Tuesday, November 3, 2026

## Top story
North Korean TraderTraitor group drained $6.3B from Binance hot wallets in under 20 minutes via compromised developer laptop and Ethereum delegation. FBI attributes attack to state-sponsored hackers; Binance absorbed losses but warns of laundering risks. Incident underscores need for independent safeguards, hot-cold segregation, and privileged access controls in exchanges. Binance Hack Shows Need for Independent Safeguards After $6.3B Loss

## Exploitation & threats

• Siemens SIMATIC IoT2050 Node-RED flaw CVE-2026-58115 exploited in the wild; attackers deploy Linux bots via malicious flows. Attackers exploit Siemens IoT2050 missing authentication flaw
• Google dismantled XCPE botnet infecting 1.3M Android TV devices; backdoor sold by Videostrong for ad fraud and proxies. Google dismantles XCPE botnet operated by Videostrong
• BeyondTrust Remote Support versions 26.2.3 and earlier probed; CISA added CVE-2026-102764 to KEV. BeyondTrust Remote Support Faces Fresh Probes for Critical Flaw
• Ivanti Connect Secure flaws CVE-2026-111357 and CVE-2026-118527 chained with CVE-2026-104935 for VPN root access; in-the-wild exploitation. CISA orders fixes for exploited Ivanti Connect Secure flaws
• Over 1,000 exposed GitLab instances vulnerable to CVE-2026-97229 integer overflow RCE; CISA KEV addition. Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

## Patch priorities

• CVE-2026-58115: Siemens SIMATIC IoT2050 Advanced; upgrade to 4.3.4.1 or later.
• CVE-2026-102764: BeyondTrust Remote Support; apply BT26-05 patch.
• CVE-2026-111357 and CVE-2026-118527: Ivanti Connect Secure; upgrade to 25.1.1.3 and 22.8R2.6.
• CVE-2026-98432: Ubuntu LTS kernels 22.04/24.04/26.04; upgrade when available (no fixed release yet).
• CVE-2026-97229: GitLab; upgrade to 19.4.2, 19.3.5 or 19.2.8.
• CVE-2026-76418: Cisco ASA/FTD SSL VPN; apply Cisco update when available.

## Breaches & incidents

• North Korean TraderTraitor stole $6.3B from Binance hot wallets on multiple blockchains; FBI lists 628 laundering addresses. Binance froze assets and replenished funds. FBI blames North Korea for $6.3 billion Binance heist
• Belarusian Cyber Partisans and Silent Crow claimed Rosstat data theft and website defacement; agency confirmed targeted attack but disputed details. Belarusian and Ukrainian hackers claim attack on Russia's Rosstat
• Hackers remotely altered temperature settings in 115+ European supermarket refrigeration systems, causing shutdowns and product losses. Hackers disrupt refrigeration systems at European supermarkets
• DarkBlinders used spear-phishing and SHELBYC2 to compromise Israeli individual and Iraqi government cloud. DarkBlinders targets Israeli individual and Iraqi government cloud
• Ransomware groups posted on leak sites including Stahlbau Mann GmbH (payload), Isapre Consalud (qilin), and others. RANSOMWARE LEAK-SITE POSTS & BREACHES (last 24h, claims by the groups): 30

## AI

• WIRED identified 400+ apps and domains advertising mundane tools then loading sexual deepfake interfaces; over 350K downloads. Mundane AI apps hide sexual deepfake tools, WIRED finds
• OpenAI rated P1 and paid bounty for ChatGPT share-link chain enabling JavaScript in signed-in sessions; fixed October 26. ChatGPT share-link chain let attackers run script in signed-in sessions
• 42AI exited stealth with $62.5M seed for transformer-based behavioral world model. 42AI comes out of stealth with $62.5M seed funding for behavioral world model
• NEW MODELS: Google Gemini 4 Carbon, speridlabs/idol, Pika-Labs/Pika-H3-Flex, FusionCow/Sulphur-3, AtomicChat/DeepSeek-V4.1-Flash-1017-Uncensored.

## Watchlist

• CISA deadlines November 2 and 13 for Ivanti Connect Secure fixes.
• No Ubuntu LTS patches released for CVE-2026-98432 despite CVSS 9.8.
• Follow up on Rosstat breach claims and 628 Binance laundering addresses.
• Monitor GitLab instances for CVE-2026-97229 exploitation.