479 results for “mise”

Report on the $6.3 billion Binance hack of October 2026, which the FBI attributed to North Korea's TraderTraitor unit. Co-CEO Richard Teng said attackers used EIP-7702 to gain execution approval over a hot wallet, after a compromised laptop and further breach points, and used self-destructing malware. Binance replaced 90% of the assets, and the FBI expects further laundering through Ethereum. No IOCs or mitigations are given.

en.cryptonomist.charticleAdded 1 Nov 2026, published 31 Oct 2026🛡️ Security

Decrypt's explainer on the roughly $6.4 billion theft from Binance hot wallets across about 10 blockchains. Binance traced it to a compromised DevOps engineer laptop plus further breach points, and on Ethereum the attacker used 50 pre-signed EIP-7702 authorizations to turn a hot wallet into a sweeper. Chainalysis and TRM Labs attribute it to TraderTraitor; Tether and Circle froze about $2.3 billion.

decrypt.coarticlePublished and added 31 Oct 2026🛡️ Security

Ahmad Umar Agha (Th3Pr0), a Syrian Electronic Army member, received a 42-month US sentence in the Eastern District of Virginia, over 12 years after he was first charged in June 2014. He compromised about 47 Western media, company, NGO and government targets, including the 2013 Associated Press Twitter takeover that caused a flash crash. Accomplice Firas Dardar remains at large.

securityweek.comarticlePublished and added 31 Oct 2026🛡️ Security

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

stepsecurity.ioarticlePublished and added 30 Oct 2026🛡️ Security

ERC draft "Independent Simulation Result" (STVA) defines a canonical, content-addressed SimulationResult (success, gasUsed, returnData, stateDiffHash, logsHash, snapshotId, resultHash) that any wallet, hardware device or verifier can recompute from the same VerificationPayload and state snapshot. It targets compromised-frontend and UI/calldata-mismatch attacks, and defines Basic, Standard and Strict compliance levels. Open questions are stateDiff encoding, prestate proofs and binding to capability tokens.

ethresear.chthreadPublished and added 30 Oct 2026🛡️ Security

The Block reports that Binance lost about $6.3 billion in a hack on 29 October 2026. Co-CEO Richard Teng said a compromised DevOps engineer's laptop gave access to a service container used to submit unauthorized withdrawals, and TRM Labs attributed the theft to North Korea's TraderTraitor. The rest covers reactions: President Trump said on 30 October he was looking into it, CFTC Chair Michael Selig and The Digital Chamber urged federal exchange rules, and senators disputed whether the Clarity Act would have allowed freezes.

theblock.coarticlePublished and added 30 Oct 2026🛡️ Security

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Bankless report on the Binance hack of $6.3 billion, which Binance's preliminary investigation traced to a compromised DevOps engineer's laptop with access to withdrawal-authorizing systems. TRM Labs found valid EIP-7702 authorizations on Ethereum, and nine other chains were drained through normally signed transactions. TRM and Chainalysis link it to North Korea's TraderTraitor. Tether and Circle froze about $3 billion, and Binance says SAFU and corporate cash will cover the losses.

bankless.comarticlePublished and added 30 Oct 2026🛡️ Security

Polymarket's international site was hit on 29 October 2026 when a page-speed monitoring script served from DebugBear's CDN was replaced with a drainer. It hijacked logged-in sessions for about an hour and took $2.7M from 726 wallets via Polymarket's relayer. Scott Helme of Report URI says the CSP allowlisted every domain used and that hash pinning would have blocked the swapped file. Polymarket is repaying $3.9M, and this is its second vendor-script compromise since June.

bankless.comarticlePublished and added 30 Oct 2026🛡️ Security

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation: CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable numbers or identifiers). The alert restates BOD 26-04, which requires federal civilian agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise. It also links the KEV nomination form.

cisa.govadvisoryPublished and added 30 Oct 2026🛡️ Security

Discussion thread for a draft Core EIP that lets an Ethereum EOA permanently disable EIP-7702 delegation. A type-4 set-code transaction with an empty authorization list, destination equal to sender and zero value installs the 0xef0200 marker for 33500 gas. Later authorizations, including clearing to the zero address, are skipped. It does not protect against private-key compromise. Open questions cover the prefix, a dedicated transaction type, gas pricing, and EIP-8151 interaction.

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🛡️ Security

Decrypt reports on the October 2026 Binance hot-wallet hack, about $6.3 billion, which Binance CEO Richard Teng says the company will cover with over $6.34 billion of its own funds. Teng says the attacker used an EIP-7702 delegation that skipped Binance's approval controls, a self-destruct mechanism to wipe tooling, and more than one breach point beyond a compromised laptop. TRM Labs and Chainalysis attribute the theft to TraderTraitor, and the attacker is still moving funds on Tron.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

21shares.comarticlePublished and added 30 Oct 2026🛡️ Security

The Block reports that Binance says it has set aside $6.34 billion of its own funds to cover a hack it puts at about $6.3 billion. Co-CEO Richard Teng says the entry point was a compromised DevOps laptop and no private key leak was found. About $3 billion was frozen by Tether, Circle, Ripple and others, withdrawals are suspended, and TRM Labs sees parallels with North Korean attacks. Technical detail is thin.

theblock.coarticlePublished and added 30 Oct 2026🛡️ Security

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

aikido.devarticlePublished and added 30 Oct 2026🛡️ Security

TRM Labs and Chainalysis attribute the October 2026 Binance theft, about $6.4 billion across 10 blockchains, to North Korea's TraderTraitor. On Ethereum the attacker used EIP-7702 delegation with 50 pre-signed authorizations to turn a hot wallet into a sweeper, pointing to compromised signing infrastructure. The attacker funded wallets via Tornado Cash, laundered through automation and Aave borrowing, and about $3 billion was frozen.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

GossiTheDog's Mastodon post reports that the Anthropic Claude Code Visual Studio extension, as installed in Cursor, contains malware that creates a remote access Trojan on desktops. It links to a phorion.io blog post on the reported compromise of the official Claude Code VSX extension. The post gives no technical detail, indicators or dates itself.

cyberplace.socialthreadAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

Binance estimated the October 2026 security incident at about $6.3 billion and said it found "additional points of breach" beyond the compromised DevOps engineer laptop it first named. The attacker reached a service container and submitted unauthorized withdrawals, with no wallet private key leak found. Arkham counted $6.01 billion taken from hot wallets on nine chains; Tether and Circle froze about $1.8 billion in stablecoins. About $3 billion is frozen onchain; withdrawals stay suspended.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Binance linked the theft of about $6.3 billion in crypto to a compromised DevOps engineer's laptop, which let attackers reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the 29 October 2026 attack to North Korea's TraderTraitor. About $2.7 billion was frozen, and the attackers hold about $2.4 billion. Binance has found no evidence of a leaked wallet private key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can announce an oversized screen surface (for example 32768 by 32768 at 32 bpp), forcing a software decode path and an out-of-bounds write that crashes the viewer or runs code. Remedio's research shows a pointer overwrite routed to WinExec. Version 15.83 fixes it, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalation bugs.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

The Binance hack of 29 October 2026 drained about $6.36 billion across ten blockchains in roughly 20 minutes, according to TRM Labs. TRM attributes it with high confidence to North Korea's TraderTraitor, citing a mixer-funded operator wallet, pre-signed transactions and overlap with the Bybit and KelpDAO hacks. Binance's early findings point to a compromised DevOps engineer laptop. Stablecoin issuers froze about $2.7 billion.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

en.cryptonomist.charticlePublished and added 30 Oct 2026🛡️ Security

ERC draft "Independent Simulation Result" (STVA) defines a canonical, content-addressed SimulationResult structure that wallets, hardware devices or third-party verifiers can recompute from the same VerificationPayload and state snapshot. It specifies fields, a keccak256 or EIP-712 result hash, and Basic, Standard and Strict compliance tiers. The goal is to close UI/calldata mismatch attacks where a compromised frontend serves a false simulation. Open questions cover stateDiff encoding and prestate proofs.

ethereum-magicians.orgotherPublished and added 30 Oct 2026🛡️ Security

llm-trails is an open study of what LLMs choose to do next inside a breached AWS account. It puts 14 models in 13 post-compromise situations, records only a single-turn plan with nothing executed, and codes each answer to CloudTrail events. The repo has the llmtrials harness, prompts, codebook, processed dataset (viz_data.json) and an interactive dashboard, so the study can be rerun or extended.

github.comrepoAdded 30 Oct 2026🧠 AI

llm-trails is a research repo that placed 14 LLMs in 13 post-compromise AWS situations, asked only for their next move (single-turn, nothing executed), and coded each answer to CloudTrail events. It includes the llmtrials harness, prompts, codebook, processed dataset (viz_data.json) and an interactive dashboard. Rates are conditioned on the situation shown, and the aim is turning model behavior into detection priorities.

github.comrepoAdded 30 Oct 2026🛡️ Security

Trail of Bits post on X summarising Binance's initial investigation into a security incident. Binance suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. The text says no evidence has been found of wallet private key compromise. The fetched text is truncated and gives no further detail.

x.comthreadPublished and added 30 Oct 2026🛡️ Security

Polymarket's international exchange suffered unauthorized withdrawals on 29 October 2026 after a compromised third-party provider, reportedly the website monitoring service DebugBear. Betting Intelligence and Polysights found one account withdrew at least $2.7 million across 710 wallets. Polymarket paused trading, referred the case to law enforcement, promised reimbursement, and had a June 2026 vendor breach that cost about $3 million. The attack mechanism is not described.

en.cryptonomist.charticlePublished and added 29 Oct 2026🛡️ Security

Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security

Icepick is a dataset published on 28 October 2026 by Distributed Denial of Secrets. It lists 41,191 DHS employees and contractors with names, titles, offices, phones, managers and 55,000+ permission groups. The hacktivist group Department of Peace says it took the data from DHS's Okta SSO; Okta denies compromise. DHS has filed a takedown notice via ZeroFox, and the full archive is unverified.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security

Unit 42 threat brief on PHP2Shell, two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2), both caused by longjmp() error handling that leaves memory uninitialized or freed. Cortex Xpanse counted over 22.6 million exposed instances. The 29 October 2026 update says attackers chained PHP2Shell with a Linux kernel privilege escalation against internet-exposed PAN-OS management interfaces. An earlier 23 October claim of post-compromise activity was retracted on 25 October.

unit42.paloaltonetworks.comadvisoryAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

tl;dr sec #352 is a security newsletter issue covering [un]prompted talks (AI-assisted firmware patching, a "Security Constitution" for finding cloud design flaws), Azure API Connections cross-tenant bugs worth $200,000, and a test of 14 LLMs given AWS keys. It also covers a paper on malicious LLM API routers (9 of 428 injecting code) and Datadog's "counterfeit policy" bypass of the Jev classifier.

tldrsec.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Wiz research on intrusions where AI agents do the hands-on attacker work. It reviews public cases (ARTEX against South Korean banks and the ConnectWise compromise, Hermes at Thailand's Ministry of Finance, JPCERT/CC, CrowdStrike, DIVD) and three Wiz-investigated attacks. It distills fingerprints: machine-paced iteration, embedded natural-language reasoning, self-correcting scripts, checklist enumeration, noisy lateral movement, probe-before-payload habits and self-named scratch files. It also covers attribution, scale and defense implications.

wiz.iowriteupPublished and added 29 Oct 2026🛡️ Security

A hacker using the handle Department of Peace leaked more than 41,000 US Department of Homeland Security employee records, which the hacker says came from an Okta single sign-on system. The data covers names, work emails, phone numbers, job titles, office locations and per-account system access, mostly for CBP, ICE and HSI staff plus about 1,000 CISA employees. Okta says it has no evidence of compromise. Distributed Denial of Secrets calls the dataset 'Icepick'.

securityweek.comarticlePublished and added 29 Oct 2026🛡️ Security

Cryptanalysis of VTBSAE, a verifier-based PAKE protocol for the Industrial Internet of Things, showing it fails to resist client impersonation after server compromise. The authors propose E-VTBSAEv1, which binds the client point E1 to fresh server randomness, and prove AKE security and forward secrecy in the random-oracle model under CDH. Raspberry Pi 4B tests show runtime comparable to VTBSAE with the same communication and storage overhead.

eprint.iacr.orgpaperAdded 31 Oct 2026, published 29 Oct 2026🛡️ Security

The OpenSourceMalware Show #27 (28 October 2026) is a podcast episode with transcript. It covers the Brotli decoder bug (CVE-2026-111497) vendored in C code across Python, Rust and PHP, and how to find copies via decode.c. It also covers the LiteLLM v1.107.0 compromise from an unrevoked admin key and a relaxed release control, and the MALFEX npm campaign hiding payloads in PNG-header files, plus an AGENTS.md lure and DPRK fake fonts in TTF/OTF.

opensourcemalware.comtalkPublished and added 29 Oct 2026🛡️ Security

Icepick is a leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, published by Distributed Denial of Secrets in 2026 and said to come from DHS's Okta login system. WIRED's analysis covers CBP, ICE, HSI, USCIS and CISA staff, plus over 55,000 permission groups that reference undercover programs, Palantir Falcon, PenLink, Signal and Mobile Fortify. Okta says it has no evidence of compromise.

wired.comarticleAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

CISA alert of 28 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities Catalog on evidence of active exploitation: CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux kernel missing variable initialization). It restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise. It also links the KEV nomination form.

cisa.govadvisoryAdded 29 Oct 2026, published 28 Oct 2026🛡️ Security

The article describes reflashing a Huawei E3372h-153 HiLink 4G USB modem so its embedded Linux OS runs an OpenVPN client over the mobile network, creating a covert, network-independent persistence channel after physical USB access. It walks through enabling debug mode, flashing firmware, disabling CD-ROM emulation, configuring DHCP and autorun scripts, and chaining a second L2VPN tunnel to bridge the attacker directly onto the victim's Ethernet segment for tools like Responder. Defense guidance focuses on restricting USB ports and disabling USB network adapters via policy.

hackers-arise.comwriteupPublished and added 28 Oct 2026🛡️ Security

This paper measures job-based doubt in LLM fact-checkers: judging a claim false more often when the poster has a lower-status job. It compares base and post-trained checkpoints of six model families on fact-checked claims with randomised poster profiles. Only the open Tülu-3 recipe (OLMo-2 32B, Tülu-3 70B) creates the effect, under one percentage point but reliable. In OLMo-2 32B the flip comes from one residual-stream direction and appears at supervised fine-tuning, confirmed on 400 new claims. None of seven commercial models doubts lower-status posters more.

arxiv.orgpaperAdded 30 Oct 2026, published 28 Oct 2026🧠 AI

CISA alert of 27 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of a dangerous file type in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value in Google Brotli. It restates BOD 26-04, which makes federal civilian agencies prioritise KEV flaws on exposed assets and check for prior compromise. No technical detail or IOCs are given.

cisa.govadvisoryAdded 29 Oct 2026, published 27 Oct 2026🛡️ Security

Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.

huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

DreamHost suspended its File Manager (files.dreamhost.com) and reset passwords for some email and FTP/SFTP users after an unexplained issue affecting File Manager and webmail. Account owners were told to set new passwords and change reused ones; users questioned whether passwords were compromised or properly hashed. DreamHost deployed a fix on Monday. Root cause and number of affected users were not disclosed.

securityweek.comarticlePublished and added 27 Oct 2026🛡️ Security

Campfire is a self-hosted tool that runs Claude Code, Codex, Goose, Aider and OpenHands in one tab. Risky actions need permission voting (majority approves, any single deny blocks, 30 second timeout), and session replay traces which file or tool call triggered an action. The post cites Forever Security's finding that Codex followed a planted AGENTS.md instruction over 90% of the time and Claude Code about half the time. It also cites the February Cline release compromise via a poisoned GitHub Actions cache.

x.comthreadAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Aikido Images are free patched PHP container images on public ECR (public.ecr.aws/aikido-dev/php) that backport the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 into release lines 5.5 to 8.5, except 8.0. Upstream fixed 8.2 to 8.5 in October 2026 and left 8.1 and older unpatched. The post shows docker pull and Dockerfile FROM changes, then rebuild, restart, session.upload_progress.enabled=0 and compromise checks.

aikido.devarticlePublished and added 26 Oct 2026🛡️ Security

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on 26 October 2026: CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state). It also updated its PHP alert on critical vulnerabilities requiring immediate patching. The alert restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise.

cisa.govadvisoryAdded 29 Oct 2026, published 26 Oct 2026🛡️ Security

Keystone confirmed a breach of Shopify customer records (about 26,000 plus 13,000 incomplete orders), in which the attacker also took the WebAuth key used to verify device authenticity. It will destroy almost 19,000 unshipped wallets and issue a new key. Foundation Passport phishing emails (over 20,000) came from compromised Cloudflare API keys, and old WooCommerce database copies kept personal data past the stated 60-day deletion.

protos.comarticlePublished and added 26 Oct 2026🛡️ Security

Thread on two October 2026 npm compromises: @subql/common 5.8.3 (5 October), published through GitHub Actions OIDC Trusted Publishing after the attacker tampered with the publish workflow, and tensorlake 0.5.144 (8 October), published by the project's own release workflow with valid provenance for about 1 hour 40 minutes. Both ran on install and stole cloud, GitHub, Kubernetes, Vault, SSH and .env credentials; tensorlake also took AI tool and MCP config. Its payload installed a gh-token-monitor service that deletes the home directory if the stolen GitHub token is revoked, so remove it before rotating.

x.comthreadAdded 27 Oct 2026, published 26 Oct 2026🛡️ Security

Clean-label poisoning attack on federated learning for Basic Safety Message anomaly detection in vehicular networks, from Sagduyu, Erpek, Stephenson and Xue (paper submitted 23 October 2026). The attack perturbs benign samples toward malicious feature extremes without changing labels, which lowers class separability, and it grows stronger with more compromised nodes. A feature-consistency relabeling defense keeps attack success low without hurting clean accuracy, and a game-theoretic model shifts equilibria against attacking.

en.cryptonomist.charticlePublished and added 26 Oct 2026🛡️ Security

Keystone, a hardware wallet maker, disclosed on 25 October 2026 that an attacker accessed its Shopify-based store, detected 20 October and confirmed 23 October. Customer names, contact details, shipping addresses and order details were taken. Keystone says no payment data, recovery phrases or keys were exposed. Customers on X say their data was held despite a 180-day deletion pledge. The piece lists 2026 leaks at Trezor, SafePal and Ledger.

theblock.coarticlePublished and added 25 Oct 2026🛡️ Security

Interconnects podcast with Nathan Lambert and Florian Brand on Kimi K3.1 Pro and the AI cyber landscape. Kimi says it down-weighted cyber data in mid-training so its open weights do not extend offensive capability. They discuss the PHP2Shell remote code execution bug, the repeat LiteLLM compromise from an API key left in GitHub for five months, abliterated model APIs, and trusted-access programs from OpenAI and Anthropic. The transcript was truncated at the very end.

interconnects.aitalkPublished and added 25 Oct 2026🛡️ Security

Analysis of the 19 October 2026 swap of binaries on five ovh/ovhcloud-cli GitHub releases (v0.11.0 to v0.15.0), live 94 minutes. StepSecurity rebuilt the attacker's binary, detonated the recovered GlassWorm preinstall.js loader against a controlled Solana dead drop, and found install.sh never exposed arm64 Linux, Homebrew was safe, and `ovhcloud version` showing "undefined" identifies the swapped build. Includes IOCs and recovery steps.

stepsecurity.iowriteupPublished and added 24 Oct 2026🛡️ Security

AINews digest for 22 to 23 October 2026, led by Moonshot's Kimi K3.1 Pro (2.8T parameters, 104B active, weights promised for 4 November 2026). It reports Artificial Analysis scoring the model 64% on its Cyber Index despite Moonshot removing cyber data from training. Other items: OpenAI's frontier-training containment incident, a Brotli remote-code-execution disclosure, and Anthropic's Mythos 5 unauthorized-action analysis.

latent.spacearticleAdded 30 Oct 2026, published 24 Oct 2026🛡️ Security

AINews issue for 22 to 23 October 2026 centred on Moonshot's Kimi K3.1 Pro, a multimodal mixture-of-experts model with 2.8T total and 104B active parameters and 1M context. Weights are promised for 4 November 2026. Artificial Analysis scored it 55 on its Intelligence Index (fourth place), and Arena ranked it #8 in WebDev. Standard pricing is $2/$10 per million tokens. The issue also covers a cyber-data removal approach, serving-cost objections, and paid-promotion allegations. Shorter items follow on agents, evals and inference.

latent.spacearticlePublished and added 24 Oct 2026🧠 AI

Post on the LiteLLM supply-chain compromise. Attackers spent eleven days in the GitHub org, ran a workflow on a throwaway branch to take twenty secrets including a GitHub App private key, then used stolen GitHub CLI OAuth tokens to publish malicious release 1.107.0 from a lookalike Berri-AI repo. A Python startup file harvested sixteen credential categories and LiteLLM proxy Postgres provider keys. Socket flagged the wheels in seven minutes.

x.comthreadAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

AI Quanting's X thread covers Moonshot's Kimi K3.1 Pro release (1M-token context, open weights promised by November 4). Moonshot removed cyber data from mid-training and RL stages; on its in-house xdev-bench-hard exploit benchmark (Linux kernel, Node.js, JavaScriptCore, Exim, VirGL bugs) pass@3 fell from 90.5% to 81.0%. The author argues this is only about a tenth of the capability, so four in five expert exploit tasks remain solvable.

x.comthreadAdded 25 Oct 2026, published 24 Oct 2026🛡️ Security

Kimi K3.1 Pro is a new model from Moonshot AI. According to a post by hajra, Artificial Analysis ranks it 4th in the world, 3 points behind Claude Opus 5.5. The API price is down by a third, and full open weights are promised by 4 November. The post gives no benchmark breakdown, licence or architecture details.

x.comthreadPublished and added 24 Oct 2026🧠 AI