Friday 30 October 2026

Major Incidents or Breaches

• Binance, the world’s largest cryptocurrency exchange, suffered a record-setting security breach resulting in the theft of approximately $6.3 billion in digital assets. The incident has been linked to the compromise of a DevOps engineer’s laptop, and blockchain investigators attribute the attack to North Korean threat actors, specifically the TraderTraitor group. Nearly $3 billion in assets were reportedly frozen in response to the breach, which was executed in under 20 minutes ^{[7][15][17][32][42][47][49][54][61][79]}.
• Polymarket, a prediction market platform, temporarily halted trading after hackers compromised a third-party service and distributed a cryptocurrency-draining JavaScript, resulting in the theft of approximately $2.5 million from user accounts. The attack leveraged a supply chain vector via a website monitoring tool ^[20][29][45].
• A searchable database containing records of more than 41,000 current and former US Department of Homeland Security employees and contractors was leaked, exposing contact details and sensitive job information ^[66][74][80].
• Belgium’s tax agency confirmed a cyberattack that forced it to pull services offline and extend tax deadlines ^[52].
• Japan Airlines disclosed a third-party data breach at Amadeus’s Passenger Service System, exposing data of about 92,000 customers ^[19].
• An employee at RIZAP Inc. in Japan uploaded health records of 726 individuals to a personal AI chat, resulting in a sensitive data exposure incident ^[71].
• The University of New Mexico Health reported a cyberattack, with a ransomware group claiming responsibility ^[69].
• The Florida Department of Education revealed a breach of its student financial aid website, potentially exposing personal information, including Social Security numbers, of approximately 4.9 million people ^[70].
• Frontline school software suffered a breach exposing student Social Security numbers and Medicaid IDs ^[73].

Newly Discovered Vulnerabilities

• A highly critical authorization bypass vulnerability in Drupal Commerce Core, tracked as CVE-2026-118539, is being actively exploited in the wild to target online stores ^[5][14][28].
• A maximum-severity remote code execution vulnerability in GitLab, CVE-2026-97229, is now being exploited against unpatched servers, including Alpine Linux deployments ^[6][12][30].
• The Linux kernel is affected by a critical TCP flaw, CVE-2026-98432, rated 9.8 CVSS, impacting major distributions such as Ubuntu and Red Hat Enterprise Linux ^[9].
• Cisco Catalyst SD-WAN Controllers are being targeted via CVE-2026-20127, an authentication-bypass vulnerability exploited to deploy custom KeyDrift malware ^[6][22].
• TeamViewer is affected by an integer overflow vulnerability, CVE-2026-111585, which could allow malicious hosts to execute arbitrary code on support technicians’ systems ^[31].
• Researchers found critical vulnerabilities in five AI developer tools, with flaws in OpenAI and Microsoft products still unpatched, primarily involving embedded browsers ^[50].
• Critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are being targeted for remote code execution in web server environments ^[81][77].
• A fresh unauthenticated race condition vulnerability in WordPress is under active exploitation, allowing remote code execution ^[27].

Notable Threat Actor Activity

• North Korean threat actors, specifically the TraderTraitor group, are linked to the $6.3 billion Binance heist. Microsoft also reports increased adoption of AI tools by North Korean actors to enhance attack speed and efficiency ^{[32][42][54][79][82]}.
• A suspected Chinese-nexus actor compromised a US government-affiliated network by chaining a custom PHP2Shell exploit to gain root access to Palo Alto Networks firewall servers ^[51][53][67].
• UAT-11473, a newly tracked APT group, exploited a Cisco SD-WAN flaw to deploy custom KeyDrift malware ^[22].
• Belarusian state hackers, identified as the “FrostyNeighbor” APT, launched a destructive data-wiping attack in Ukraine, aligning with Russian cyber objectives ^[36][67].
• The Syrian Electronic Army hacker “Th3Pr0” was sentenced to 42 months in US federal prison for a hacking conspiracy that involved posting a fake tweet, triggering a $136 billion market drop ^[3][56].
• Threat actors are distributing malicious loaders and cryptocurrency miners disguised as AI desktop applications for Anthropic Claude and OpenAI ChatGPT, abusing signed executables ^[10].
• A trojanized version of Anthropic’s Claude Code extension was distributed via the Cursor Marketplace, planting a persistent SSH backdoor on developer machines ^[4][59].
• A campaign abusing Hugging Face models for crypto mining has resurfaced, hijacking GPU servers and deploying backdoors ^[18].
• Attackers exploited a fake cryptocurrency trading app on the Apple App Store, resulting in the theft of $23,000 from 27 Solana wallets ^[21].
• A bulletproof hosting provider, Virtualine, lost its domain to an FBI seizure after supporting ransomware and infostealer operators ^[26].

Trends, Tools, or Tactics of Interest

• Attackers are increasingly leveraging supply chain attacks, as seen in the Polymarket incident and the trojanized Claude Code extension ^{[20][29][4][59]}.
• There is a growing trend of threat actors exploiting vulnerabilities in widely used open-source and enterprise platforms, including Drupal, GitLab, Linux, PHP, WordPress, and Cisco SD-WAN ^{[5][6][9][12][14][22][27][28][30][31][50][77][81]}.
• AI is being adopted both as an attack vector and as a defensive tool. North Korean threat actors are integrating AI into their tradecraft, while Google and Anthropic highlight AI models capable of discovering and exploiting vulnerabilities. AI-assisted remediation and agent verification tools are being launched for enterprise security ^{[34][40][57][58][60][82]}.
• Phishing campaigns themed around Anthropic are bypassing leading secure email gateway solutions ^[37].
• Attackers are abusing legitimate communication channels, such as Microsoft Teams and phone calls, to conduct vishing and social engineering attacks that result in remote access session compromises ^[62].
• Chrome extensions with over 13 million installs were found hijacking search queries for ad revenue ^[23].
• Smart TVs and IoT devices continue to present significant security risks due to unpatched vulnerabilities and data tracking ^[65].
• Criminal groups rapidly rebuild fake shopping sites after takedowns, often reusing web assets and infrastructure ^[64].
• Malware operators are using victims’ OpenAI API keys to execute AI queries via NIK C2 malware ^[55].

Regulatory or Policy Developments Affecting the Security Industry

• The UK’s Ofcom has outlined four possible age-verification methods for enforcing the under-16 social media ban, including photo ID, bank checks, and face scans ^[78].
• The UK Investigatory Powers Commissioner’s Office reported that GCHQ cannot account for thousands of data storage devices, expressing concern over the agency’s asset management and related security implications ^[43][48].
• Australia’s Signals Directorate disrupted the Amadey malware operation, severing criminal access to approximately 180,000 infected computers ^[72].

Sources

1. Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen - thehackernews.com
2. Binance links $6.3 billion crypto theft to compromised DevOps laptop - bleepingcomputer.com
3. Binance probes potential $5.8 billion crypto-theft hack - bleepingcomputer.com
4. $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor - securityweek.com
5. The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes - wired.com
6. Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds - therecord.media
7. In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security - theregister.com
8. Binance Hit by Record-Breaking $6.3bn Hack in Largest Cryptocurrency Heist in History - infosecurity-magazine.com
9. Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record - helpnetsecurity.com
10. Binance hit by largest-ever crypto theft, with $6.3 billion stolen - malwarebytes.com
11. Polymarket halts trading after crypto-draining script breach, $2.5M traced - bleepingcomputer.com
12. $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack - securityweek.com
13. Polymarket confirms cyberattack on third-party provider after outages - therecord.media
14. Leaked DHS employee archive, Icepick, faces challenges to stay online - cyberscoop.com
15. DHS personnel leak exposes contact details and sensitive job information - databreaches.net
16. Hackers steal and publish data on 41,000 Homeland Security workers - malwarebytes.com
17. Belgium's tax agency confirms cyberattack, pulls services offline - theregister.com
18. Japan Airlines suffers third-party data breach exposing passenger info - bleepingcomputer.com
19. A RIZAP Employee Uploaded 726 People’s Health Records to a Personal AI Chat - databreaches.net
20. UNM Health addresses cyberattack in New Mexico after ransomware group claims responsibility - databreaches.net
21. Florida education department says data breach may affect 4.9 million people - databreaches.net
22. Student SSNs and Medicaid IDs Exposed in Frontline School Software Breach - databreaches.net
23. Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw - thehackernews.com
24. Drupal warns of critical Commerce Core flaw exploited in attacks - bleepingcomputer.com
25. Drupal Commerce Core Vulnerability Exploited Against Online Stores - securityweek.com
26. CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV - thehackernews.com
27. CISA says max severity GitLab flaw now exploited in the wild - bleepingcomputer.com
28. Max-Severity GitLab Vulnerability Exploited Against Alpine Linux - securityweek.com
29. Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions - thehackernews.com
30. Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware - bleepingcomputer.com
31. TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines - securityweek.com
32. Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched - theregister.com
33. Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) - unit42.paloaltonetworks.com
34. A quiet week in infosec <.< - blog.talosintelligence.com
35. Fresh WordPress Vulnerability in Attackers’ Crosshairs - securityweek.com
36. Tracking AI adoption in North Korean threat actor tradecraft - microsoft.com
37. Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers - theregister.com
38. Chinese Actor Compromises US Government Network Via Chained PHP2Shell Exploit - infosecurity-magazine.com
39. Risky Bulletin: Belarusian state hackers get on the data-wiping train - news.risky.biz
40. As Russia's Cyberwar Evolves, Belarus Steps Forward - darkreading.com
41. Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison - thehackernews.com
42. Assad regime hacker who caused $136 billion market drop sentenced to 42 months - helpnetsecurity.com
43. Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners - thehackernews.com
44. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - thehackernews.com
45. Claude Code extension poisoned with persistent SSH backdoor - helpnetsecurity.com
46. Hugging Face malware campaign returns to hijack GPUs for crypto mining - bleepingcomputer.com
47. Fake crypto app on Apple App Store linked to $23K wallet theft - bleepingcomputer.com
48. Bulletproof Host Virtualine Loses Its Domain to FBI Seizure - securityweek.com
49. Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model - securityweek.com
50. Claude Model Builds Exploits Across Major Browsers &amp; OSes - darkreading.com
51. Shufti ties AI agent actions to verified owners and permissions - helpnetsecurity.com
52. Bedrock Data routes data exposure fixes to owners and verifies results - helpnetsecurity.com
53. Open-weight AI model GLM-5.3 cheated its way to correct answers - helpnetsecurity.com
54. Anthropic-Themed Phishing Emails Bypass Top Security Tools - darkreading.com
55. Fake IT help desk callers got by on little more than names and email addresses - helpnetsecurity.com
56. Chrome extensions with 13.4 million installs caught hijacking searches - bleepingcomputer.com
57. Smart TVs can harbor unpatched security flaws and track what you watch - helpnetsecurity.com
58. Scammers rebuild fake shopping sites within hours of a takedown - helpnetsecurity.com
59. NIK C2 Malware Can Use Victims’ OpenAI Keys for AI Queries - infosecurity-magazine.com
60. Photo ID, bank checks, face scan? The UK’s age-check options - malwarebytes.com
61. British spy agency cannot account for thousands of data storage devices, watchdog says - therecord.media
62. British intelligence agency misplaced 'thousands' of storage devices, years later still can't say how many - theregister.com
63. Australia severs criminal access to 180,000 computers after breaching Amadey malware backend - databreaches.net