This brief covers the trailing ~48 hours (October 29–31, 2026). Every item below was traced to a primary source — the vendor advisory, CISA’s KEV catalog, the CVE record, or the affected organization’s own statement — and the dates were confirmed on those pages.
CISA adds GitLab CVSS 10.0 RCE and Cisco ASA/FTD VPN DoS to the KEV catalog
CISA / GitLab / Cisco PSIRT · October 29, 2026
CISA’s catalog update 2026.10.29 added two entries with a federal remediation deadline of November 1, 2026. CVE-2026-97229 (CVSS 10.0) is an integer overflow in GitLab CE/EE’s CI/CD regular-expression compiler that lets an unauthenticated attacker execute code on the server; GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8, and Rapid7 independently reproduced code execution against an official CE image. CVE-2026-76418 (CVSS 8.6) is a NULL-pointer dereference in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD that lets an unauthenticated remote attacker reload the device; Cisco published the advisory on October 28 with fixed releases across ASA 9.16–9.24 and FTD 7.0–10.1, and exposure requires secondary authentication on a tunnel group. Both are actively exploited and now on KEV.
“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75
Source: CISA alert · GitLab patch release 19.4.2 · Cisco advisory · The Hacker News
Trojanized Claude Code extension on Cursor Marketplace planted a persistent SSH backdoor
Cursor / Microsoft Security / OpenSourceMalware · October 29, 2026
Malicious builds of Anthropic’s anthropic.claude-code extension (versions 2.1.312 and 2.1.313, Windows and macOS) were served from the Cursor VS Code Extension Marketplace under the extension’s real publisher identity between roughly 2:27 a.m. and 1:35 p.m. PT on October 29. The payload added an attacker-controlled SSH key labeled svc-telemetry to authorized_keys, attempted a reverse SSH tunnel to 134.209.82[.]225, installed persistence via cron, LaunchAgent or a SysMon scheduled task, and beaconed host details over HTTP to port 8099. Anthropic and Cursor say Anthropic’s systems were not compromised; Cursor removed the version, temporarily shut the marketplace, rotated keys and had the attacker server taken offline. Microsoft confirmed the build never reached the Visual Studio Marketplace or npm, and Socket found no trace on Open VSX. The legitimate current version is 2.1.314. Cursor published IoCs, hashes and remediation scripts.
“Removing or updating the extension does not remove artifacts written outside its installation directory.” — Microsoft Security Research
Source: Cursor security notice · Microsoft Security Blog · OpenSourceMalware · The Hacker News
Binance discloses ~$6.3B hot-wallet theft; ~$3B frozen on-chain
Binance · October 30, 2026
Binance’s incident update puts the total impact at around $6.3 billion, with roughly $3 billion frozen on-chain so far (Tether ~1.567B USDT, Circle ~800M USDC, and Arbitrum’s Security Council ~$30.5M). The exchange says its initial investigation points to a compromised DevOps engineer’s laptop that gave the attacker access to a service container used to submit unauthorized withdrawals, and that no wallet private key leaked; it later said it found additional points of breach and has not yet published a root cause. Withdrawals were suspended pending a security revamp, with deposits unaffected, and Binance says it will cover losses from the SAFU fund and company funds. TRM Labs and Chainalysis attribute the theft to North Korea’s TraderTraitor with high confidence; Elliptic urged caution absent a root cause.
“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container.” — Binance, Security Incident Update (2026-10-30)
Source: Binance announcement · The Hacker News
WordPress core upgrade-window RCE draws ~63,000 attack attempts in 24 hours
WordPress Security Team / Wordfence · October 29, 2026
WordPress 7.1.4 (October 28) fixed a race condition in which full-package core upgrades extracted files, including the installer, to a predictable web-accessible path under wp-content/upgrade; the GitHub advisory GHSA-4w3m-c66w-69mg was published October 29 and the CVE record, CVE-2026-119977 (CVSS 8.1, AV:N/AC:H/PR:N/UI:N), was published by Wordfence as CNA on October 31. All versions 4.7.0 through 7.1.3 are affected, with backports from 7.0.8 down to 4.7.39. The WordPress project rates the issue Low, but Wordfence reported 62,969 blocked exploitation attempts in a 24-hour window as attackers polled staging paths such as setup-config.php. The CVE is not in CISA’s KEV catalog.
“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg
Source: WordPress GHSA advisory · WordPress 7.1.4 release · CVE-2026-119977 · Wordfence · The Hacker News
CrowdStrike: China-nexus Vapor Panda uses AI pentest tool ARTEX against 200+ organizations
CrowdStrike · October 29, 2026
CrowdStrike reports that Vapor Panda (formerly VexatiousTemper, overlapping Trend Micro’s Earth Estries) has used ARTEX, a closed-source Go-based agentic penetration-testing framework that coordinates multiple LLM backends for reconnaissance, vulnerability identification and exploitation, against more than 200 organizations since October 17. Targets include foreign ministries across Latin America, Europe, Asia and the Middle East, a Middle East interior ministry, U.S. semiconductor, defense, pharmaceutical, nuclear and financial organizations, and telecoms in the U.S., Belgium and the Philippines. Post-exploitation activity was confirmed at nine organizations, where the group deployed BLOODALCHEMY, a ShadowPad derivative.
“Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide.” — CrowdStrike
Source: CrowdStrike blog · The Hacker News
Chainalysis discloses security incident exposing customer contact data
Chainalysis · October 30, 2026
Chainalysis says it was the target of a cybersecurity incident in which an external actor accessed internal systems; customer notifications cite exposed user IDs, full names, email addresses and organizational role labels. The company reports no evidence of unauthorized access to investigation content, authentication credentials or session tokens, says it is working with outside experts to harden its systems, and states the incident is unrelated to the Binance theft. No technical details on the entry point or dwell time have been released.
“no evidence of unauthorized access to investigation content, authentication credentials, or session tokens” — Chainalysis
Source: Chainalysis statement · BleepingComputer
Trezor warns of suspected hardware implant in a Safe 5 sold by reseller CryptoBilis
Trezor · October 30, 2026
A customer in Indonesia reported an extra circuit board, described as including a cellular module and antenna, fitted inside a Trezor Safe 5 purchased from reseller CryptoBilis via Tokopedia in August; the report says the board captures the recovery phrase from the screen and transmits it. Trezor has not yet examined the device but ended its relationship with CryptoBilis on October 9 and is advising anyone who bought a Trezor from CryptoBilis or its supplied stores since March 2026 to move funds to a new wallet with a new seed. No losses have been reported.
“Move your funds to a new wallet with a new seed as soon as possible.” — Trezor
Source: Trezor blog · The Hacker News
Still developing
Drupal Commerce Core access bypass (CVE-2026-118539) actively exploited
Drupal Security Team · October 28, 2026
SA-CONTRIB-2026-254 rates the flaw Highly critical (21/25) and says it is being exploited in the wild; the CVE record was published October 30 with a CISA ADP CVSS 3.1 score of 6.5 (Missing Authorization, CWE-862). The module fails to protect certain routes and entity fields, allowing an access bypass that can financially impact the vendor. Affected: Commerce Core below 2.41 and 3.0.0 through 3.3.12; fixed in 3.3.13 and 8.x-2.41. Drupal also advises auditing orders for inconsistencies. Not in CISA’s KEV catalog as of the 2026.10.29 update.
“This vulnerability is being actively exploited in the wild.” — Drupal Security Advisory SA-CONTRIB-2026-254
Source: Drupal advisory · CVE-2026-118539 · The Hacker News
Linux kernel IPv4 TCP race (CVE-2026-98432) still unpatched on Ubuntu and RHEL
Anthropic / kernel.org · October 27, 2026
The kernel CVE team scores this race condition in IPv4 TCP connection setup at 9.8; Red Hat, Oracle and SUSE score it 8.1. Anthropic says Claude produced a working exploit giving an unauthenticated remote attacker root on servers with an MPTCP listener, though the proof of concept takes 48 minutes to leak a kernel pointer and no in-the-wild exploitation has been reported. Fixed upstream October 5 in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3; Debian, Oracle and Amazon Linux have shipped fixes, while Ubuntu and RHEL 8/9/10 still listed fixes as in progress as of October 30. Not in KEV.
Source: Anthropic research post · CVE-2026-98432 · The Hacker News
This brief covers the trailing ~48 hours (October 29–31, 2026).
Primary sources: CISA KEV alert (Oct 29) · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Cursor security notice · Microsoft Security Blog · OpenSourceMalware · Binance incident update · WordPress GHSA-4w3m-c66w-69mg · WordPress 7.1.4 · CVE-2026-119977 · CrowdStrike · Chainalysis · Trezor · Drupal SA-CONTRIB-2026-254 · CVE-2026-118539 · Anthropic · CVE-2026-98432