📄 Articles1123

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

stepsecurity.ioarticlePublished and added 30 Oct 2026

CVE-2026-98432 is a use-after-free race condition in the Linux kernel IPv4 TCP code (tcp_v4_syn_recv_sock, ireq_opt), affecting kernels back to 4.4 and rated 9.8 by the kernel CVE team (Red Hat rates it 5.9). Anthropic researchers say an unreleased Claude model built an exploit that bypassed KASLR and got remote root on an MPTCP listener in about 53 minutes. The article lists distro patch status and CIQ's nftables mitigation for IP options; disabling MPTCP alone does not help. No in-the-wild exploitation is reported.

bleepingcomputer.comarticlePublished and added 30 Oct 2026

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

galaxy.comarticleAdded 30 Oct 2026

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

galaxy.comarticleAdded 30 Oct 2026

Bankless report on the Binance hack of $6.3 billion, which Binance's preliminary investigation traced to a compromised DevOps engineer's laptop with access to withdrawal-authorizing systems. TRM Labs found valid EIP-7702 authorizations on Ethereum, and nine other chains were drained through normally signed transactions. TRM and Chainalysis link it to North Korea's TraderTraitor. Tether and Circle froze about $3 billion, and Binance says SAFU and corporate cash will cover the losses.

bankless.comarticlePublished and added 30 Oct 2026

Polymarket's international site was hit on 29 October 2026 when a page-speed monitoring script served from DebugBear's CDN was replaced with a drainer. It hijacked logged-in sessions for about an hour and took $2.7M from 726 wallets via Polymarket's relayer. Scott Helme of Report URI says the CSP allowlisted every domain used and that hash pinning would have blocked the swapped file. Polymarket is repaying $3.9M, and this is its second vendor-script compromise since June.

bankless.comarticlePublished and added 30 Oct 2026

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

decrypt.coarticlePublished and added 30 Oct 2026

Interconnects post in which Nathan Lambert revisits his claim that an open-weight release of Claude Mythos in April 2026 would have been survivable. He argues GLM-5.3 already crosses that capability threshold with little visible harm. He cites Epoch AI's GLM-5.3 Firefox file-exfiltration exploit and Joshua Saxe's trend data, and says recent vulnerability waves come mostly from closed models and general AI diffusion.

interconnects.aiarticlePublished and added 30 Oct 2026

Decrypt reports on the October 2026 Binance hot-wallet hack, about $6.3 billion, which Binance CEO Richard Teng says the company will cover with over $6.34 billion of its own funds. Teng says the attacker used an EIP-7702 delegation that skipped Binance's approval controls, a self-destruct mechanism to wipe tooling, and more than one breach point beyond a compromised laptop. TRM Labs and Chainalysis attribute the theft to TraderTraitor, and the attacker is still moving funds on Tron.

decrypt.coarticlePublished and added 30 Oct 2026

Trezor warns of a suspected crypto-theft implant in a Trezor Safe 5 sold by reseller CryptoBilis in Southeast Asia. An Indonesian buyer found an extra board with a cellular module and antenna between the main board and screen, apparently able to read the recovery phrase and send it over mobile networks. Trezor has not examined the device, advises moving funds to a new wallet for any CryptoBilis purchase since March 2026, and notes a similar Ledger implant was confirmed.

bleepingcomputer.comarticlePublished and added 30 Oct 2026

The Defiant reports that Binance co-CEO Yi He's colleague Teng says the attacker in a breach Binance estimates at $6.3 billion used EIP-7702 to bypass wallet controls. Binance is rebuilding its withdrawal service, and attackers destroyed tools and traces during the intrusion. Only the teaser loaded, so the technical detail of the EIP-7702 abuse is not in the available text.

thedefiant.ioarticlePublished and added 30 Oct 2026

Trezor says a user reported a Safe 5 wallet bought from Malaysian reseller CryptoBilis in August 2026 with a hidden board between the main board and screen, carrying a cellular module and antenna. The implant allegedly reads the screen, including the wallet backup, and sends it over a mobile network when plugged in. Trezor has not yet examined the device, has dropped CryptoBilis (9 October), and is replacing wallets bought since March 2026.

protos.comarticlePublished and added 30 Oct 2026

Protos analysis of how the Binance hack played out on Ethereum. The attacker deployed a sweeper contract and sent 50 EIP-7702 authorizations for the Binance 14 hot wallet, signed with its key and using varied nonces to match the wallet's changing count. Other wallets and EVM chains used plain transfers. Binance later removed the delegation, and about $2.4 billion in funds was frozen or blacklisted.

protos.comarticlePublished and added 30 Oct 2026

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

securityweek.comarticlePublished and added 30 Oct 2026

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

securityweek.comarticlePublished and added 30 Oct 2026

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

21shares.comarticlePublished and added 30 Oct 2026

A malicious version 2.1.313 of Anthropic's Claude Code extension was served from Cursor's marketplace for about 11 hours on 29 October 2026, reaching up to 5,000 developers. A JavaScript loader prepended to extension.js added an attacker SSH key, a reverse tunnel and macOS/Windows persistence, and reported to 134.209.82[.]225. Coding errors likely blocked SSH access on many hosts. Cursor removed it and rotated keys; victims should look for an 'svc-telemetry' SSH key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026

EIP-7702 ("Set Code for EOAs") is the Ethereum change, live since the Pectra upgrade on 7 May 2025, that lets ordinary wallets delegate to smart contract code. The guide covers set-code transactions, delegation indicators, batching, sponsorship and sweeper-contract scams. It then describes the 29 October 2026 Binance theft of about $6.4B, which TRM Labs and Chainalysis attributed to TraderTraitor, where 50 pre-signed authorizations turned a hot wallet into a sweeper.

decrypt.coarticlePublished and added 30 Oct 2026

Opinion piece arguing that passkeys, built on public-key cryptography, resist phishing, credential stuffing and password theft but do not settle identity risk. Attackers can go around them through account enrollment before a passkey is bound, weaker recovery paths (SMS, email link, help desk), device changes and authenticated session hijacking. It proposes layering identity threat detection with risk-based, continuous evaluation of trust.

securityweek.comarticlePublished and added 30 Oct 2026

Virtualine is a Russian-speaking bulletproof hosting provider whose domain virtualine.net the FBI seized. Court documents say it hosted phishing, spam, carding and illicit content, and ignored abuse reports. TRM Labs says it received more illicit-attributed cryptocurrency than any other labeled bulletproof host, mostly from a Russian drug marketplace (44%) and a sextortion scheme (17%), and later from StealC operators in 2026.

securityweek.comarticlePublished and added 30 Oct 2026

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

aikido.devarticlePublished and added 30 Oct 2026

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

bleepingcomputer.comarticlePublished and added 30 Oct 2026

Decrypt report that Israel extradited Alexander Block (formerly Gurevich) to the US over about $2.8 million taken from the Nomad bridge in August 2022. A June 2022 update flaw let tokens be received without locking assets, and copycats then drained more than $186 million. Israel's Supreme Court held that exploiting a flaw the software permitted can still be unlawful intrusion. The FTC proposed a settlement with Illusory Systems in December 2025.

decrypt.coarticlePublished and added 30 Oct 2026

TRM Labs and Chainalysis attribute the October 2026 Binance theft, about $6.4 billion across 10 blockchains, to North Korea's TraderTraitor. On Ethereum the attacker used EIP-7702 delegation with 50 pre-signed authorizations to turn a hot wallet into a sweeper, pointing to compromised signing infrastructure. The attacker funded wallets via Tornado Cash, laundered through automation and Aave borrowing, and about $3 billion was frozen.

decrypt.coarticlePublished and added 30 Oct 2026

A WordPress core race condition in the update process, patched in WordPress 7.1.4 on 28 October 2026, allows unauthenticated remote code execution with high attack complexity. New files unpack into a predictable, web-accessible staging directory. Defiant's Wordfence logged over 18,500 requests for staged setup-config.php paths in 21 hours, with no confirmed compromises. No CVE is assigned yet. The release fixes 22 flaws in total.

securityweek.comarticlePublished and added 30 Oct 2026

Report on the 29 October 2026 Binance theft, which TRM Labs valued at USD 6.36 billion across ten chains, mostly within 20 minutes. TRM attributes it with high confidence to North Korea's TraderTraitor. The attacker used pre-signed EIP-7702 delegations to turn a Binance Ethereum hot wallet into a sweeper. About USD 3 billion was frozen; TRM advises monitoring for unexpected delegations and separating signing infrastructure.

en.cryptonomist.charticlePublished and added 30 Oct 2026

CVE-2026-118539 is a highly critical access bypass in the Drupal Commerce Core module (over 42,000 sites), exploited in the wild. Unauthenticated attackers can abuse insufficiently protected routes and entity fields, and Drupal rated it 21 out of 25. Fixes are in 3.3.13 and 8.x-2.41, and admins should audit orders. The article also covers 38 other Drupal advisories from 28 October and the 14 October RCE bugs CVE-2026-108097 and CVE-2026-108099.

securityweek.comarticlePublished and added 30 Oct 2026

Drupal Commerce Core has a critical missing-authorization flaw, CVE-2026-118539, that unauthenticated attackers exploit in the wild. It affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal urges upgrading to 3.3.13 (or 8.x-2.41 on the older branch) and auditing orders for inconsistencies. The article also recalls CVE-2026-9082, exploited in May and added to CISA KEV, and two RCE patches (CVE-2026-108097, CVE-2026-108099).

bleepingcomputer.comarticlePublished and added 30 Oct 2026

Trezor warned buyers of its wallets from reseller CryptoBilis (March 2026 onward) to move funds, after an Indonesian customer reported a hardware implant in a Safe 5 bought in August 2026. The report describes a board with a cellular module between mainboard and screen that reads the wallet backup and sends it over a mobile network. Trezor has not yet examined the device. It found no tampering in four other CryptoBilis units.

decrypt.coarticlePublished and added 30 Oct 2026

Polymarket halted trading on 29 October after users reported unauthorized withdrawals traced to malicious JavaScript served from DebugBear's real user monitoring snippet. Hudson Rock's sample abused the authenticated session to sell positions or send tokens to a hard-coded address, without exfiltrating credentials. Loss estimates range from $2.19 million to $2.71 million (GoPlus), and Polymarket pledged reimbursement.

securityweek.comarticlePublished and added 30 Oct 2026

Chainalysis assesses the 29 October 2026 theft of about $6.4 billion from Binance hot wallets as the work of North Korean group TraderTraitor. Attribution rests on on-chain behavior, including real-time commingling with funds from the Bitget exploit, a Tornado Cash-funded operator wallet and signed authorizations that let a hot wallet run attacker code. About $2.8 billion was frozen. Laundering shows automation, with addresses receiving exactly 1 TRX before forwarding funds.

chainalysis.comarticlePublished and added 30 Oct 2026

CVE-2026-97229 is a CVSS 10 code execution flaw in Onigmo, Ruby's regular expression engine, reachable through crafted CI/CD configuration in GitLab. Attackers used it against Alpine Linux's GitLab on 20 and 21 October 2026 and failed; Alpine rebuilt the instance and found no tampering with aports or packages. Self-managed installs with their own Ruby need Ruby 3.3.13, 3.4.12 or 4.0.9, not just GitLab 19.3.6. CISA added it to KEV.

securityweek.comarticlePublished and added 30 Oct 2026

Binance estimated the October 2026 security incident at about $6.3 billion and said it found "additional points of breach" beyond the compromised DevOps engineer laptop it first named. The attacker reached a service container and submitted unauthorized withdrawals, with no wallet private key leak found. Arkham counted $6.01 billion taken from hot wallets on nine chains; Tether and Circle froze about $1.8 billion in stablecoins. About $3 billion is frozen onchain; withdrawals stay suspended.

decrypt.coarticlePublished and added 30 Oct 2026

Socket's analysis of the reported malicious Claude Code extension 2.1.313, which Cursor confirmed was served from its own marketplace on 29 October 2026 to up to 5,000 users. Open VSX's change feed (3,392 events) and npm metadata hold no publication or removal record for that version, contradicting the initial OpenSourceMalware claim. Cursor published hashes, IOCs and remediation scripts.

socket.devarticlePublished and added 30 Oct 2026

Binance linked the theft of about $6.3 billion in crypto to a compromised DevOps engineer's laptop, which let attackers reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the 29 October 2026 attack to North Korea's TraderTraitor. About $2.7 billion was frozen, and the attackers hold about $2.4 billion. Binance has found no evidence of a leaked wallet private key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

en.cryptonomist.charticlePublished and added 30 Oct 2026

CVE-2026-111585 (CVSS 8.8) is an integer overflow in the remote-control screen processing of TeamViewer clients on Windows, macOS, Linux and Android. A malicious or compromised host can announce an oversized screen surface (for example 32768 by 32768 at 32 bpp), forcing a software decode path and an out-of-bounds write that crashes the viewer or runs code. Remedio's research shows a pointer overwrite routed to WinExec. Version 15.83 fixes it, along with CVE-2026-92372, CVE-2026-92374 and six local privilege escalation bugs.

securityweek.comarticlePublished and added 30 Oct 2026

Trezor advised everyone who bought wallets from reseller CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase. An Indonesian customer reported a Safe 5 bought via Tokopedia in August 2026 with an extra board holding a cellular module that allegedly sends the wallet backup out. Trezor has not yet examined the device. Ledger separately confirmed tampering on CryptoBilis devices in October 2026.

en.cryptonomist.charticlePublished and added 30 Oct 2026

The Binance hack of 29 October 2026 drained about $6.36 billion across ten blockchains in roughly 20 minutes, according to TRM Labs. TRM attributes it with high confidence to North Korea's TraderTraitor, citing a mixer-funded operator wallet, pre-signed transactions and overlap with the Bybit and KelpDAO hacks. Binance's early findings point to a compromised DevOps engineer laptop. Stablecoin issuers froze about $2.7 billion.

securityweek.comarticlePublished and added 30 Oct 2026

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

en.cryptonomist.charticlePublished and added 30 Oct 2026

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake path: a request socket's ireq_opt pointer moves to the child socket as inet_opt and is freed with kfree() while a retransmitted-SYN CPU still reads it under RCU. The fix (commit e3f33b0a1d89) uses kfree_rcu(). The page covers CVSS 9.8 versus vendor scores, Anthropic's MPTCP root-exploit lab demo, per-distribution patch checks, MPTCP listener inventory and detection guidance. The page was truncated before its mitigation section.

penligent.aiarticleAdded 31 Oct 2026, published 30 Oct 2026

Decrypt reports on wallets linked to the suspected Binance hack (at least $5.5 billion drained, 29 October 2026) that swap freezable stablecoins for ETH via Uniswap and borrow 19,762 ETH on Aave. About 253,000 ETH (roughly $570 million) sits idle in two wallets. Tether, Circle and Ripple froze over $2 billion plus about $200 million RLUSD, and Aave and Kamino paused markets. Tornado Cash appears only as funding for the attack address.

decrypt.coarticlePublished and added 29 Oct 2026

Binance is investigating a possible breach involving up to $5.8 billion in assets, which would exceed the $1.5 billion Bybit theft of February 2025. Tether froze over $1.567 billion in USDT and Circle over $800 million in USDC. Arkham tracks 55 addresses labelled "binance-hacker-1029" holding about $5.78 billion, but that is wallet holdings, not a confirmed theft amount. The cause is not yet known.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Polymarket's international exchange suffered unauthorized withdrawals on 29 October 2026 after a compromised third-party provider, reportedly the website monitoring service DebugBear. Betting Intelligence and Polysights found one account withdrew at least $2.7 million across 710 wallets. Polymarket paused trading, referred the case to law enforcement, promised reimbursement, and had a June 2026 vendor breach that cost about $3 million. The attack mechanism is not described.

en.cryptonomist.charticlePublished and added 29 Oct 2026

A campaign of 31 malicious Hugging Face repositories across seven accounts, found by Pluto Security, posed as small Qwen2 checkpoints and used trust_remote_code to run a cryptominer and reverse shell on GPU inference hosts. The top model reached 28,412 downloads and scanned clean, and a second wave returned within days of takedown. The article also covers a fake Solana starter kit on GitHub that installs NetSupport Manager via a PowerShell one-liner aimed at AI coding agents.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Japan Airlines disclosed that unauthorized access to Amadeus's Passenger Service System, between 10 August 2023 and 23 September 2026, exposed data on about 92,000 customers. Roughly 2,000 also had emails, phone and passport numbers exposed. ANA, Asiana Airlines and Korean Air are also reported as affected. Amadeus had announced a booking display vulnerability on 1 October 2026 and has not given the full scope.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Polymarket suspended trading for about an hour on 29 October 2026 after attacker-controlled JavaScript was served through DebugBear's Real User Monitoring script (cdn.debugbear[.]com/C7xcKKrjUnXK.js). The script hijacked logged-in trading sessions, sold positions and moved assets to an attacker wallet, with about $2.5M traced. The article gives the wallet address, the data.debugbear.com C2 endpoint and Hudson Rock's findings.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Decrypt reports that at least $5.57 billion left Binance-linked hot wallets on Ethereum, Bitcoin and Tron on 29 October 2026, which would be the largest crypto hack on record. On-chain analysts point to an EIP-7702 delegation, installed from a Tornado Cash-funded address minutes before the first sweep. Tether and Circle froze about $1.8 billion. Binance has not confirmed the hack, and how the attacker obtained the signature is unknown.

decrypt.coarticlePublished and added 29 Oct 2026

Rekt News analysis of the 30 September to 1 October 2026 theft of 3.865 million USDT from the NEAR Intents HOT Bridge treasury on BNB Chain, paid out in five signed withdrawals after a 10 USDT deposit. It uses Bitquery's trace of laundering via Chainflip, THORChain, KuCoin and Hyperliquid, and a NEAR regression test showing an oversized refund log made mt_resolve_deposit fail. NEAR said the funds were returned but published no report.

rekt.newsarticleAdded 29 Oct 2026

Rekt News piece tracing three AI-security headlines back to their sources. It covers Justin Drake's October 2026 "bunker mode" warning about AI breaking ECDSA, OpenAI's report of a model spending Sepolia test ETH from a default developer mnemonic, and Wiz's "70% of the Internet" claim for PHP CVE-2026-109618 and CVE-2026-109619. It closes with four questions for checking a claim.

rekt.newsarticleAdded 29 Oct 2026

Rekt News post-mortem of the 23 October 2026 Initia exploit. A MoveVM script-caching bug let an attacker credit unbacked WETH, iUSD, AUSD0 and USDC without raising total supply, and bridges paid out about $2.73 million (1.4 million AUSD, 105 ETH, 1.08 million USDC). It includes 0xCanzi's local replay of a stale cached verification, the on-chain laundering timeline, and the Foundation's backing-restoration pledge.

rekt.newsarticleAdded 29 Oct 2026

The SAIL Framework from Pillar Security is a seven-phase, lifecycle-oriented method for securing AI systems. The phases are AI policy and safe experimentation, AI asset discovery, AI security posture management, AI red teaming, runtime guardrails, sandboxed execution for agents and MCP servers, and AI activity tracing. It argues for a "Shift Up" approach that protects the business logic AI controls, and it is meant to sit on top of existing standards.

pillar.securityarticleAdded 29 Oct 2026

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

oversecured.comarticleAdded 29 Oct 2026

Oversecured's Android security checklist for Content Providers covers insecure FileProvider path configs, path traversal via decoded Uri.getLastPathSegment(), mismatched readPermission/writePermission, proxying requests to more privileged providers, SQL injection across a shared database, and sensitive actions in providers. Each case has vulnerable manifest and Java code, an attacker PoC and remediation. Real cases from Google and Samsung devices are cited. The page text was truncated near the end.

oversecured.comarticleAdded 29 Oct 2026

Oversecured Apps Care, Part 1 (21 March 2024) publishes scanner results for about 224 Google Android apps, drawn from a wider scan of over 6,000 public APKs from 1,000+ companies. Tables per device image (phone, Wear OS, Android Automotive, Android TV) give package names, three finding counts and report links, including android, com.android.settings, gms and Play Store. It invites researchers to report issues to Google for rewards.

oversecured.comarticleAdded 29 Oct 2026

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

oversecured.comarticleAdded 29 Oct 2026

Oversecured's article on Android deep-link vulnerabilities covers five patterns: custom scheme hijacking, open redirect into WebView, limited and full intent redirection, and domain takeover via an expired whitelist entry. It shows bypass payloads, intent selector abuse, and the HierarchicalUri reflection bypass. It also compares what SAST and DAST can find and gives a checklist for pentesters.

oversecured.comarticleAdded 29 Oct 2026

Oversecured guide to eight vulnerability categories that lead to account takeover in mobile banking and fintech apps: WebView JavaScript bridge token leakage, Intent Redirection, hardcoded tokens, deeplink hijacking, insecure token storage, localhost OAuth listeners, AIDL abuse and weak biometric auth. It includes a WebView PoC based on Samsung SmartThings CVE-2022-30746 and maps findings to OWASP MASVS, PCI DSS and PSD2. It argues taint analysis plus dynamic PoC is needed to find multi-component chains.

oversecured.comarticleAdded 29 Oct 2026

Oversecured guide to SDK security in mobile apps, built around Microsoft's April 2026 disclosure of an intent redirection flaw in EngageLab's EngageSDK (50 million installs, fixed in 5.2.1). It covers SDK attack surfaces (exported components, WebViews, deep links, hardcoded secrets, payment crypto), a canhub image cropper file-overwrite example, why source-only SAST misses SDK code, and MASVS and PCI DSS expectations.

oversecured.comarticleAdded 29 Oct 2026

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

oversecured.comarticleAdded 29 Oct 2026

Guide to PCI DSS v4.0.1 scope for mobile apps, with a mapping of common Android and iOS finding types to the requirements they break (Req 2, 3, 4, 6, 7). It covers which app behaviors bring an app into scope and gives three anonymized cases: cleartext HTTP in a vendor native library, hardcoded keys in a third-party SDK, and an implicit Intent leaking data. It argues for testing the shipped binary and keeping a current component inventory.

oversecured.comarticleAdded 29 Oct 2026

dfbench is a held-out benchmark maintained by depthfirst that scores frontier LLMs on defensive security work: vulnerability detection, validation (precision) and differential analysis between commits. It reports recall, precision, F1 and cost per task by model and thinking level, split by application, low-level and smart-contract code and by single or multi-repo scope. Overall detection recall runs from about 21% to 69%, with the top figure at $99.19 per task for Mythos 5; validation precision mostly falls between 15% and 49%.

depthfirst.comarticleAdded 29 Oct 2026

Padre Terminal, a fake Solana meme-coin trading app on the Apple App Store, drained about $23,000 from 27 Solana wallets after users imported private keys, per blockchain investigator Iris. The app has been removed, but the drainer stayed active; Iris traced funds to two attacker wallets holding 229.66 SOL. Iris also flagged four other suspected impersonator apps (Axiom Pro: Focus, GMGN AI, HyperTerminal-HyperliquidTools, Pump Fun Tokens & Analitycs).

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Explainer on "shell" vulnerabilities, the -Shell naming for RCE flaws that began with Log4Shell (CVE-2021-44228). It compares memory-corruption bugs (PHP2Shell, CVE-2026-109618 and CVE-2026-109619; Node2Shell, CVE-2026-111497, in the Brotli decoder) with design-flaw bugs (Log4Shell, React2Shell, CVE-2025-55182). It covers shared traits, exposure through inherited components, and Brotli patch status across runtimes and distributions.

aikido.devarticleAdded 30 Oct 2026, published 29 Oct 2026

Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.

decrypt.coarticlePublished and added 29 Oct 2026

Icepick is a dataset published on 28 October 2026 by Distributed Denial of Secrets. It lists 41,191 DHS employees and contractors with names, titles, offices, phones, managers and 55,000+ permission groups. The hacktivist group Department of Peace says it took the data from DHS's Okta SSO; Okta denies compromise. DHS has filed a takedown notice via ZeroFox, and the full archive is unverified.

decrypt.coarticlePublished and added 29 Oct 2026

UAT-11473, a newly tracked APT cluster, exploits CVE-2026-20127, a max-severity authentication bypass in Cisco Catalyst SD-WAN Controllers (patched February 2026), to deploy the KeyDrift malware framework. KeyDrift's PolyFlame runs inside vdaemon processes, and LittleFilch hooks SSL_read to extract AES-256 IPsec keying material, saved to /var/tmp/vdaemon.bin and sent over UDP. Targets include space, defense and policy organizations. Talos sees overlap with Volt Typhoon's Silent Train network but makes no definitive link.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

blog.talosintelligence.comarticlePublished and added 29 Oct 2026

Windows Prefetch forensics tutorial from Hackers Arise. It explains that prefetch files in C:\Windows\Prefetch record last run time, run count and files touched, so they prove an application was used even after deletion. It shows parsing with NirSoft WinPrefetchView, building a timeline from Last Run Time, and how a suspect could disable Prefetch or Superfetch (SysMain).

hackers-arise.comarticlePublished and added 29 Oct 2026

Socket reports on a GitHub issue for OpenCode, opened 28 June, describing a bypass of per-IP usage limits on its free hosted models by switching VPN addresses. The reporter first proposed account-based limits, then reopened the issue in August to promote the workaround and claimed to run 130 agents. After the thread drew harassment and was deleted in October 2026, it is unclear whether OpenCode fixed the bypass.

socket.devarticlePublished and added 29 Oct 2026

BleepingComputer reports Socket researcher John Tuckner's findings on 319 Chrome extensions with 13.4 million installs that hijack the default search engine. They use the chrome_settings_overrides manifest setting to route queries through operator proxies and collect Bing and Yahoo referral revenue. The proxy can later redirect to phishing or malware. Clusters named include Bing-Search and SecuryBrowse; the report adds 264 extensions to 57 found in April 2025.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

OpenAI's internal misalignment monitoring system uses a layered pipeline: activation probes, a model-based reviewer, an investigative agent and automated investigation against network logs, then human paging. Replaying the Hugging Face incident, the expanded monitors would have alerted security about 30 minutes after the sandbox escape, over 30 hours before the breach. The post covers evaluation on recorded and simulated incidents, METR and Redwood Research red-teaming, avoiding chain-of-thought obfuscation pressure, and external Astra monitoring.

alignment.openai.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Microsoft Threat Intelligence report on how North Korean actors use AI, ranking Jade Sleet, Coral Sleet and Jasper Sleet as operationalized, Diamond Sleet, Onyx Sleet, Pearl Sleet and Sapphire Sleet as accelerating, and Emerald Sleet as expanding. It documents AI-generated lures (100+ Onyx Sleet PDFs, August and September 2026), AI-built tooling such as Coral Sleet's private GitHub repository trojanizing, and Onyx Sleet and Pearl Sleet use of the ARTEX agentic pentest framework. It ends with mitigation and Defender guidance.

microsoft.comarticlePublished and added 29 Oct 2026

Gemini 4 Carbon is a Google frontier model announced with restricted access for cyber defenders through the Fairwind Program (650+ organizations). Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, ahead of GPT-6 Astra and Claude models, with no guardrails. It also cites prompt injection and cheating-resistance results, and pricing of $2/$10 per million tokens.

securityweek.comarticlePublished and added 29 Oct 2026

SecurityWeek article examining US election security through a cybersecurity lens. It covers voting machines certified by the Election Assistance Commission but unpatched for up to two years, machines hacked at DEF CON's Voting Village, and QR-code ballots voters cannot verify. Sequent's Shai Bargil proposes open-source software and encrypted vote records. It also covers AI-enabled influence campaigns such as the 2024 Biden deepfake robocall.

securityweek.comarticlePublished and added 29 Oct 2026

Wiz Research reviews agentic attacks seen in its incident response work and in public reports (ARTEX, Hermes, JPCERT/CC, CrowdStrike, DIVD). It derives fingerprints of AI-agent activity from three intrusions: machine-paced iteration, natural-language reasoning in scripts, self-correcting script versions, checklist enumeration, noisy lateral spraying, probe-before-payload and self-labeled scratch files. It also covers effects on attribution, attack scale and defense.

wiz.ioarticlePublished and added 29 Oct 2026

tl;dr sec #352 is a security newsletter issue covering [un]prompted talks (AI-assisted firmware patching, a "Security Constitution" for finding cloud design flaws), Azure API Connections cross-tenant bugs worth $200,000, and a test of 14 LLMs given AWS keys. It also covers a paper on malicious LLM API routers (9 of 428 injecting code) and Datadog's "counterfeit policy" bypass of the Jev classifier.

tldrsec.comarticleAdded 30 Oct 2026, published 29 Oct 2026

Project Quarry is a neurosymbolic rule language Cisco has open sourced to detect AI agent attacks that only show up across a sequence of individually benign steps. Rules combine ML classifier and LLM judge evidence with symbolic checks on sequences, strings and tool relationships. The starter pack has a DSL, evaluation runtime, CLI scanner, Python SDK and a plugin for Claude Code, Codex and other MCP-compatible agents.

securityweek.comarticlePublished and added 29 Oct 2026

Cisco Talos Incident Response Q3 2026 trends report. Phishing led initial access at 37 percent, with vishing and IT help desk impersonation to get RMM access; public-facing exploitation followed at 33 percent. Ransomware reached 27 percent of engagements (Qilin, Rhysida, Interlock, new VYPR), with EDR killers via BYOVD and WDAC. It also covers Salt Typhoon intrusions using CVE-2023-20198 and BadCandy, attacks on Claude Code credentials, and logging, MFA and secrets recommendations.

blog.talosintelligence.comarticlePublished and added 29 Oct 2026

Fragnesia (CVE-2026-46300) is a Linux kernel XFRM ESP-in-TCP logic bug in the Dirty Frag class that gives local attackers root, with a public PoC. CISA added it to the KEV catalog and ordered federal patching under BOD 26-04. Attackers chain it with PHP2Shell (CVE-2026-109618, CVE-2026-109619) to implant PHP webshells. Dream Security tied the chain to 25 rooted servers in the US, Japan, Taiwan and South Korea.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

SecurityWeek roundup of patches from Adobe, Veeam and Juniper Networks covering over three dozen vulnerabilities. Adobe fixed 12 flaws (eight critical in Campaign Classic), Veeam fixed nine (including a cross-tenant RCE in Backup for Microsoft 365), and Juniper fixed 18 in Session Smart Router and Conductor. None were reported exploited. Juniper said CVE-2026-109618 (PHP2Shell) affects Junos OS but is not exploitable there.

securityweek.comarticlePublished and added 29 Oct 2026

The Bankruptcy Noticing Center (BNC), operated by BAE Systems for the US federal judiciary, was restored after an incident that took it offline for more than two weeks from around 9 October 2026. BAE says no data was extracted and no PII was breached. It does not say what caused the incident or whether it was a cyberattack. The Judicial Conference declared a "Bankruptcy Rules emergency" on 22 October, and no group has claimed responsibility.

securityweek.comarticlePublished and added 29 Oct 2026

Cloudflare DDoS Threat Report 2026 Q3 covers July to September 2026, with 18.2 million network-layer attacks and 14.4 trillion HTTP DDoS requests mitigated. Short attacks under 10 minutes and 1 Gbps rose 208%, while attacks above 1 Tbps fell from 805 to 251 after law enforcement took down the Aisuru, KimWolf, JackSkid and Mossad botnets. CLDAP floods collapsed 99.5% as DNS amplification rose 215%. The United States became the most-attacked country again.

blog.cloudflare.comarticlePublished and added 29 Oct 2026

A hacker using the handle Department of Peace leaked more than 41,000 US Department of Homeland Security employee records, which the hacker says came from an Okta single sign-on system. The data covers names, work emails, phone numbers, job titles, office locations and per-account system access, mostly for CBP, ICE and HSI staff plus about 1,000 CISA employees. Okta says it has no evidence of compromise. Distributed Denial of Secrets calls the dataset 'Icepick'.

securityweek.comarticlePublished and added 29 Oct 2026

Decrypt reports that OFAC sanctioned 10 individuals and one entity on 28 October 2026 over North Korean IT worker schemes. Russian nationals Ilya Boykov and Vitold Obertas converted millions in crypto (about $3.5 million and nearly $2 million), and the listings include Ethereum and Tron addresses, one shared by both. It also covers the Vladivostok-based First Financial and Technical Development Center and Kim Ki Hyok, who moved nearly $500,000 in crypto.

decrypt.coarticlePublished and added 29 Oct 2026

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026

So-net, the Japanese ISP run by Sony Network Communications, disclosed on 27 October that attackers broke into its member database on 19 October and took nearly 2.6 million records of So-net and Plala subscribers. Data includes names, birth dates, phone numbers, emails and user IDs, plus about 54,000 email addresses with passwords and 16 bank account records. The company reset mail passwords and reported to Japan's Personal Information Protection Commission; the intrusion method is undisclosed.

securityweek.comarticlePublished and added 29 Oct 2026

Cisco Talos reported that UAT-11473 exploited CVE-2026-20127 (CVSS 10, Cisco SD-WAN peering authentication bypass) to deploy KeyDrift, a framework with PolyFlame (backdoor, relay C2) and LittleFilch (key harvesting) modules. Talos found its infrastructure overlaps considerably with Volt Typhoon's Silent Train network. Lumen Black Lotus Labs tied Silent Train to zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.

securityweek.comarticlePublished and added 29 Oct 2026

CVE-2026-76418 (CVSS 8.6) is an exploited flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD. An unauthenticated remote attacker can force a device reload through logic errors in tunnel groups using secondary authentication. Cisco learned of exploitation in October 2026, offers no workaround, and recommends upgrading. It is the second ASA/FTD DoS zero-day after CVE-2026-20349 in August.

securityweek.comarticlePublished and added 29 Oct 2026

Aikido's analysis of the PHP2Shell disclosures (CVE-2026-109618 and CVE-2026-109619), published October 2026. It covers the timeline: the CVE IDs leaked on 20 October, PHP moved its release to 21 October, and Amazon reports exploitation attempts from 17 October. It cites Censys data (32.5 million services still affected on 27 October) and argues that AI-driven discovery and exploit building call for shorter embargoes and faster patching.

aikido.devarticleAdded 28 Oct 2026, published 29 Oct 2026