Daily Cybersecurity News – November 1, 2026

What happened

CISA added CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure to its KEV catalog on October 30, 2026, confirming active exploitation.

These join CVE-2026-104935 (CVSS 8.6), an authentication bypass, in a three-flaw chain first documented by Volexity. The chain delivers unauthenticated root-level code execution. CVE-2026-111357 (CVSS 7.0) is a missing-authentication issue in the dsinvoked broker that escalates to root via mishandled DSCache data. CVE-2026-118527 allows a remote authenticated attacker to upload attacker-controlled files to a known disk location through predictable identifiers.

Threat actor UTA0576 used the chain for credential extraction, Active Directory recon, and searches for admin passwords and BitLocker keys rather than typical web shells.

Who is affected

Organizations running Ivanti Connect Secure 25.1.1.2 and prior (fixed in 25.1.1.3) or 22.8R2.5 and prior (fixed in 22.8R2.6).

These are widely deployed SSL VPN gateways. Earlier patches for only CVE-2026-104935 leave systems exposed to the full chain.

Why it matters

Unauthenticated root on perimeter VPN appliances enables full device takeover, credential theft, and lateral movement into internal networks.

Active KEV status and real-world use by UTA0576 make this an immediate priority for any operator of remote-access infrastructure.

How it could have been prevented

Upgrade immediately to Ivanti Connect Secure 25.1.1.3 or 22.8R2.6. Federal Civilian Executive Branch agencies must remediate CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

Apply vendor IOCs, perform forensic triage on exposed devices, and monitor for unusual authentication or configuration activity.

What happened

Security firm Parameter demonstrated that a malicious ChatGPT public share link could run attacker JavaScript inside the signed-in browser session of anyone who opened it, allowing full account actions including reading private conversations.

The researchers reported the issue via OpenAI's bug bounty on October 18, 2026. OpenAI fixed it by October 26 and rated it P1. The chain used ChatGPT's HTML Preview feature together with an unchecked MathLive postMessage listener that accepted raw HTML from any frame, then loaded a script from an allowed YouTube origin under the site's CSP.

No real-world exploitation was observed. Tests ran only between researcher-controlled accounts.

Who is affected

Any signed-in ChatGPT web user who opened a crafted share link before the October 26, 2026 fix. No additional installation, workspace join, or attacker-controlled login was required.

Why it matters

A single shared link could yield complete control of a victim's ChatGPT account and private data. The issue shows how complex frontend features and third-party libraries can create high-impact sandbox escapes even when individual components appear isolated.

How it could have been prevented

The vulnerability is fixed server-side across ChatGPT web frontends. Avoid opening untrusted shared conversation links, especially those prompting Preview. Review account activity and connected apps if you opened shares in mid-October 2026. Developers using MathLive should enforce strict origin checks on postMessage handlers.

What happened

The FBI, with the U.S. Secret Service and IRS Criminal Investigation, officially attributed the theft of more than $6.43 billion in virtual assets from Binance on or about October 29, 2026, to the North Korea-aligned group TraderTraitor (also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899).

Stolen assets moved primarily into Ethereum and are expected to be further laundered via DeFi and instant-swap services. Roughly $2.85 billion was frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism. The haul is the largest cryptocurrency theft on record and nearly doubles prior North Korean crypto totals.

TraderTraitor has a history of Web3-targeted heists using malware-laced applications and social engineering, including prior incidents against Bybit and others.

Who is affected

Binance and its users, plus the wider cryptocurrency ecosystem. Blockchain analysis firms and exchanges handling the stolen flows are also directly impacted by laundering activity.

Why it matters

The scale funds North Korean state operations and sanctions evasion. It demonstrates persistent, high-capability targeting of major exchanges and the speed at which stolen assets can be moved and mixed on-chain.

How it could have been prevented

Crypto platforms, node operators, DeFi services, and analytics firms should block the wallet addresses published by the FBI. Enforce multi-signature controls, hardware wallet requirements for large transfers, continuous transaction monitoring, and strict privileged-access controls. Review and harden any DevOps or admin endpoints that could enable similar large-scale drains.

What happened

On October 29, 2026, malicious JavaScript replaced the DebugBear real-user monitoring script loaded by Polymarket. The code abused already-signed-in trader sessions to sell positions and transfer funds, moving roughly $2.64 million in POL and related assets from about 33 wallets to an attacker address in under an hour.

DebugBear's DNS was compromised via its domain registrar; the malicious file targeted only Polymarket's customer-specific script. The payload read browser storage for trading keys and located the page's order-placement and signer components, then submitted signed requests through Polymarket's relayer. No seed phrases or private keys were exfiltrated.

Polymarket is refunding about $2.7 million to 726 affected wallets.

Who is affected

Signed-in Polymarket traders during the roughly one-hour window on October 29. Any site loading third-party RUM or analytics scripts faces similar supply-chain exposure.

Why it matters

A compromised external script turned legitimate user sessions into an automated drain without needing passwords or seed phrases. It underscores the danger of third-party JavaScript and insufficient content security controls on high-value financial frontends.

How it could have been prevented

Remove or strictly pin third-party scripts with subresource integrity hashes. Deploy a tight Content Security Policy that limits script sources. Monitor for unexpected changes to loaded resources and DNS. Users should enable wallet transaction prompts, review recent activity, and prefer hardware signers. Rotate any exposed API material and watch for similar vendor incidents.

What happened

Kaspersky disclosed a highly sophisticated infection chain targeting a custom Windows 10 build used only by government entities in Asia. The chain deploys a previously undocumented .NET assembly-loading framework called NetamLoader.

The malware appeared in the first half of 2026 inside a CAB archive placed in the Windows update download directory and mixed with legitimate signed Patch My PC components. A malicious .config file enables AppDomainManager injection to load arbitrary .NET assemblies, followed by multi-layer encoded payloads from fabric.config and Resources.resx. Delivery is suspected to involve a supply-chain compromise. No known threat actor has been attributed, and only one victim was observed in telemetry. It remains unclear whether sensitive data was stolen.

Who is affected

Government organizations in Asia running the specialized Windows 10 build. The technique could apply more broadly to any environment using similar .NET and update-package trust assumptions.

Why it matters

The loader hides inside trusted Windows update paths and legitimate signed binaries, achieving stealthy code execution suitable for long-term espionage. AppDomainManager injection lets malicious code run inside a legitimate process, complicating detection.

How it could have been prevented

Monitor the SoftwareDistribution\Download paths for unexpected CAB or config files. Restrict or closely audit third-party patch-management tools. Deploy EDR rules for AppDomainManager abuse and unusual .NET assembly loads. Enforce least privilege on update mechanisms and maintain offline integrity checks of system packages. Apply available Kaspersky or equivalent detections for NetamLoader indicators.

What happened

Cloud application platform Northflank disclosed a security incident on October 30, 2026, after a threat alert from Wiz. Attackers gained access that allowed decryption of customer environment variables, resulting in unauthorized use of stored AI API keys.

Northflank told all customers to assume every environment variable had been decrypted and to rotate secrets immediately. Multiple users reported abusive calls on their AI provider keys. The company applied rapid network-policy patches and engaged Wiz incident response. Root cause, exact scope, and whether other credential types were abused have not been disclosed.

Who is affected

All Northflank customers who stored secrets or environment variables on the platform, particularly those supplying AI API keys from providers such as OpenAI or Anthropic. The number of affected accounts remains unknown.

Why it matters

Stolen AI API keys can generate large unexpected bills, exfiltrate data through model queries, or enable further automated attacks. The incident fits a broader October wave of compromises against AI developer platforms, showing how centralized secret storage becomes a high-value target.

How it could have been prevented

Immediately rotate every secret, environment variable, and API key stored in Northflank, revoking the old credentials at each issuing provider. Review AI provider usage and billing logs for anomalies and report suspicious activity. Prefer short-lived tokens and external secret managers over long-lived environment variables. Enable the platform's newly available audit logs and one-click rotation features for databases and other add-ons.

What happened

SANS Internet Storm Center handler Didier Stevens updated his onedump.py tool with a --jsonoutput option. The feature emits JSON containing every embedded file found inside one or more OneNote .one documents in a single pass.

The JSON can be piped to myjson-filter.py with the -W hashvir option to write each embedded file to disk under a SHA-256-based name plus a .vir extension. This avoids repeatedly running the tool for large sets of OneNote files.

Who is affected

Digital forensics analysts, malware researchers, and incident responders who regularly examine OneNote documents, a common vehicle for embedding malicious payloads.

Why it matters

OneNote files frequently appear in phishing and malware campaigns. Bulk, scriptable extraction speeds analysis of large sample sets and integrates cleanly with existing JSON-based toolchains.