Saturday, October 31, 2026

Top story

Binance reports about $6.3 billion stolen. Binance said a compromised DevOps laptop reached a service container and submitted unauthorized withdrawals, with no evidence of a wallet private-key leak, and that it will cover user losses. Close to $3 billion is already frozen on-chain. TRM Labs and Chainalysis attribute the October 29 theft to North Korea’s TraderTraitor; Binance has not named a culprit.

Exploitation & threats

• CISA confirmed exploitation of CVE-2026-97229, an unauthenticated GitLab CI/CD integer overflow; fixed builds are 19.2.8, 19.3.5, and 19.4.2.
• Volexity says UTA0576 chained CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 on Ivanti Connect Secure for unauthenticated root; upgrade to 25.1.1.3 or 22.8R2.6.
• Unit 42 says attackers chained CVE-2026-109618 and CVE-2026-109619 with kernel bug CVE-2026-46300 against exposed PAN-OS management; install the vendor hotfixes.
• Backdoored Claude Code 2.1.313 auto-updated in VS Code and Cursor and tried to open a persistent SSH tunnel; move to 2.1.314.
• CrowdStrike says China-linked Vapor Panda used the ARTEX framework with LLMs against more than 200 organizations from October 17, confirming post-exploitation at nine.
• Zimperium says Coruna and DarkSword can steal iPhone data from one page visit; install the newest iOS, including 18.7.7.

Patch priorities

• CVE-2026-76418, Cisco Secure Firewall ASA and Threat Defense SSL VPN: KEV unauthenticated denial of service; see vendor advisory, no fixed build listed.
• CVE-2026-111497, Brotli: update OS packages to 1.0.10, 1.1.1, or 1.2.1 so a WordPress pingback cannot crash PHP workers.
• CVE-2026-112816, Canonical LXD: upgrade to 4.0.15, 5.0.11, 5.21.9, or 6.10.1.
• CVE-2026-84295, Progress WS_FTP Server on Windows: upgrade to 2024.0.6 or 2025.0.3.
• CVE-2026-61564 and CVE-2026-61567, AVideo: upgrade to 8.1.0.
• CVE-2026-115905, Rust zip library: upgrade to 9.0.5.

Breaches & incidents

• Alpine Linux says a threat actor used the GitLab flaw against its instance on October 20 and 21, and that it rebuilt the instance.
• Leak sites carried 30 posts attributed to the gangs, naming ArentFox Schiff, Hensel Elektrik, TRAUCO AG, and others; treat the listings as claims.

AI

• Google unveils Gemini 4 Carbon for flaw finding, exploitation tests, and patches; selected defenders get first access, with no general-availability date.
• GLM 5.3 built Firefox exploit chains from public patch gaps, Epoch AI says, at about $1,000 each; Mozilla fixed the rediscovered bug in Firefox 159.0.
• Newly listed models include baidu/Unlimited-OCR-2, ccore/Qwen3.5-4B-3D-Coder, and LiquidAI/d1-2B.

Watchlist

• Cloudflare tracks forged certificates from eMudhra’s weak CA keys; reject the weak intermediates and require Certificate Transparency.
• CVE-2026-65145, NVIDIA NeMo Agent Toolkit: no workaround is stated; apply NVIDIA’s update when available.
• Federal civilian agencies must remediate the GitLab and Cisco KEV entries by November 1, 2026.
• One GitLab note says CVE-2026-110264 is not fixed by the earlier update and should be tracked separately.