Thursday, November 5, 2026

## Top story North Korean TraderTraitor group stole $6.3 billion from Binance via fake job interviews, tampered downloads and internal AI tools, compromising engineers and hot wallets. Binance froze $2.8 billion; FBI confirmed attribution. The attack shows state-sponsored supply-chain and social engineering tactics targeting critical crypto infrastructure. Defenders must enforce strict recruitment verification, endpoint isolation and AI behavioral controls.

## Exploitation & threats

• CISA added CVE-2026-119977 WordPress RCE (TOCTOU in upgrades) to KEV after active exploitation; attackers hit 18,500+ attempts in 21 hours. CISA flags WordPress RCE flaw as actively exploited in attacks
• GreyNoise reported 996 Zyxel GS1900 switches compromised worldwide via zero-day RCE in dispatcher.cgi before patch; linked to Red Heron campaign. Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability
• APT29 planted malicious scripts on real and cloned sites in US, Ukraine and Europe to steal cookies and data from outdated iOS and Android devices. APT29 Uses Watering Hole Attacks on Trusted Sites
• Actors hijacked enterprise LLM gateways to rack up $100,000+ daily fraudulent cloud charges using stolen IAM credentials. Google Warns of LLMJacking Attacks Generating Over $100,000 Daily
• 3AM ransomware encrypted 37 machines in UK school estate, built domain trusts and used WMI/PowerShell lateral movement after stealing backup credentials. 3AM ransomware uses human-AI hybrid tactics in UK school compromise

## Patch priorities

• CVE-2026-119977: WordPress Core; upgrade to 7.1.4. CISA flags WordPress RCE flaw as actively exploited in attacks
• CVE-2026-7273 / CVE-2026-107441: Zyxel GS1900; upgrade to release 2.90(...).3 or later. Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability
• Multiple RCE flaws: Android 14-17; install security patch level 2026-11-05. Google patches critical Android RCE flaws allowing remote code execution
• CVE-2026-66903 / CVE-2026-68524: Apache OFBiz; upgrade to 24.09.08. Apache OFBiz 24.09.08 patches multiple critical vulnerabilities
• CVE-2026-116606 / CVE-2026-111560: Barracuda Email Security Gateway and other families; upgrade to patched firmware. Barracuda discloses authorization bypass and command injection flaws
• Multiple RCE and file issues: Ruby on Rails Active Storage; upgrade to 8.0.5.2 or 8.1.4.1. Critical Ruby on Rails Flaw Lets Hackers Steal Server Secrets Through Malicious Image Uploads

## Breaches & incidents

• North Korean TraderTraitor stole $6.3 billion from Binance hot wallets after months-long fake job interview campaign; $2.8 billion frozen. North Korea-linked hackers steal $6.3 billion from Binance
• Crédit Mutuel Arkéa confirmed attackers stole estimated $133 million via supplier platform transfers to crypto exchanges. French bank confirms cyber heist, hackers suspected to have stolen $133 million
• Attackers wiped data on over 1,000 servers at Russian provider Beget, disrupting VPS, storage and Kubernetes services. Beget suffers data wipe in cloud infrastructure attack
• Supplier cyberattack disrupted refrigeration monitoring at three French blood storage facilities, raising temperatures. Cyberattack disrupts blood storage refrigeration in France
• Ransomware groups claimed 30 leaks including Magasin du Nord, TFG London and others; no confirmed compromises yet. RANSOMWARE LEAK-SITE POSTS & BREACHES (last 24h, claims by the groups): 30

## AI

• Google Gemini trains on personal chat history from subscriptions; users cannot opt out without losing activity after 72 hours. Google Gemini trains on personal chat history
• OpenAI pipeline generated and patched 948 Linux kernel privilege escalations in 30 hours at $1.2 million cost. OpenAI Pipeline Generates 948 Linux Root Escalation Exploits
• Hugging Face added deep-principle/Hydrogen-1.0, moonshotai/Kimi-K3.1-Pro and Pika-Labs/Pika-H3-Flex variants. NEW / TRENDING MODELS

## Watchlist

• Verify all WordPress instances at 7.1.4 after CISA KEV addition; monitor upgrade staging paths.
• Follow up on 30 ransomware claims at leak sites; distinguish confirmed vs. unconfirmed posts.
• Confirm Android patch level 2026-11-05 on all devices before next major release.
• Review Beget and French blood service incidents for supplier compromise indicators.