Binance loses US$ 6.3 billion; GitLab CVSS 10 flaw exploited

Binance loses US$ 6.36 billion in the largest cryptocurrency theft in history

Hackers stole US$ 6.36 billion from Binance on October 29, in the largest cryptocurrency theft ever recorded. According to TRM Labs, the North Korean group TraderTraitor is the author; about US$ 3 billion has already been frozen.

US$ 3.3 billion remains without a trace. Binance says user funds are safe, that the loss belongs to the exchange and that it will cover the losses. Bitcoin fell about 2%, with more than US$ 1.5 billion in forced liquidations.

Takeaway: For high-value assets, the final loss depends on the speed of detection and freezing.

Sources: @vxunderground, @WatcherGuru, @mert, @pashov

Claude Code extension with backdoor reaches up to 5 thousand Cursor users

A tampered version of the Claude Code extension was distributed through the Cursor IDE marketplace and installed hidden remote access on machines. Cursor says at most 5 thousand users downloaded version 2.1.313, not developed by Anthropic.

Whoever installed it may have active remote access on the development workstation, exposing code, credentials and repositories. Cursor took down the marketplace, neutralized the malware with the providers and asks for an update to version 2.1.314.

Takeaway: A package installed by a developer is an intrusion vector; an extension inventory must exist before the incident.

Sources: @cursor_ai, @mattjay, @TheHackersNews

PHP2Shell: live intrusions point to ransomware, says researcher

A researcher observes intrusions in real time against real organizations using the PHP PHP2Shell flaws, with assessment of intent to deploy ransomware. CISA (the US government's cybersecurity agency) and Palo Alto Networks had already confirmed active exploitation.

The risk already reaches the entire operation: companies report about six exploitations, with 25 servers under total control in four countries and movement into the Active Directory, the central login of corporate networks.

Takeaway: An applied patch only counts after restarting the service and confirming the running version.

Sources: JPCERT/CC, @hakluke

Brotli gains a WordPress vector with public exploit in xmlrpc.php

The Brotli flaw gained a new vector in WordPress: a researcher published an exploit that attacks sites via /xmlrpc.php. CISA had already confirmed active exploitation of the flaw, with a federal fix deadline on November 10.

The flaw is embedded in products used everywhere: Node.js, Bun, Python.NET packages, Visual Studio, PowerShell and Palo Alto firewalls. Whoever processes compressed data from external sources is at risk of code execution. Running processes keep the vulnerable code until restart.

Sources: Microsoft, The Hacker News, @BleepinComputer

CISA confirms active exploitation of CVSS 10 flaw in GitLab

CISA confirmed active exploitation of CVE-2026-97229 in GitLab and requires federal agencies to fix it by November 1. The flaw, of maximum severity (CVSS 10.0), allows executing code on the GitLab server without any login, via a malicious expression in CI/CD configuration.

An attack was attempted against the GitLab of the Alpine Linux project, with no proof of success. The case exposes a blind spot: Alpine had already updated GitLab, but Ruby remained without a fix and the flaw was still exploitable; the server was rebuilt.

Takeaway: Updating the application without updating the dependency underneath leaves the flaw exploitable.

Sources: CISA KEV, The Hacker News, @TheHackersNews, @DailyDarkWeb

XBOW reports critical flaw in web application of the US election commission

Security company XBOW claims to have found a critical remote code execution flaw in a public web application of the U.S. Election Assistance Commission, the American federal commission for election administration. According to XBOW, it was a resource and logistics calculator.

The flaw does not require login, according to XBOW, but the commission did not confirm the case. There is no CVE, fix or signs of exploitation in the sources. The application has no relation to electronic voting machines or voter registration.

Sources: @Xbow 1, @Xbow 2

Linux kernel: AI-created remote root exploit; Ubuntu and Red Hat without patch

A 9.8 flaw in the Linux kernel allows executing commands with full power on servers, without a password and without user action. Anthropic demonstrated a working exploit created by an unreleased Claude model, not published and with no known attacks.

Ubuntu and Red Hat remained without a fix on October 29; Debian, Oracle, Amazon Linux and SUSE have already fixed part of the versions. The attack requires Multipath TCP active, a feature that combines several network connections; Go programs 1.24 or newer use it by default.

Sources: The Hacker News, @DarkWebInformer, @IntCyberDigest

Drupal confirms active exploitation of critical flaw in Commerce Core

Drupal confirmed that intruders are actively exploiting a flaw considered highly critical in the Commerce Core module, used by stores with shopping carts. The flaw allows bypassing access controls and can cause financial losses for merchants.

The real scale is still uncertain: Drupal did not disclose details or the scale of the attacks. Stores that use Commerce Core in versions 0.0.0 to 2.41 or 3.0.0 to 3.3.13 should follow the official advisories and fix as soon as possible.

Sources: @TheHackersNews, The Hacker News

Built-in browsers of AI assistants have flaws; Codex and VS Code without a fix

Researcher Gal Weizman found flaws in the built-in browsers of Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop, disclosed under the name EMBRACE. A hostile page opened in these browsers can execute code on the computer, read local files or spoof the displayed address.

Codex and VS Code were without a fix at publication, with users exposed, according to the blog. Source code, credentials and local documents, inside and outside the project folder, are within reach of a malicious page, with the user's privileges.

Takeaway: A new tool on the developer's desktop is an attack surface that almost no one tests.

Sources: @WeizmanGal, r/netsec

VMware ESX: exploited logging flaw has a fix and deadline on November 11

The fix for the logging flaw in VMware ESX is in VMSA-2026-0006, with a federal deadline on November 11. CISA added CVE-2026-41709 to the KEV (CISA's list of flaws already used in attacks).

The flaw acts after the intrusion: according to CrowdStrike, the China-linked group Warp Panda used it as a zero-day. Whoever already has an administrator account executes operations without logging, removing the audit trail and delaying detection.

Sources: CISA KEV, The Hacker News, SecurityWeek, @DailyDarkWeb