FBI attributes Binance’s multibillion-dollar theft as exploited flaws spread

The FBI attributed Binance’s theft of more than $6 billion to North Korea-aligned TraderTraitor, following disclosure that a compromised engineering laptop enabled the loss. Elsewhere, attackers chained web and Linux flaws for root access, compromised developer tools, and forced Moldova to suspend 82 public services.

Key developments

Binance theft attributed

The FBI attributed the theft of more than $6 billion from Binance to North Korea-aligned TraderTraitor, alongside the U.S. Secret Service and IRS Criminal Investigation. Binance had linked approximately $6.3 billion in stolen cryptocurrency to a compromised DevOps engineer’s laptop and said nearly $3 billion had been frozen on-chain.

A compromised engineering endpoint provided a route to financial infrastructure holding billions in customer assets.

Oct 30–Nov 1 · The Record · The Hacker News · BleepingComputer

PHP2Shell attacks reach root

CISA confirmed exploitation of two PHP2Shell vulnerabilities rated 9.2 and warned that attackers were chaining them with the Linux kernel Fragnesia privilege-escalation flaw. Researchers described an October 25 attack that gained root access on 25 servers and breached a U.S. government-affiliated network.

Fixing the web entry point alone does not address the kernel flaw attackers are using to take full control of servers.

Oct 27–29 · The Hacker News · BleepingComputer · The Hacker News

Moldova suspends public services

Moldova temporarily shut down 82 online public services after attackers stole personal and financial data on 750,000 citizens, roughly one third of its population. Attackers tried to regain access after eviction while the digital agency began restoring services.

Citizens face both exposure of sensitive records and interrupted access to government services during recovery.

Oct 28–29 · Risky Business News

Developer extension installs backdoors

A malicious Claude Code VS Code extension circulated through Cursor’s marketplace for approximately 11 hours on October 29, potentially exposing up to 5,000 developers. It installed persistent SSH backdoors, and Cursor briefly took down the marketplace to remove it.

Affected developer machines can retain attacker access after the extension itself is removed.

Oct 30 · BleepingComputer · The Hacker News

Florida exposes Social Security numbers

Florida’s Department of Education warned that 4.9 million people had Social Security numbers leaked in a breach involving the Florida Student Financial Aid website. The department said it became aware of the breach on October 19.

The exposed identifiers create lasting identity-fraud risk for people whose financial-aid records were affected.

Oct 30 · The Record

Undercover personnel exposed

A leak exposed personal and work information for more than 41,000 DHS personnel, including undercover ICE agents. The information was allegedly stolen from an Okta single sign-on system earlier this year.

Disclosure of undercover identities creates personal and operational risks beyond ordinary employee-data exposure.

Oct 29 · SecurityWeek · Ars Technica Security

GitLab exploitation triggers rebuild

CISA added maximum-severity GitLab flaw CVE-2026-97229 to its exploited-vulnerability catalog; the patched flaw permits unauthenticated remote code execution. Alpine Linux rebuilt its GitLab server and reset all passwords after attempted exploitation on October 20–21 raised concerns about possible compromise.

Internet-facing development servers can expose source-code infrastructure to attackers without requiring credentials.

Oct 30–Nov 1 · BleepingComputer · BleepingComputer · SecurityWeek

Ivanti chain grants root access

Attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access. CISA added two of the vulnerabilities to its exploited-vulnerability catalog following active exploitation.

Affected remote-access appliances can be fully controlled by attackers who have no valid account.

Oct 31 · The Hacker News

Brotli and Commerce exploitation flagged

CISA added vulnerabilities affecting Google’s Brotli decoder and Adobe Commerce/Magento to its exploited-vulnerability catalog, with reports describing Node2Shell exploitation and PolyShell attacks breaching hundreds of stores. The Brotli remote code execution flaw affects servers that decompress Brotli data, including Node.js, Python applications, Bun, Envoy and Istio.

Brotli exposure extends across application runtimes and infrastructure, rather than a single server product.

Oct 28–29 · BleepingComputer · The Hacker News · Risky Business News

Cisco VPN crash flaw patched

Cisco released updates for an actively exploited denial-of-service vulnerability in ASA and FTD software. Unauthenticated attackers can use the Remote Access SSL VPN service to force vulnerable firewalls to reload.

Attacks can interrupt remote access by repeatedly knocking exposed VPN firewalls offline.

Oct 29 · BleepingComputer · SecurityWeek

Also this week

Breaches and theft

• Sony Network Communications confirmed a breach compromising approximately 2.5 million records containing current and former customers’ personal information. BleepingComputer

• Attackers infected 953 online stores, mostly running Magento, with scanner-evading JavaScript loaders served through CMS blocks in a campaign active since July 2025. The Hacker News

• The Gheist campaign used stolen GitHub tokens to plant workflows that exposed private-repository secrets in Actions logs, then downloaded the logs and deleted the runs. The Hacker News · Dark Reading

• An adversary-in-the-middle campaign compromised 97 Microsoft 365 accounts across 79 organizations, with Huntress detecting 497 successful sign-ins using stolen sessions between July 14 and September 22. The Hacker News

• Northflank warned customers to rotate all credentials and secrets stored on its platform after a breach led to unauthorized use of customers’ AI API keys. BleepingComputer

• Chainalysis said attackers using “offensive agentic techniques” exposed customer names, email addresses, user IDs and organizational roles, but did not access investigation content, authentication credentials or session tokens. BleepingComputer · The Hacker News

• A hijacked DebugBear page-speed script sold signed-in Polymarket traders’ positions and transferred funds to attackers on October 29, with Polymarket saying it is refunding about $2.7 million to 726 affected wallets. The Hacker News

Patches and exposure

• Apple backported a fix for actively exploited CoreGraphics flaw CVE-2026-86950, rated 8.8, to older iPhones and iPads; its October update release addressed 304 vulnerabilities overall. SANS Internet Storm Center · The Hacker News

• Drupal urged merchants to patch actively exploited Commerce Core authorization bypass CVE-2026-118539, affecting versions 0.0.0–2.41 and 3.0.0–3.3.13, and audit their orders. BleepingComputer · SecurityWeek · The Hacker News

• Anthropic researchers developed an exploit for a critical Linux kernel flaw allowing unauthenticated remote command execution as root on servers running Multipath TCP listeners. BleepingComputer

• A critical EDK2 UEFI firmware vulnerability allows code execution early in server boot and reportedly affects most servers. Ars Technica Security

• PHP2Shell attacks gained root access on Palo Alto Networks firewalls but failed against WordPress, while more than 22.6 million exposed instances were described as potentially affected by the PHP flaws. SecurityWeek

• Attackers made nearly 63,000 attempts in 24 hours against a patched WordPress Core remote code execution flaw affecting versions 4.7 through 7.1.3 and rated 8.1. SecurityWeek · The Hacker News

• OpenAI fixed a P1 ChatGPT share-link flaw eight days after its October 18 report that could let a malicious link execute code in a logged-in user’s session and read private conversations. The Hacker News

• TeamViewer fixed a flaw allowing malicious or compromised remote hosts to crash a connecting viewer’s application and potentially execute code, depending on the platform. The Hacker News

• A CVSS 10.0 flaw in Canonical’s LXD and MicroCloud allowed attackers with HTTPS API access and a trusted client’s public certificate to impersonate that client without its private key. The Hacker News

• A researcher released proof-of-concept code for patched Android flaw CVE-2026-58882, which lets crafted text messages disrupt cellular service or crash unpatched phones. BleepingComputer

Attacker methods

• An in-the-wild prompt-injection technique exploited coding assistants’ trust in local Markdown instruction files to blur the boundary between document content and executable actions. Dark Reading

• An ongoing social-engineering campaign combined mail bombing with external Teams chats to deliver malware in 15 minutes, with a possible link to Black Basta. Dark Reading

• Researchers described the PeopleSoft exploit used by ShinyHunters since May as three chained flaws patched in June under CVE-2026-35273, beginning with server-side request forgery into an internal management interface. The Hacker News

• Researchers linked Volt Typhoon to the disrupted Silent Train access network, which used rotating chains of compromised SOHO, IoT and enterprise devices in four zero-day campaigns. BleepingComputer · The Hacker News

• Cisco Talos identified UAT-11473 exploiting authentication bypass CVE-2026-20127 in Cisco SD-WAN Catalyst Controller instances to deploy KeyDrift. Cisco Talos

• CrowdStrike attributed attacks targeting more than 200 organizations to Chinese state-sponsored Vapor Panda, which uses the Go-based AI-powered ARTEX penetration-testing framework. The Hacker News

• Cisco Talos described VOLTA as a self-deleting stealer that takes credentials, sessions and cryptocurrency wallets, then uses language models to rank victims’ valuable assets. Cisco Talos

• The Aokigahara information stealer targeted developer keyrings and AI assistants, exposing AI sessions, business data and developer infrastructure from compromised endpoints. Dark Reading

Defense and enforcement

• The Australian Signals Directorate disconnected an Amadey controller from 180,000 infected computers worldwide after accessing the criminal’s backend. The Hacker News

• Interpol’s third Operation Serengeti resulted in 1,462 arrests across 20 African countries and the United States and recovered $105 million in stolen funds. Dark Reading

• CISA announced a new strategy to strengthen national cyber defense and critical infrastructure security. CISA News

• Google’s six-month comparison found 45 V8 vulnerabilities with BigSleep and 37 with Fuzzilli, with a reported 25% overlap in the specific bugs found. Project Zero

• A federal court in Virginia sentenced Syrian Electronic Army hacker Ahmad Umar Agha, known as “Th3Pr0,” to 42 months in prison for pro-Assad attacks on media, businesses and government entities. The Record · SecurityWeek

What to watch

• Watch for completion of Moldova’s restoration of 82 public services and whether attackers’ attempts to regain access disrupt recovery.

• Watch for completion of Polymarket’s promised refunds of about $2.7 million to 726 affected wallets.

• Watch for CISA’s implementation measures for its new national cyber defense and critical infrastructure strategy; timing for these pending developments has not been announced.