WaperBinance reported a $6.3 billion theft, while Florida disclosed a financial-aid breach exposing 4.9 million people’s Social Security numbers.
Cybersecurity8 items
A compromised coding extension and active exploitation of GitLab, Drupal and PHP flaws add immediate priorities for security teams.
New7
Binance links $6.3 billion theft to compromised DevOps laptop
Binance linked approximately $6.3 billion in stolen cryptocurrency to a DevOps engineer’s compromised laptop and said nearly $3 billion had been frozen on-chain. Blockchain investigators blame North Korea, but that attribution remains unconfirmed in the supplied reports.
Why it matters: The scale of the loss highlights how a compromised engineering endpoint can expose critical financial infrastructure.
Florida financial-aid breach exposes 4.9 million people’s Social Security numbers
Florida’s Department of Education warned that 4.9 million people had Social Security numbers leaked in a breach involving the Florida Student Financial Aid website. The department said it became aware of the breach on October 19.
Why it matters: Exposure of persistent identity identifiers creates substantial fraud risk for affected people.
Compromised Claude Code extension distributed through Cursor installs SSH backdoors
A malicious Claude Code VS Code extension was distributed through Cursor’s marketplace for approximately 11 hours on October 29, potentially exposing up to 5,000 developers. The malware installed persistent SSH backdoors; Cursor briefly took down the marketplace to remove it.
Why it matters: Developer workstations may retain attacker access after the malicious extension is removed, making exposure assessment and persistence checks urgent.
CISA confirms exploitation of maximum-severity GitLab remote code execution flaw
CISA added GitLab vulnerability CVE-2026-97229 to its Known Exploited Vulnerabilities catalog. The maximum-severity flaw, patched earlier this month, allows unauthenticated attackers to execute arbitrary code on the server, with exploitation reported against Alpine Linux.
Why it matters: GitLab administrators should prioritize the available patch because exploitation is confirmed, not merely theoretical.
Drupal warns of active attacks exploiting Commerce Core authorization bypass
Drupal urged administrators to patch CVE-2026-118539, a highly critical Commerce Core authorization bypass being exploited in the wild. Affected versions span 0.0.0–2.41 and 3.0.0–3.3.13; store owners were also urged to audit orders.
Why it matters: Affected merchants need to investigate transaction integrity as well as patch their stores.
WordPress remote code execution flaw draws nearly 63,000 daily attack attempts
Attackers made nearly 63,000 attempts in 24 hours to exploit a newly patched WordPress Core remote code execution flaw. The unauthenticated race condition affects versions 4.7 through 7.1.3, carries a CVSS score of 8.1 and has no CVE identifier.
Why it matters: Rapid exploitation attempts make patch deployment urgent, although the reports do not establish successful compromise.
CrowdStrike links AI-powered ARTEX attacks to Chinese actor Vapor Panda
CrowdStrike attributed attacks targeting more than 200 organizations worldwide to Chinese state-sponsored actor Vapor Panda. The actor uses ARTEX, a Go-based AI-powered penetration-testing framework, to target high-value organizations simultaneously.
Why it matters: The findings provide a concrete example of state-backed attackers using AI-enabled tooling to scale operations across multiple targets.
Follow-ups1
PHP2Shell attacks gain root access on Palo Alto Networks firewalls
New reporting says PHP2Shell attacks have gained root access on Palo Alto Networks firewalls but failed against WordPress. More than 22.6 million exposed instances are potentially affected by the critical PHP flaws, which have been targeted for over a week.
Why it matters: Confirmed firewall compromise broadens the response priority beyond conventional PHP application servers to security infrastructure.