Daily Cybersecurity News – October 30, 2026

What happened

Hackers drained approximately $6.3 billion in cryptocurrencies from Binance hot wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, in a roughly 20-minute window starting around 4pm ET on October 29.

Crypto tracing firms TRM Labs, Chainalysis and Elliptic linked the operation to the North Korean group known as TraderTraitor based on tactics, wallet patterns and prior high-profile crypto heists. Preparation included small test withdrawals 36 hours earlier, code deployment and rehearsals on test wallets before the main drain from production hot wallets. Binance suspended deposits and withdrawals; about half the funds have been frozen so far.

Who is affected

Binance and its customers whose assets sat in the drained hot wallets. The theft spanned multiple major blockchains and represents what analysts call the largest crypto heist on record.

North Korean-linked actors have repeatedly targeted crypto firms; this single incident could nearly double the regime’s known crypto theft total to date.

Why it matters

Hot wallets remain a high-value, always-online target. Rapid multi-chain drainage at this scale shows sophisticated preparation and operational speed that can outpace many exchange monitoring and freeze capabilities.

Billions may be unrecoverable once moved, directly funding a sanctioned state actor and eroding trust in centralized exchange custody. Operators of any large crypto platform must treat hot-wallet compromise as an existential risk.

How it could have been prevented

Keep the large majority of assets in cold or multi-sig storage with strict withdrawal limits and time delays on hot wallets. Implement real-time multi-chain anomaly detection, pre-position freeze relationships with major chains and stablecoin issuers, and require multi-party approval plus out-of-band verification for large movements. Rotate and monitor hot-wallet keys aggressively and segment blockchain access.

What happened

A tampered version 2.1.313 of Anthropic’s Claude Code extension appeared on the Open VSX marketplace and installed a persistent SSH backdoor on developer machines. Researchers at Phorion found an injected IIFE at the start of the minified extension.js that runs immediately on load, before the normal activate hook.

The payload adds an attacker SSH key to authorized_keys, opens an outbound SSH tunnel that retries every 60 seconds and survives editor close, and establishes reboot persistence via LaunchAgent-style files on macOS, cron on Linux, or scheduled task/Startup folder on Windows. It also exfiltrates hostname, username, OS, home and working directories, Git email, public IP, and names of up to 40 environment variables that look like secrets or cloud credentials.

Who is affected

Users of VS Code-compatible editors that pull from Open VSX, notably Cursor and Windsurf. Cursor reported the malicious version was available in its marketplace for about 11 hours and estimated up to 5,000 users may have been affected. Microsoft’s official Visual Studio Marketplace had no reported malicious copy.

Impact is highest on machines where SSH/Remote Login is already enabled; a faulty privilege check often prevented enabling it on macOS.

Why it matters

Developer workstations hold source code, cloud credentials, SSH keys and CI tokens. A silent supply-chain backdoor in a popular AI coding extension gives long-term interactive access and a ready inventory of which hosts to target next.

Open VSX is the default store for many non-Microsoft VS Code forks, so the blast radius extends beyond classic VS Code users into the growing AI-assisted IDE ecosystem.

What happened

Attackers exploited the critical authentication-bypass flaw CVE-2026-20127 (CVSS 10.0) in Cisco Catalyst SD-WAN Controllers, Managers and Validators to install custom malware called KeyDrift. The flaw, fixed in February, lets an unauthenticated remote attacker gain high-privileged access.

KeyDrift’s LittleFilch component hooks the vdaemon process after decryption to steal AES-256 key material that Controllers distribute to edge routers, encrypts the loot with RSA, and can exfiltrate it. A loader (PolyFlame) is injected via modified runit scripts. Cisco Talos tracks the KeyDrift operators as UAT-11473; earlier exploitation of the same CVE was tracked as UAT-8616. The CVE is in CISA KEV and confirmed actively exploited.

Who is affected

Organizations running unpatched Cisco Catalyst SD-WAN Controllers (formerly vSmart), Managers (vManage) and Validators (vBond). Targets observed by Talos include space and satellite services, defense and aerospace, and policy research.

Infrastructure overlaps with the Silent Train botnet previously linked to Volt Typhoon activity. Lumen reported continued exploitation of the CVE into late 2025 and after disclosure.

Why it matters

SD-WAN Controllers sit at the center of encrypted site-to-site traffic. Stealing the AES keys lets an attacker decrypt or manipulate traffic between branches without further exploitation of the edges.

A CVSS 10 unauthenticated bypass on the control plane of critical network fabric, combined with purpose-built key-theft malware and possible nation-state ties, creates both immediate compromise and long-term espionage risk.

How it could have been prevented

Patch all Catalyst SD-WAN Controllers, Managers and Validators to fixed releases immediately. Restrict management and control-plane access to trusted networks only, monitor for unexpected runit script changes or injected processes in vdaemon, and rotate any keys that may have been exposed. Review CISA KEV guidance and apply compensating network controls if patching is delayed.

What happened

Palo Alto Networks warned of active exploitation of the PHP2Shell vulnerabilities CVE-2026-109618 (CVSS 9.8) and CVE-2026-109619 (CVSS 8.1) against internet-exposed PAN-OS management interfaces. The flaws enable unauthenticated remote code execution via PHP request-memory handling bugs and were patched upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Researchers at Dream observed a suspected China-nexus actor chaining them with the Linux kernel local privilege-escalation Fragnesia (CVE-2026-46300, CVSS 7.8) to gain root on at least 25 servers in the U.S., Japan, Taiwan and South Korea, including three in a U.S. government-affiliated environment, then moving to Active Directory credential theft and enumeration. All three CVEs are in CISA KEV and confirmed actively exploited.

Who is affected

Any organization with PAN-OS management web UI or XML API reachable from the internet. Affected version ranges include multiple 11.1, 11.2, 12.1 and 12.2 releases prior to the listed hotfixes. No special configuration is required beyond exposure of the management interface.

Dataplane interfaces are affected only if a management profile is attached.

Why it matters

Internet-exposed firewall management planes are high-value targets. Chaining unauthenticated RCE to kernel LPE yields full root control, after which attackers can implant webshells, harvest credentials and pivot into internal Active Directory environments.

Confirmed exploitation against government-linked systems and rapid KEV addition underscore the urgency for any operator still exposing PAN-OS management to the public internet.

How it could have been prevented

Immediately apply the fixed PAN-OS releases (12.2.4-h1 and later, corresponding 12.1/11.2/11.1 hotfixes). Restrict management interface access to trusted internal or jump-host networks only; never expose it to the internet. Monitor for unusual PHP or webshell activity and review CISA KEV deadlines. Rotate credentials if compromise is suspected.

What happened

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-97229 (CVSS 10.0) is an integer-overflow / wraparound flaw in GitLab CE/EE that lets an unauthenticated attacker achieve remote code execution via a crafted regular expression in CI/CD configuration. It affects versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

CVE-2026-76418 (CVSS 8.6) is an unchecked return value leading to NULL pointer dereference in Cisco Secure Firewall ASA and FTD Software that allows an unauthenticated remote attacker to trigger a device reload and denial-of-service condition. Cisco confirmed active exploitation of the Cisco flaw earlier this month. Alpine Linux publicly described a near-miss attempt against its GitLab instance using the RCE.

Who is affected

Organizations running unpatched GitLab CE/EE in the 19.2-19.4 ranges, especially instances that accept CI/CD configuration from less-trusted sources. Also any environment using vulnerable Cisco Secure Firewall ASA or FTD Software with Remote Access SSL VPN enabled.

Federal Civilian Executive Branch agencies have a remediation deadline of November 1, 2026.

Why it matters

Unauthenticated RCE on a GitLab server gives full control over source code, CI secrets, runners and supply-chain pipelines. A trivial DoS against perimeter firewalls can disrupt remote access and network availability at scale.

KEV listing signals confirmed real-world exploitation and creates a hard compliance deadline for federal agencies while serving as a clear prioritization signal for everyone else.

How it could have been prevented

Upgrade GitLab to 19.2.8, 19.3.5, 19.4.2 or later immediately. Apply the Cisco ASA/FTD fixed releases that address CVE-2026-76418. Restrict CI/CD configuration sources, monitor GitLab worker crashes, and place firewall management and VPN services behind additional access controls where possible. Track CISA KEV for mandatory federal timelines.

What happened

Drupal warned that threat actors are actively exploiting a highly critical missing-authorization vulnerability in Commerce Core, tracked as CVE-2026-118539. The flaw affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13 and fails to protect certain routes and entity fields.

Successful abuse can produce an access bypass with direct financial impact on the merchant, such as unauthorized viewing or manipulation of orders, payments or customer data. Drupal stated the issue is being exploited in the wild but released no further campaign details. The CVE is not presently listed in CISA KEV.

Who is affected

Sites running Drupal Commerce Core in the stated version ranges that expose the vulnerable routes or entity fields. Commerce Core powers shopping-cart and checkout functionality, so any merchant site using the module is potentially exposed until patched.

Exact scale of exploitation has not been published.

Why it matters

E-commerce platforms handle payment flows, order data and customer PII. An authorization bypass can let attackers view or alter transactions, create fraudulent orders, or extract financial records without authentication.

Even without a public CVSS number, Drupal’s “highly critical” and “actively exploited” designation means operators should treat it as an emergency patch.

How it could have been prevented

Upgrade immediately to Commerce Core 3.3.13 (for 3.x) or 8.x-2.41 (for earlier lines). Audit logs for unexpected access to commerce routes and entity fields, review recent orders for anomalies, and restrict administrative and API access where possible until the patch is confirmed.

What happened

Polymarket halted trading on its international platform after users reported unauthorized withdrawals. A third-party website performance monitoring provider, DebugBear, was compromised and served malicious JavaScript that hijacked logged-in Polymarket sessions.

The script located trading tools and portfolios, then either sold positions and transferred proceeds or sent position tokens directly to an attacker-controlled address. It reused existing browser session authority rather than stealing seed phrases or private keys. Researchers observed roughly $2.19 million at a hard-coded fallback address; Polymarket stated it would make affected users whole. The US platform was reportedly unaffected.

Who is affected

Traders on Polymarket’s international site (Polymarket.com) who were logged in while the malicious DebugBear real-user-monitoring snippet was active. DebugBear customers using its RUM product were also put at risk and advised to remove the snippet.

Exact victim count is undisclosed; losses exceeded $2 million according to on-chain observations.

Why it matters

Modern web apps routinely load third-party analytics and monitoring scripts that run with full access to the authenticated page. A single compromised vendor can turn every customer site into a distribution point for session-hijacking malware.

In DeFi and prediction markets the result is direct, irreversible theft of user funds, forcing the platform into emergency freezes and reimbursement while damaging trust in the broader ecosystem.

How it could have been prevented

Remove or isolate third-party RUM and analytics scripts from high-value authenticated pages; prefer self-hosted or strictly allow-listed tags with Subresource Integrity. Implement transaction simulation, spending limits and out-of-band confirmation for withdrawals. Monitor for unexpected script changes and maintain rapid kill-switches for third-party dependencies. Users should review recent transactions and revoke approvals where supported.