# Today's Top Stories

Binance, the world's largest crypto exchange, suffered a $6.3 billion theft traced to a compromised DevOps engineer's laptop, with blockchain analysts attributing the attack to North Korea's TraderTraitor group. The incident represents the largest cryptocurrency hack in history, prompting Binance to scramble to freeze funds across multiple chains. Security teams should note the initial access vector — a single compromised endpoint — underscoring the risk of privileged developer workstations.

CISA added two actively exploited vulnerabilities to its KEV catalog: CVE-2026-97229, a CVSS 10.0 integer overflow in GitLab Community and Enterprise Editions enabling unauthenticated RCE, and a Cisco firewall DoS flaw. The GitLab vulnerability has been confirmed exploited against Alpine Linux infrastructure. Federal agencies face mandatory remediation deadlines under BOD 22-01, and all GitLab administrators should prioritize patching immediately.

A trojanized version of Anthropic's official Claude Code VS Code extension was distributed via Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware that installed persistent SSH backdoors on infected hosts. The attack vector was a compromise of Cursor's marketplace itself, not the extension's source code, raising serious supply chain concerns for AI-assisted development environments. Cursor temporarily took down its marketplace service to remove the malicious package.

A critical Linux kernel vulnerability tracked as CVE-2026-98432 (CVSS 9.8) in the TCP/MPTCP stack affects Ubuntu, Red Hat Enterprise Linux, and other major distributions, allowing unauthenticated remote attackers to execute commands as root. Anthropic researchers developed a working exploit and disclosed it on October 27, and Security researchers confirmed the flaw enables remote root access on servers running Multipath TCP listeners. Administrators running MPTCP-enabled servers on affected distributions should apply kernel patches urgently.

CrowdStrike attributed an ongoing campaign targeting 200+ organizations across 14 countries to Vapor Panda, a Chinese state-sponsored threat actor, which used an AI-powered Go-based penetration testing framework called ARTEX to compromise 140 sensitive targets in just 11 days. The use of agentic AI to automate intrusion operations at this scale and speed represents a significant escalation in nation-state offensive capabilities. The campaign is still active, making it an immediate threat to government, defense, and critical infrastructure sectors.

Trezor issued a warning after a customer reported receiving a Trezor Safe 5 from reseller CryptoBilis in Southeast Asia containing a suspected hardware implant — an extra circuit board that exfiltrates the wallet's recovery phrase over a mobile network. Trezor has not yet physically examined the device but is advising all customers who purchased from CryptoBilis since March 2026 to immediately migrate funds to a new wallet with a new recovery phrase. This is a rare confirmed hardware supply chain attack against a widely-used cryptocurrency security device.

Prediction market platform Polymarket suffered a supply chain attack via a compromised third-party website monitoring tool that injected malicious JavaScript to hijack logged-in user sessions and drain cryptocurrency funds, with over $2 million confirmed stolen and approximately $2.5 million traced to a suspected attacker wallet. Polymarket suspended trading and attributed the outage, which began at 2pm EST on October 30, to the third-party compromise. The attack demonstrates how JavaScript supply chain compromises in financial platforms can directly result in asset theft.

Florida's Department of Education (FLDOE) disclosed on October 30 that a breach of the Florida Student Financial Aid website, discovered October 19, exposed the Social Security numbers and personal data of approximately 4.9 million individuals. The breach affects a state government system handling sensitive financial aid applicant data, making affected individuals at high risk for identity theft and fraud. No patch or remediation timeline has been publicly specified for the underlying vulnerability.

Drupal issued an emergency warning that CVE-2026-118539, a 'highly critical' missing authorization flaw in Commerce Core (versions 0.0.0–2.41 and 3.0.0–3.3.13), is being actively exploited in the wild, allowing attackers to bypass access controls on e-commerce sites running Drupal. Store owners are urged to audit orders immediately and update to patched versions, as the vulnerability impacts the shopping cart and checkout systems used by thousands of online stores. Active exploitation makes this a high-priority patch for any Drupal Commerce operator.

Personal details of more than 41,000 U.S. Department of Homeland Security staff — including ICE and CBP border agents — were leaked and published online, exposing names, contact details, and potentially operational information about law enforcement personnel. The exposure of agent identities creates significant operational security risks, including potential targeting of field agents by criminal organizations and foreign intelligence services. The source and full scope of the breach have not yet been officially confirmed by DHS.