This brief covers the trailing ~48 hours (October 30 – November 1, 2026). Every item below was traced to a primary source — the vendor’s own disclosure, the CVE record, or the original research — and confirmed to fall inside the window.
Binance confirms ~$6.3 billion hot-wallet theft; TRM Labs points to North Korea’s TraderTraitor
Binance · October 30, 2026
Binance published a “Security Incident Update (2026-10-30)” stating that an attacker reached a service container via a compromised DevOps engineer’s laptop and submitted unauthorized withdrawals, with an estimated impact of about $6.3 billion. The exchange says it found no evidence of a wallet private-key leak, has suspended deposits and withdrawals, revoked the affected authorizations, and reports roughly $3 billion frozen on-chain by Tether, Circle, Ripple and others. TRM Labs and Chainalysis attribute the theft to DPRK’s TraderTraitor with high confidence; Elliptic urges caution because the laundering pattern differs from past DPRK cases and no root cause has been published. No CVE is involved.
“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop.” — Binance, Security Incident Update
Source: Binance announcement · The Hacker News · SecurityWeek
Northflank breach: customer environment variables decrypted, stored AI API keys abused
Northflank · October 30, 2026
Developer-platform Northflank opened a security incident at 13:40 UTC on October 30 after a Wiz threat alert, and within twenty minutes told customers to assume every environment variable had been decrypted and to disable or rotate all keys. By 23:38 UTC, customers were reporting unauthorized use of AI provider API keys that had been stored on the platform; Northflank linked the overlapping source IPs to the “Black October” wave of LLM-credential theft documented by Wiz. Mitigations so far include network-policy patches, one-click secret rotation for Postgres, MongoDB, MySQL and Redis add-ons, and audit logs enabled for all tiers. The incident remains in “Identified” status with no root cause published.
“Assume all environment variables have been decrypted. Disable/rotate all keys.” — Northflank status page, October 30, 13:58 UTC
Source: Northflank incident page · BleepingComputer
Chainalysis discloses intrusion into internal tools via “offensive agentic techniques”; customer identity data exposed
Chainalysis · October 30, 2026
Chainalysis published a disclosure at 21:14 UTC saying an external actor used AI-driven attack techniques to gain unauthorized access to its systems and internal tools, activity it detected in October. Accessed data is limited to user IDs, full names, email addresses and organization role labels for provisioned platform users; the company says investigation content (graphs, notes, cases), query results, cleartext passwords, MFA secrets, session tokens and authentication credentials were not touched. It is patching the exploited vulnerabilities, hardening with outside experts, has notified all customers, and states explicitly that the incident is unrelated to the Binance theft.
“Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access.” — Chainalysis security disclosure
Source: Chainalysis disclosure · The Hacker News
Trojanized “Claude Code” extension on Cursor Marketplace planted a persistent SSH backdoor
OpenSourceMalware · October 30, 2026
OpenSourceMalware (Jenn Gile and Paul McCarty) reported that version 2.1.313 of the anthropic.claude-code extension was published to Cursor’s marketplace on October 29 with a 66-line loader prepended to extension.js. The loader adds an Ed25519 key labeled “svc-telemetry” to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse SSH tunnel to 134.209.82.225 that reconnects every 60 seconds, installs persistence (LaunchAgent, crontab, or scheduled task), and beacons host reconnaissance over plain HTTP. Cursor says the malicious build was live for roughly 11 hours, affected at most 5,000 users, and later flagged 2.1.312 as malicious too; it rotated keys and is rebuilding the marketplace. Anthropic states its own systems were not compromised and that the VS Code Marketplace and Open VSX builds are unaffected. Users who installed from Cursor should treat the host as compromised and remove the rogue key and persistence.
“Malicious code is prepended to the normal extension bundle and executes before legitimate initialization.” — OpenSourceMalware
Source: OpenSourceMalware analysis · The Hacker News
CISA adds two more Ivanti Connect Secure flaws to KEV, completing the UTA0576 root-access chain
CISA / CVE.org · October 30, 2026
CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog on October 30, with federal remediation deadlines of November 2 and November 13 respectively. CVE-2026-111357 is a privilege-escalation bug in which the dsinvoked broker trusts DSCache configuration data, yielding root; the CVE record carries CVSS 7.0 (AV:L/AC:H), while outlets citing Ivanti’s advisory report 8.8. CVE-2026-118527 is a lower-severity predictable-identifier flaw that lets an authenticated attacker upload files to a known location (reported CVSS 4.3). Volexity observed both chained with the already-listed authentication-bypass/RCE CVE-2026-104935 (KEV October 13) by the actor it tracks as UTA0576, who then harvested Active Directory credentials, LAPS passwords and BitLocker recovery keys. Ivanti’s fixed builds are 25.1.1.3 and 22.8R2.6; Volexity recommends forensic review of any appliance showing lateral movement.
“We made the decision to not delay getting a fix to customers that resolved the primary exploitation path.” — Ivanti advisory, as quoted by The Hacker News
Source: CISA alert · CVE-2026-111357 record · Ivanti advisory · Volexity · The Hacker News
WordPress core upgrade-staging RCE draws ~63,000 attack attempts in 24 hours
Wordfence / The Hacker News · October 30, 2026
Wordfence reported blocking 62,969 attempts in a single day to reach the web-accessible staging directory used during full-package WordPress core upgrades, the path behind GHSA-4w3m-c66w-69mg. The flaw, a race condition during core updates in which an unauthenticated attacker who wins the race against package extraction can achieve remote code execution, affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4 with backports to every branch back to 4.7.39. No CVE has been assigned; Wordfence scores it CVSS 8.1 while the GitHub advisory labels it “Low”. Attackers are probing paths such as setup-config.php; no confirmed compromises have been reported. Not in KEV.
“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg
Source: WordPress advisory · Wordfence · The Hacker News
Still developing
GitLab CVE-2026-97229 exploited against Alpine Linux infrastructure — GitLab / CISA · October 12 (patch), October 29 (KEV), 2026
The CVSS 10.0 regex-compiler RCE in GitLab CE/EE (fixed in 19.2.8, 19.3.5 and 19.4.2) entered KEV on October 29 with a November 1 federal deadline. Alpine Linux maintainers disclosed that an attacker hit their unpatched GitLab instance on October 20–21 with crafted CI configurations, crashing workers eight times and pulling the container image; later attempts on October 25–26 were blocked. Alpine found no evidence of success but rebuilt the instance from scratch and verified aports, packages and the October 21 releases were untampered. Source: GitLab patch release · CISA KEV · The Hacker News
Cisco ASA/FTD SSL VPN zero-day CVE-2026-76418 under active exploitation — Cisco / CISA · October 28–29, 2026
Cisco’s advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 describes a CVSS 8.6 unauthenticated denial-of-service (device reload) in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group; Cisco says it became aware of exploitation in October. CISA added it to KEV on October 29 with a November 1 due date. Fixed releases span ASA 9.16.4.104 through 9.24.1.27 and FTD 7.0.11 through 10.1.1. Source: Cisco advisory · CISA KEV
Drupal Commerce Core access bypass CVE-2026-118539 exploited against online stores — Drupal Security Team · October 28, 2026
SA-CONTRIB-2026-254 (rated Highly critical, 21/25) says the module “doesn’t sufficiently protect certain routes and entity fields,” allowing an access bypass that can financially impact the vendor, and states the vulnerability “is being actively exploited in the wild.” Affected: Commerce Core before 2.41 and 3.0.0 through 3.3.12; fixed in 8.x-2.41 and 3.3.13. Not in KEV. Source: Drupal advisory · SecurityWeek
This brief covers the trailing ~48 hours (October 30 – November 1, 2026).
Primary sources: Binance Security Incident Update · Northflank incident page · Chainalysis disclosure · OpenSourceMalware · CISA KEV alert (Oct 30) · CVE-2026-111357 · Volexity · WordPress GHSA-4w3m-c66w-69mg · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Drupal SA-CONTRIB-2026-254