Confirmed
CrowdStrike attributes a global espionage campaign against over 200 high value organisations to a China based group it tracks as Vapor Panda, previously VexatiousTemper. The group uses ARTEX, a Go based framework with AI assistance, to run intrusion activity against many targets at once rather than one at a time. The reporting is research rather than incident response, so the practical step is to check for the infrastructure and tooling indicators in the report and to assume AI assisted operations shorten the time from access to action.
Sources CrowdStrike|The Hacker News
🟡 MEDIUM (8)
Polymarket loses $2.7m after third-party monitoring script was compromised Confirmed
An attacker drained about $2.73m from 737 Polymarket accounts through 985 withdrawals in roughly an hour on 29 October, after malicious code linked to a website monitoring tool was injected into the platform’s frontend. The script hijacked logged in sessions and moved funds, so nothing on chain was broken; the trust boundary was a supplier. Polymarket paused trading, restored service and says it will reimburse affected users. Web3 teams should treat third party JavaScript with the same scrutiny as contracts and check script integrity on every deploy.
Sources SecurityWeek|BleepingComputer|CoinDesk|Yahoo Finance
Trezor warns of suspected theft implant in a Safe 5 bought from reseller CryptoBilis Under investigation
A customer reported that a Trezor Safe 5 bought from reseller CryptoBilis in Southeast Asia contained an extra circuit board that transmits the recovery phrase over a mobile network. Trezor has not yet examined the device but is treating the report as credible and has told anyone who bought a Trezor from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase. Buy hardware wallets from the vendor or an authorised reseller, and never trust a sealed device that arrived from a secondary seller.
Sources BleepingComputer|The Hacker News|Decrypt
Hugging Face crypto mining campaign returns days after takedown Confirmed
A campaign that abuses Hugging Face models to hijack GPU servers for crypto mining reappeared days after it was taken down, planting backdoors and using one model that was downloaded more than 28,000 times. A separate fake Solana starter kit on GitHub is built to trick AI coding agents into installing the NetSupport remote access trojan. Teams running model hubs or agentic coding tools should scan downloaded artefacts, restrict outbound traffic from GPU hosts and review what their agents are allowed to install.
Sources BleepingComputer
Japan Airlines says Amadeus breach exposed data of 92,000 customers Confirmed
Japan Airlines has disclosed that a breach at Amadeus, which runs its Passenger Service System, exposed the data of about 92,000 customers. The airline is a downstream victim rather than the initial target, which is the common pattern for travel sector breaches where a shared reservation platform concentrates passenger records. Affected customers should expect convincing phishing that quotes real booking details, and travel operators should review what data they pass to reservation suppliers.
Sources BleepingComputer
Anthropic themed phishing slips past leading secure email gateways Confirmed
DarkReading reports a phishing campaign that impersonates Anthropic and carries obvious red flags is still reaching inboxes through several industry leading secure email gateways. The lures lean on AI tool adoption, which gives them a plausible reason to ask for credentials or a payment. Organisations should test their own filters with these messages, train staff on AI vendor impersonation and add out of band verification for any request that arrives by email.
Sources DarkReading
Chainalysis discloses security incident affecting internal tools Under investigation
Chainalysis says it was the target of a cybersecurity incident affecting its systems and internal tools, similar to attacks on other tech platforms in recent weeks. Its investigation to date found no evidence of unauthorised access to investigation content, authentication credentials or session tokens, though reporting indicates some customer data was exposed. Customers should watch for targeted phishing that references their casework and should rotate any credentials shared with the vendor as a precaution.
Sources Chainalysis|Blockchain.news
ICS advisory roundup: Siemens Mendix SAML bypass and two Hitachi Energy product sets Confirmed
CISA published three ICS advisories on 29 October. Siemens Mendix SAML module before 4.2.4, and before 3.6.29 on Mendix 9, has an authentication bypass, CVE-2026-89209, where a replayed SAML assertion works in IdP initiated flows. Hitachi Energy CoreTec carries OS command injection and Dirty Frag issues, CVE-2026-13162 and CVE-2026-43284, rated 8.8, and the TRO600 series has flaws, CVE-2026-10756 and CVE-2026-106087, that allow remote code execution. Engineering teams should apply vendor updates and keep these systems off the public internet.
Sources CISA (Siemens Mendix)|CISA (Hitachi CoreTec)|CISA (Hitachi TRO600)
FBI seizes domain of bulletproof host Virtualine Confirmed
SecurityWeek reports that the FBI has seized the domain of Virtualine, a bulletproof hosting provider that catered to hack for hire services and supported ransomware and infostealer operators while accepting crypto payments. Seizing the domain disrupts payment and control flows but rarely removes the operators, who typically reappear on new infrastructure. Defenders tracking these services should keep historic Virtualine indicators on watch lists and expect displacement rather than a clean takedown effect.
Sources SecurityWeek
⚪ WATCH (3)
Microsoft traces help desk impersonation through to AD CS abuse Confirmed
Microsoft has published an intrusion chain that starts with impersonating a help desk to take over a Teams account, moves to remote access, then abuses Active Directory Certificate Services through authentication relay and Kerberos to escalate. ESC1 and ESC8 remain the two certificate template misconfigurations most often used this way. The practical controls are callback verification for help desk resets, disabling NTLM relay paths and auditing certificate templates that allow requester supplied subject names.
Sources Microsoft Security Blog
Talos incident response trends: vishing help desks and rising ransomware share Confirmed
Cisco Talos reports that in Q3 2026 phishing remained the top initial access technique, while the share of ransomware and pre ransomware cases increased, with finance and public administration tied as the most targeted sectors. A recurring theme is voice phishing of IT help desks to reset credentials and enrol devices. The recommendation is procedural: verify identity on sensitive resets, monitor MFA enrolment changes and rehearse ransomware containment before it is needed.
Sources Cisco Talos
CrowdStrike documents prompt injection aimed at agent planning stages Confirmed
CrowdStrike has published new prompt injection techniques that target the planning phase of AI agents rather than the final response, so the agent chooses malicious steps before any guardrail inspects output. This follows a broader trend of indirect injection being treated as a live attack vector rather than a theoretical one. Teams deploying agents should log planned tool calls, constrain the tools available per task and treat retrieved content as untrusted input.
Sources CrowdStrike
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.