# Archive
Browse past daily curated stories
Sunday, November 01, 2026
-
1SecurityWeek general$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
North Korea's TraderTraitor threat group is linked to a record-breaking $6.3 billion hack of Binance, the world's largest cryptocurrency exchange. Blockchain analysts identified hallmarks of the DPRK-affiliated group, while Binance is investigating a potentially compromised engineer laptop as the initial access vector. The theft surpasses all previous crypto heists in scale and underscores the persistent and escalating financial threat posed by North Korean state-sponsored actors.
-
2Ars Technica Security generalHackers steal $6.3 billion from Binance in record crypto heist
Binance confirmed a $6.3 billion cryptocurrency theft that blockchain investigators attribute to North Korea, making it the largest crypto heist on record. The exchange is scrambling to freeze stolen funds as investigators trace on-chain movements consistent with North Korean laundering tradecraft. Security practitioners should note the likely role of a compromised engineer laptop as an initial foothold, reinforcing supply-chain and insider-threat concerns at major exchanges.
-
3The Hacker News generalAttackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA added two Ivanti Connect Secure vulnerabilities to its KEV catalog following active exploitation: CVE-2026-111357 (CVSS 8.8), a missing authentication flaw, and a second flaw that together enable unauthenticated root access via chained exploitation. Defenders running ICS should treat patching as immediately mandatory given CISA's KEV designation and confirmed in-the-wild chaining. This continues the pattern of Ivanti VPN appliances serving as primary initial-access targets for sophisticated threat actors.
-
4CyberScoop generalChina-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
CrowdStrike reports that China-backed threat group 'Vapor Panda' used an agentic AI-powered pentesting tool to compromise 140 sensitive targets across more than 200 organizations spanning at least 14 countries in just 11 days. The campaign's speed and success rate represent a qualitative shift in state-sponsored offensive capability, demonstrating that AI-assisted attack automation is no longer theoretical. Security teams should expect dramatically compressed windows between vulnerability discovery and exploitation at scale.
-
5The Hacker News generalOfficial Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
The official Anthropic Claude Code extension on the Open VSX registry and the Cursor Marketplace was backdoored for nearly 12 hours, delivering a persistent SSH backdoor to infected developer machines. Attackers gained access via a compromised verified Cursor account; the mechanism of that compromise remains unknown. The incident highlights supply-chain risk in AI-assisted development tooling, where developers implicitly trust extensions from ostensibly verified publishers.
-
6SecurityWeek generalMax-Severity GitLab Vulnerability Exploited Against Alpine Linux
CVE-2026-97229, a maximum-severity unauthenticated remote code execution vulnerability in GitLab, is being actively exploited in the wild, with confirmed attacks targeting Alpine Linux instances. CISA added the flaw to its KEV catalog, and organizations running self-managed GitLab instances should apply the patch released earlier this month immediately. Exploitation of GitLab RCE bugs historically leads to source code theft, CI/CD pipeline compromise, and lateral movement into downstream environments.
-
7The Hacker News generalWordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
A high-severity unauthenticated race condition in WordPress Core versions 4.7 through 7.1.3 (CVSS 8.1) drew nearly 63,000 exploitation attempts within 24 hours of patch release, with no CVE identifier yet assigned. Patches were released in October and attackers are actively probing exposed instances for remote code execution. Site administrators running affected WordPress versions should prioritize emergency patching given the immediate and widespread exploitation activity.
-
8The Hacker News generalTrezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis
A Trezor Safe 5 hardware wallet purchased from reseller CryptoBilis was found to contain an extra circuit board designed to exfiltrate the wallet's recovery phrase over a mobile network, constituting a hardware supply-chain implant. Trezor is advising all customers who purchased from CryptoBilis since March 2026 to immediately transfer funds and generate a new recovery phrase. This represents a rare confirmed hardware-level supply-chain attack against cryptocurrency custody devices, with direct and severe financial risk to affected users.
-
9SecurityWeek generalPHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
PHP2Shell attacks are actively exploiting critical PHP vulnerabilities against Palo Alto firewall web interfaces, with over 22.6 million exposed instances potentially at risk across more than a week of sustained exploitation. The campaign has been less effective against WordPress targets despite attempts. Defenders managing Palo Alto devices with exposed management interfaces should apply PHP patches immediately and audit for indicators of compromise.
-
10BleepingComputer generalChainalysis discloses data breach from "offensive agentic techniques"
Blockchain analytics firm Chainalysis disclosed a breach in which external attackers used 'offensive agentic techniques' to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. The company states that investigation content, authentication credentials, and session tokens were not accessed. The use of AI-driven agentic attack methods against a firm specializing in tracking illicit crypto flows is notable both for the technique employed and the sensitivity of Chainalysis's customer base in law enforcement and financial compliance.