This brief covers the trailing ~48 hours (October 30 – November 1, 2026). Every item below was traced to a primary source — the vendor’s own disclosure, the CVE record, or the original research — and confirmed to fall inside the window.

Binance confirms ~$6.3 billion hot-wallet theft; TRM Labs points to North Korea’s TraderTraitor

Binance · October 30, 2026

Binance published a “Security Incident Update (2026-10-30)” stating that an attacker reached a service container via a compromised DevOps engineer’s laptop and submitted unauthorized withdrawals, with an estimated impact of about $6.3 billion. The exchange says it found no evidence of a wallet private-key leak, has suspended deposits and withdrawals, revoked the affected authorizations, and reports roughly $3 billion frozen on-chain by Tether, Circle, Ripple and others. TRM Labs and Chainalysis attribute the theft to DPRK’s TraderTraitor with high confidence; Elliptic urges caution because the laundering pattern differs from past DPRK cases and no root cause has been published. No CVE is involved.

“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop.” — Binance, Security Incident Update

Source: Binance announcement · The Hacker News · SecurityWeek

Northflank breach: customer environment variables decrypted, stored AI API keys abused

Northflank · October 30, 2026

Developer-platform Northflank opened a security incident at 13:40 UTC on October 30 after a Wiz threat alert, and within twenty minutes told customers to assume every environment variable had been decrypted and to disable or rotate all keys. By 23:38 UTC, customers were reporting unauthorized use of AI provider API keys that had been stored on the platform; Northflank linked the overlapping source IPs to the “Black October” wave of LLM-credential theft documented by Wiz. Mitigations so far include network-policy patches, one-click secret rotation for Postgres, MongoDB, MySQL and Redis add-ons, and audit logs enabled for all tiers. The incident remains in “Identified” status with no root cause published.

“Assume all environment variables have been decrypted. Disable/rotate all keys.” — Northflank status page, October 30, 13:58 UTC

Source: Northflank incident page · BleepingComputer

Chainalysis discloses intrusion into internal tools via “offensive agentic techniques”; customer identity data exposed

Chainalysis · October 30, 2026

Chainalysis published a disclosure at 21:14 UTC saying an external actor used AI-driven attack techniques to gain unauthorized access to its systems and internal tools, activity it detected in October. Accessed data is limited to user IDs, full names, email addresses and organization role labels for provisioned platform users; the company says investigation content (graphs, notes, cases), query results, cleartext passwords, MFA secrets, session tokens and authentication credentials were not touched. It is patching the exploited vulnerabilities, hardening with outside experts, has notified all customers, and states explicitly that the incident is unrelated to the Binance theft.

“Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access.” — Chainalysis security disclosure

Source: Chainalysis disclosure · The Hacker News

Trojanized “Claude Code” extension on Cursor Marketplace planted a persistent SSH backdoor

OpenSourceMalware · October 30, 2026

OpenSourceMalware (Jenn Gile and Paul McCarty) reported that version 2.1.313 of the anthropic.claude-code extension was published to Cursor’s marketplace on October 29 with a 66-line loader prepended to extension.js. The loader adds an Ed25519 key labeled “svc-telemetry” to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse SSH tunnel to 134.209.82.225 that reconnects every 60 seconds, installs persistence (LaunchAgent, crontab, or scheduled task), and beacons host reconnaissance over plain HTTP. Cursor says the malicious build was live for roughly 11 hours, affected at most 5,000 users, and later flagged 2.1.312 as malicious too; it rotated keys and is rebuilding the marketplace. Anthropic states its own systems were not compromised and that the VS Code Marketplace and Open VSX builds are unaffected. Users who installed from Cursor should treat the host as compromised and remove the rogue key and persistence.

“Malicious code is prepended to the normal extension bundle and executes before legitimate initialization.” — OpenSourceMalware

Source: OpenSourceMalware analysis · The Hacker News

CISA adds two more Ivanti Connect Secure flaws to KEV, completing the UTA0576 root-access chain

CISA / CVE.org · October 30, 2026

CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog on October 30, with federal remediation deadlines of November 2 and November 13 respectively. CVE-2026-111357 is a privilege-escalation bug in which the dsinvoked broker trusts DSCache configuration data, yielding root; the CVE record carries CVSS 7.0 (AV:L/AC:H), while outlets citing Ivanti’s advisory report 8.8. CVE-2026-118527 is a lower-severity predictable-identifier flaw that lets an authenticated attacker upload files to a known location (reported CVSS 4.3). Volexity observed both chained with the already-listed authentication-bypass/RCE CVE-2026-104935 (KEV October 13) by the actor it tracks as UTA0576, who then harvested Active Directory credentials, LAPS passwords and BitLocker recovery keys. Ivanti’s fixed builds are 25.1.1.3 and 22.8R2.6; Volexity recommends forensic review of any appliance showing lateral movement.

“We made the decision to not delay getting a fix to customers that resolved the primary exploitation path.” — Ivanti advisory, as quoted by The Hacker News

Source: CISA alert · CVE-2026-111357 record · Ivanti advisory · Volexity · The Hacker News

WordPress core upgrade-staging RCE draws ~63,000 attack attempts in 24 hours

Wordfence / The Hacker News · October 30, 2026

Wordfence reported blocking 62,969 attempts in a single day to reach the web-accessible staging directory used during full-package WordPress core upgrades, the path behind GHSA-4w3m-c66w-69mg. The flaw, a race condition during core updates in which an unauthenticated attacker who wins the race against package extraction can achieve remote code execution, affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4 with backports to every branch back to 4.7.39. No CVE has been assigned; Wordfence scores it CVSS 8.1 while the GitHub advisory labels it “Low”. Attackers are probing paths such as setup-config.php; no confirmed compromises have been reported. Not in KEV.

“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg

Source: WordPress advisory · Wordfence · The Hacker News

Still developing

GitLab CVE-2026-97229 exploited against Alpine Linux infrastructure — GitLab / CISA · October 12 (patch), October 29 (KEV), 2026
The CVSS 10.0 regex-compiler RCE in GitLab CE/EE (fixed in 19.2.8, 19.3.5 and 19.4.2) entered KEV on October 29 with a November 1 federal deadline. Alpine Linux maintainers disclosed that an attacker hit their unpatched GitLab instance on October 20–21 with crafted CI configurations, crashing workers eight times and pulling the container image; later attempts on October 25–26 were blocked. Alpine found no evidence of success but rebuilt the instance from scratch and verified aports, packages and the October 21 releases were untampered. Source: GitLab patch release · CISA KEV · The Hacker News

Cisco ASA/FTD SSL VPN zero-day CVE-2026-76418 under active exploitation — Cisco / CISA · October 28–29, 2026
Cisco’s advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 describes a CVSS 8.6 unauthenticated denial-of-service (device reload) in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group; Cisco says it became aware of exploitation in October. CISA added it to KEV on October 29 with a November 1 due date. Fixed releases span ASA 9.16.4.104 through 9.24.1.27 and FTD 7.0.11 through 10.1.1. Source: Cisco advisory · CISA KEV

Drupal Commerce Core access bypass CVE-2026-118539 exploited against online stores — Drupal Security Team · October 28, 2026
SA-CONTRIB-2026-254 (rated Highly critical, 21/25) says the module “doesn’t sufficiently protect certain routes and entity fields,” allowing an access bypass that can financially impact the vendor, and states the vulnerability “is being actively exploited in the wild.” Affected: Commerce Core before 2.41 and 3.0.0 through 3.3.12; fixed in 8.x-2.41 and 3.3.13. Not in KEV. Source: Drupal advisory · SecurityWeek

This brief covers the trailing ~48 hours (October 30 – November 1, 2026).

Primary sources: Binance Security Incident Update · Northflank incident page · Chainalysis disclosure · OpenSourceMalware · CISA KEV alert (Oct 30) · CVE-2026-111357 · Volexity · WordPress GHSA-4w3m-c66w-69mg · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Drupal SA-CONTRIB-2026-254

This brief covers the trailing ~48 hours (October 29–31, 2026). Every item below was traced to a primary source — the vendor advisory, CISA’s KEV catalog, the CVE record, or the affected organization’s own statement — and the dates were confirmed on those pages.

CISA adds GitLab CVSS 10.0 RCE and Cisco ASA/FTD VPN DoS to the KEV catalog

CISA / GitLab / Cisco PSIRT · October 29, 2026

CISA’s catalog update 2026.10.29 added two entries with a federal remediation deadline of November 1, 2026. CVE-2026-97229 (CVSS 10.0) is an integer overflow in GitLab CE/EE’s CI/CD regular-expression compiler that lets an unauthenticated attacker execute code on the server; GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8, and Rapid7 independently reproduced code execution against an official CE image. CVE-2026-76418 (CVSS 8.6) is a NULL-pointer dereference in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD that lets an unauthenticated remote attacker reload the device; Cisco published the advisory on October 28 with fixed releases across ASA 9.16–9.24 and FTD 7.0–10.1, and exposure requires secondary authentication on a tunnel group. Both are actively exploited and now on KEV.

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75

Source: CISA alert · GitLab patch release 19.4.2 · Cisco advisory · The Hacker News

Trojanized Claude Code extension on Cursor Marketplace planted a persistent SSH backdoor

Cursor / Microsoft Security / OpenSourceMalware · October 29, 2026

Malicious builds of Anthropic’s anthropic.claude-code extension (versions 2.1.312 and 2.1.313, Windows and macOS) were served from the Cursor VS Code Extension Marketplace under the extension’s real publisher identity between roughly 2:27 a.m. and 1:35 p.m. PT on October 29. The payload added an attacker-controlled SSH key labeled svc-telemetry to authorized_keys, attempted a reverse SSH tunnel to 134.209.82[.]225, installed persistence via cron, LaunchAgent or a SysMon scheduled task, and beaconed host details over HTTP to port 8099. Anthropic and Cursor say Anthropic’s systems were not compromised; Cursor removed the version, temporarily shut the marketplace, rotated keys and had the attacker server taken offline. Microsoft confirmed the build never reached the Visual Studio Marketplace or npm, and Socket found no trace on Open VSX. The legitimate current version is 2.1.314. Cursor published IoCs, hashes and remediation scripts.

“Removing or updating the extension does not remove artifacts written outside its installation directory.” — Microsoft Security Research

Source: Cursor security notice · Microsoft Security Blog · OpenSourceMalware · The Hacker News

Binance discloses ~$6.3B hot-wallet theft; ~$3B frozen on-chain

Binance · October 30, 2026

Binance’s incident update puts the total impact at around $6.3 billion, with roughly $3 billion frozen on-chain so far (Tether ~1.567B USDT, Circle ~800M USDC, and Arbitrum’s Security Council ~$30.5M). The exchange says its initial investigation points to a compromised DevOps engineer’s laptop that gave the attacker access to a service container used to submit unauthorized withdrawals, and that no wallet private key leaked; it later said it found additional points of breach and has not yet published a root cause. Withdrawals were suspended pending a security revamp, with deposits unaffected, and Binance says it will cover losses from the SAFU fund and company funds. TRM Labs and Chainalysis attribute the theft to North Korea’s TraderTraitor with high confidence; Elliptic urged caution absent a root cause.

“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container.” — Binance, Security Incident Update (2026-10-30)

Source: Binance announcement · The Hacker News

WordPress core upgrade-window RCE draws ~63,000 attack attempts in 24 hours

WordPress Security Team / Wordfence · October 29, 2026

WordPress 7.1.4 (October 28) fixed a race condition in which full-package core upgrades extracted files, including the installer, to a predictable web-accessible path under wp-content/upgrade; the GitHub advisory GHSA-4w3m-c66w-69mg was published October 29 and the CVE record, CVE-2026-119977 (CVSS 8.1, AV:N/AC:H/PR:N/UI:N), was published by Wordfence as CNA on October 31. All versions 4.7.0 through 7.1.3 are affected, with backports from 7.0.8 down to 4.7.39. The WordPress project rates the issue Low, but Wordfence reported 62,969 blocked exploitation attempts in a 24-hour window as attackers polled staging paths such as setup-config.php. The CVE is not in CISA’s KEV catalog.

“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg

Source: WordPress GHSA advisory · WordPress 7.1.4 release · CVE-2026-119977 · Wordfence · The Hacker News

CrowdStrike: China-nexus Vapor Panda uses AI pentest tool ARTEX against 200+ organizations

CrowdStrike · October 29, 2026

CrowdStrike reports that Vapor Panda (formerly VexatiousTemper, overlapping Trend Micro’s Earth Estries) has used ARTEX, a closed-source Go-based agentic penetration-testing framework that coordinates multiple LLM backends for reconnaissance, vulnerability identification and exploitation, against more than 200 organizations since October 17. Targets include foreign ministries across Latin America, Europe, Asia and the Middle East, a Middle East interior ministry, U.S. semiconductor, defense, pharmaceutical, nuclear and financial organizations, and telecoms in the U.S., Belgium and the Philippines. Post-exploitation activity was confirmed at nine organizations, where the group deployed BLOODALCHEMY, a ShadowPad derivative.

“Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide.” — CrowdStrike

Source: CrowdStrike blog · The Hacker News

Chainalysis discloses security incident exposing customer contact data

Chainalysis · October 30, 2026

Chainalysis says it was the target of a cybersecurity incident in which an external actor accessed internal systems; customer notifications cite exposed user IDs, full names, email addresses and organizational role labels. The company reports no evidence of unauthorized access to investigation content, authentication credentials or session tokens, says it is working with outside experts to harden its systems, and states the incident is unrelated to the Binance theft. No technical details on the entry point or dwell time have been released.

“no evidence of unauthorized access to investigation content, authentication credentials, or session tokens” — Chainalysis

Source: Chainalysis statement · BleepingComputer

Trezor warns of suspected hardware implant in a Safe 5 sold by reseller CryptoBilis

Trezor · October 30, 2026

A customer in Indonesia reported an extra circuit board, described as including a cellular module and antenna, fitted inside a Trezor Safe 5 purchased from reseller CryptoBilis via Tokopedia in August; the report says the board captures the recovery phrase from the screen and transmits it. Trezor has not yet examined the device but ended its relationship with CryptoBilis on October 9 and is advising anyone who bought a Trezor from CryptoBilis or its supplied stores since March 2026 to move funds to a new wallet with a new seed. No losses have been reported.

“Move your funds to a new wallet with a new seed as soon as possible.” — Trezor

Source: Trezor blog · The Hacker News

Still developing

Drupal Commerce Core access bypass (CVE-2026-118539) actively exploited

Drupal Security Team · October 28, 2026

SA-CONTRIB-2026-254 rates the flaw Highly critical (21/25) and says it is being exploited in the wild; the CVE record was published October 30 with a CISA ADP CVSS 3.1 score of 6.5 (Missing Authorization, CWE-862). The module fails to protect certain routes and entity fields, allowing an access bypass that can financially impact the vendor. Affected: Commerce Core below 2.41 and 3.0.0 through 3.3.12; fixed in 3.3.13 and 8.x-2.41. Drupal also advises auditing orders for inconsistencies. Not in CISA’s KEV catalog as of the 2026.10.29 update.

“This vulnerability is being actively exploited in the wild.” — Drupal Security Advisory SA-CONTRIB-2026-254

Source: Drupal advisory · CVE-2026-118539 · The Hacker News

Linux kernel IPv4 TCP race (CVE-2026-98432) still unpatched on Ubuntu and RHEL

Anthropic / kernel.org · October 27, 2026

The kernel CVE team scores this race condition in IPv4 TCP connection setup at 9.8; Red Hat, Oracle and SUSE score it 8.1. Anthropic says Claude produced a working exploit giving an unauthenticated remote attacker root on servers with an MPTCP listener, though the proof of concept takes 48 minutes to leak a kernel pointer and no in-the-wild exploitation has been reported. Fixed upstream October 5 in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3; Debian, Oracle and Amazon Linux have shipped fixes, while Ubuntu and RHEL 8/9/10 still listed fixes as in progress as of October 30. Not in KEV.

Source: Anthropic research post · CVE-2026-98432 · The Hacker News

This brief covers the trailing ~48 hours (October 29–31, 2026).

Primary sources: CISA KEV alert (Oct 29) · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Cursor security notice · Microsoft Security Blog · OpenSourceMalware · Binance incident update · WordPress GHSA-4w3m-c66w-69mg · WordPress 7.1.4 · CVE-2026-119977 · CrowdStrike · Chainalysis · Trezor · Drupal SA-CONTRIB-2026-254 · CVE-2026-118539 · Anthropic · CVE-2026-98432

This brief covers the trailing ~48 hours (October 28–30, 2026). Every item below was traced to a primary source — vendor advisory, CISA KEV entry, or the original research — and the dates were confirmed on those pages.

Cisco patches actively exploited ASA/FTD SSL VPN zero-day (CVE-2026-76418); CISA adds it to KEV

Cisco PSIRT · October 28, 2026

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, High), a denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. An unauthenticated remote attacker can send a crafted request during an SSL VPN connection to force the device to reload; the bug is triggered only when SSL remote access VPN is enabled and secondary authentication is configured on a tunnel group (including DefaultWEBVPNGroup). Fixed releases span ASA 9.16.4.104 through 9.24.10.1 and FTD 7.0.11 through 10.1.1; there is no workaround, though disabling secondary authentication on affected tunnel groups is listed as a mitigation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 29.

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory

Source: Cisco advisory · CISA KEV alert (Oct 29) · The Hacker News

GitLab CVSS 10.0 RCE (CVE-2026-97229) lands in KEV after attacker targets Alpine Linux’s GitLab

CISA / Alpine Linux · October 29, 2026

CISA’s October 29 KEV update also added CVE-2026-97229 (CVSS 10.0, Critical), a GitLab CE/EE flaw in which insufficient regular-expression validation in CI/CD configuration lets an unauthenticated user execute arbitrary code on the server. GitLab patched it on October 13 in 19.4.2, 19.3.5 and 19.2.8; self-compiled installs must also move to Ruby 3.3.13, 3.4.12 or 4.0.9+, and Ruby 3.2 will not be fixed. Alpine Linux disclosed on October 28 that an attacker began probing gitlab.alpinelinux.org on October 20, crashing worker processes repeatedly, and that its October 22 upgrade to 19.3.6 did not close the hole because the image used standard Ruby. Alpine rebuilt the server, rotated all passwords and secret keys, and is treating the system as compromised even though it found no proof the exploit succeeded.

“A successful exploit would leave no crash and no trace in the web logs.” — Alpine Linux incident post

Source: GitLab patch release · Alpine Linux incident post · CISA KEV alert (Oct 29) · The Hacker News

CISA adds Fragnesia Linux kernel LPE (CVE-2026-46300) to KEV; Palo Alto confirms PHP2Shell exploitation against exposed PAN-OS management interfaces

CISA / Palo Alto Networks / Dream · October 28–29, 2026

CISA added CVE-2026-46300 “Fragnesia” (CVSS 7.8, High), a Linux kernel local privilege-escalation bug in the IPsec ESP modules disclosed in May 2026, to the KEV catalog on October 28 with an unusually short federal remediation deadline of October 31. CISA notes it is being chained with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2, patched October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to drop PHP web shells and run commands as root. Palo Alto Networks updated its advisory on October 29 to confirm active exploitation against internet-exposed PAN-OS management interfaces, with fixes across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches (some hotfixes still pending). Israeli firm Dream, whose findings Unit 42 independently verified, reported that a suspected China-nexus actor used a custom PHP2Shell exploit plus Fragnesia to root 25 systems across the US, Japan, Taiwan and South Korea, including firewalls tied to a US government-affiliated organization, then tunneled toward its Active Directory.

“Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” — Palo Alto Networks security advisory

Source: Palo Alto Networks advisory · CISA KEV alert (Oct 28) · Ubuntu on Fragnesia · Dream research · The Hacker News

CrowdStrike: China-nexus Warp Panda used low-severity VMware ESXi logging bypass (CVE-2026-41709) as a zero-day; CISA adds it to KEV

CrowdStrike / CISA · October 28, 2026

CrowdStrike’s 2026 Legal Threat Landscape Report, published October 28, disclosed that Warp Panda (also tracked as Clay Typhoon) exploited CVE-2026-41709 as a zero-day in intrusions against US law firms and other organizations as late as early 2026, using it to run ESXi operations without leaving audit-log entries. Broadcom scores the insufficient-logging flaw just 2.7 (Low) and fixed it in July 2026 under VMSA-2026-0006 (ESXi 8.0 U3j, ESXi 9.0.2.0100, ESXi 9.1.0.0, VCF 5.2.4). Despite the low score, CISA added it to the KEV catalog on October 28 with a November 11 federal due date — a reminder that an attacker who already holds admin access values anti-forensics bugs highly.

“the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day” — CrowdStrike, 2026 Legal Threat Landscape Report

Source: Broadcom VMSA-2026-0006 · CrowdStrike report · CISA KEV alert (Oct 28) · SecurityWeek

Cisco Talos details KeyDrift, a key-stealing implant planted on SD-WAN controllers via CVE-2026-20127, tied to Volt Typhoon’s “Silent Train” network

Cisco Talos / Lumen Black Lotus Labs · October 28, 2026

Talos published an analysis of KeyDrift, a malware framework deployed by the APT it tracks as UAT-11473 after exploiting CVE-2026-20127 (CVSS 10.0), the Catalyst SD-WAN Controller/Manager/Validator authentication bypass Cisco patched earlier this year and that CISA covered under Emergency Directive 26-03. KeyDrift runs inside control-plane processes, hooks SSL_read to harvest keying material and session metadata, and stages the data encrypted for exfiltration; victims include satellite and space operators, military-aerospace firms and policy research organizations. Talos assesses with high confidence that the infrastructure overlaps with Volt Typhoon’s Silent Train covert access network, which Lumen’s Black Lotus Labs described the same day as a rotating chain of compromised SOHO, IoT and enterprise devices used in at least four zero-day exploitation campaigns. Cisco warns that upgrading does not remove implants already in place.

“Talos assesses with high confidence that the framework is designed to provide long-term persistent access.” — Cisco Talos

Source: Cisco Talos research · Cisco advisory (CVE-2026-20127) · Lumen Black Lotus Labs · The Hacker News

Binance suspends withdrawals after security incident; on-chain estimates of outflows run into the billions

Binance (via TechCrunch) · October 29, 2026

Binance confirmed a security incident on October 29 and temporarily suspended withdrawals on multiple networks after users reported funds draining from its hot wallets. The exchange has not confirmed a hack or a loss figure. Independent on-chain trackers put the outflows at a minimum of roughly $2 billion, with some estimates as high as $5.7–5.8 billion, which would make it the largest crypto theft on record (the 2025 Bybit hack was $1.4 billion). Tether reported freezing about $1.56 billion and Circle about $800 million of funds connected to the movement. The attacker is unidentified and the incident may still be developing.

Binance “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” — Binance spokesperson Ross O’Leary, to TechCrunch

Source: TechCrunch · BleepingComputer

Still developing

Linux kernel MPTCP use-after-free (CVE-2026-98432, CVSS 9.8) — remote root exploit demonstrated, distro patches uneven

Anthropic / kernel.org · October 27, 2026

Anthropic disclosed CVE-2026-98432, a race-condition use-after-free in the Linux kernel’s multipath TCP handling that an unauthenticated remote attacker can use to leak kernel addresses and ultimately run commands as root on hosts with an MPTCP listener. The kernel CNA scores it 9.8; Red Hat, SUSE and Oracle rate it 8.1 and Amazon 7.0. The bug dates to Linux 4.4 and is fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Oracle Linux, Debian and parts of SUSE and Amazon Linux have shipped fixes; several Ubuntu releases were still in progress and Red Hat had deferred as of October 29. No in-the-wild exploitation has been reported, exploit code has not been published, and the CVE is not in KEV.

“The underlying vulnerability is a race condition-induced UAF bug in the kernel networking stack.” — Anthropic

Source: Anthropic disclosure · CVE record · Ubuntu · Red Hat · The Hacker News

Sony’s So-net ISP discloses breach of ~2.58 million member records, including email passwords and some bank details

Sony Network Communications · October 27, 2026

Sony Network Communications reported that an outside party accessed the So-net membership database starting October 19; the intrusion was detected October 23 and the server was shut down. Exposed data covers 2,141,986 So-net and 443,495 plala (S Course) members — names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs — plus 54,401 email-service passwords and 16 bank account records. Sony says membership passwords and credit card data were not involved.

Source: Sony Network Communications notice (PDF) · SecurityWeek

This brief covers the trailing ~48 hours (October 28–30, 2026).

Primary sources:

• Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (CVE-2026-76418)
• CISA: Adds Two KEVs (Oct 29, 2026)
• CISA: Adds Two KEVs (Oct 28, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• GitLab 19.4.2 patch release (CVE-2026-97229)
• Alpine Linux GitLab security incident
• Palo Alto Networks advisory (CVE-2026-109618 / CVE-2026-109619)
• Dream: Chained PHP2Shell exploit roots 25 servers
• Broadcom VMSA-2026-0006 (CVE-2026-41709)
• CrowdStrike 2026 Legal Threat Landscape Report
• Cisco Talos: Inside KeyDrift
• Lumen Black Lotus Labs: Silent Train
• TechCrunch: Binance pauses withdrawals
• Anthropic: CVE-2026-98432 disclosure
• Sony Network Communications breach notice