Monday, November 2, 2026

## Top story
The FBI attributes a $6.36 billion theft from Binance on or about October 29, 2026, to North Korea’s TraderTraitor group (Lazarus). Attackers compromised a developer’s laptop to send unauthorized withdrawals later converted to Ethereum. The agency urges blockchain firms and DeFi services to block listed addresses and derived funds. FBI blames North Korea for $6 billion Binance crypto theft

## Exploitation & threats

• North Korean TraderTraitor hackers used a compromised engineer's laptop to steal from Binance. FBI Links North Korean Hackers to $6 Billion Binance Theft
• Malicious Cursor extensions installed SSH backdoors on developer systems. Malicious Claude Code extensions install persistent SSH backdoors
• Attackers deploy autonomous ARTEX AI agents to automate intrusions and data theft. Hackers weaponize ARTEX AI agents for network intrusions
• Coordinated campaign targeted 61 GitHub repos with command injection to steal CI/CD secrets. Hackers target 61 GitHub repos with command injection
• Hijacked DebugBear script on Polymarket stole $2.64 million from 726 traders. Hackers steal $2.7 million from Polymarket via hijacked DebugBear script
• VOLTA infostealer harvests credentials and ranks victims using Claude, Gemini and Kimi AI. VOLTA Infostealer Uses Claude, Gemini and Kimi AI to Rank Victims

## Patch priorities

• Upgrade Incus to 7.6.0 or LXD 4.0.15, 5.0.11, 5.21.9, 6.10.1 to fix certificate validation flaw. Critical Vulnerabilities in Incus and LXD Allow Full Cluster Access
• Upgrade Prefab UI to 0.21.0 to fix arbitrary code execution. CVE-2026-120338
• Upgrade AVideo to 8.1.0 to fix unauthenticated PHP injection and command injection. CVE-2026-61564
• Upgrade Rust zip library to 9.0.5 to fix ZIP filename mismatch. CVE-2026-115905
• Upgrade WS_FTP Server to 2024.0.6 or 2025.0.3 to fix improper authentication. CVE-2026-84295
• Upgrade CoPilot to 0.1.77 to fix path traversal. CVE-2026-61738

## Breaches & incidents

• North Korean hackers stole over $6 billion from Binance, converting to Ethereum. FBI blames North Korea for $6 billion Binance crypto theft
• Hijacked DebugBear script on Polymarket stole $2.64 million from 726 traders; exchange refunded $3.9 million.
• Attacker accessed environment variables for subset of Trigger.dev customers. Company blocked exploit and emailed mitigations. Trigger.dev says attacker accessed some customers' environment variables
• Ransomware groups posted 22 leaks on sites including n0n, qilin, lockbit5, interlock, hyflock, shiba and direwolf. Victims include Michigan State University, Global Holding and synergy.co.id.

## AI

• Alleged 8TB Anthropic Mythos-class model checkpoint leaked on Hugging Face. Anthropic Mythos-class model leaked on Hugging Face
• Empathetic prompts cause chatbots like Gemini and Claude to output trauma-like narratives. Empathetic prompts make AI chatbots simulate trauma
• Nace AI open-sources Drex Max v1 27B decision model for Apple Silicon inference. Nace AI Open-Sources Drex Max v1 27B Decision Model
• DeepSeek open-sources dsh-superagent router-worker coding agent for GitHub tasks. DeepSeek Open-Sources dsh-superagent Router-Worker Coding Agent
• Byoky open-source wallet encrypts and controls AI API keys on device. Byoky open-source wallet stores AI API keys securely

## Watchlist

• Alpine Linux rebuilt GitLab after attempted RCE on CVE-2026-97229; no confirmed compromise. Reset all passwords. Alpine Linux rebuilds GitLab after attempted RCE attack
• Apache Wicket 8.20.0, 9.25.0 and 10.12.0 fix 19 CVEs; upgrade to 10 LTS or 11. Apache Wicket 8.20.0, 9.25.0 and 10.12.0 fix 19 CVEs
• Upgrade Google::Auth for Perl to prevent server-side request forgery via unvalidated URLs. Google::Auth for Perl (2 CVEs)
• Upgrade TightVNC Viewer to 2.8.89 or 2.8.90; disable unnecessary Listening Mode. TightVNC Viewer pre-auth RCE via memory corruption