Check Point weekly bulletin covers crypto thefts and exploited flaws
Original title: 2nd November – Threat Intelligence Report
The November 2 roundup also cites a claimed $6.3 billion Binance theft and exposure of about 4.9 million student-aid records.
Check Point’s November 2 threat bulletin recaps the week’s incidents and research. It says Binance lost about $6.3 billion after a DevOps laptop compromise, Polymarket lost about $2.7 million via malicious JavaScript, Japan Airlines data on about 92,000 passengers was exposed through Amadeus, and Florida’s education department may have exposed 4.9 million people. It also flags exploited flaws in Brotli/Node.js, Drupal Commerce Core and Cisco VPN software, plus AI-assisted intrusions and malware campaigns.
Unconfirmed: The Binance North Korea link, Polymarket attacker wallet, and several group attributions are claims reported in the bulletin, not independently confirmed here.
- CVE-2026-98432 is a CVSS 9.8 Linux kernel Multipath TCP flaw described as unauthenticated root code execution.
- Cisco confirmed CVE-2026-76418 was exploited before ASA and Firepower Threat Defense updates.
- GOLD OGRE reportedly used AI agents during Aur0ra ransomware operations.
- VAPOR PANDA is said to have used ARTEX against more than 200 organizations in 14 countries.
- Yoba spreads fake ChatGPT and Claude installers through fraudulent GitHub projects.
Impact: Crypto and personal-data theft, plus remote code execution
| Product | Affected |
|---|---|
| Node.js | — |
| Linux kernel | — |
| Drupal Commerce Core | — |
| Cisco Adaptive Security Appliance | — |
| Cisco Firepower Threat Defense | — |
- 1.Apply available patches for the Cisco, Drupal, Linux kernel and Brotli flaws named in the bulletin
- Threat actors
- GOLD OGREVAPOR PANDAUAT-11473
- Organizations
- Check Point ResearchAmadeus
- Countries
- JapanUnited StatesChina
- AI models
- Qwen
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — | ||
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
3 min read at research.checkpoint.com
For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6. 3 billion in digital assets.
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.