Topic
Versions 2.1.312 and 2.1.313 of the Claude Code extension on Cursor's marketplace added an SSH key and a reverse tunnel. How to check a machine and what to remove, per Microsoft and Cursor.
The FBI has attributed the Binance theft to North Korea's TraderTraitor. Binance reopened withdrawals in phases on 1 November, starting with Bitcoin; the full proof of reserves is now due on 3 November.
A race during WordPress core updates can let an unauthenticated attacker run code. WordPress 7.1.4 and backports fix it; Wordfence says it blocked 62,969 attempts in a day.
Attackers chained two newly disclosed Ivanti Connect Secure flaws with the October zero-day CVE-2026-104935. Ivanti's fixes are 25.1.1.3 and 22.8R2.6; the integrity checker can miss a compromise.
Binance puts the 29 October theft at about $6.3 billion and traces it to a compromised DevOps engineer's laptop. TRM Labs and Chainalysis attribute it to North Korea's TraderTraitor.
An attacker chained PHP2Shell with the Fragnesia kernel bug to get root on 24 Palo Alto firewalls and a management server. Palo Alto confirms it. Fixed PAN-OS versions inside.
Trackers saw billions in crypto leave Binance's hot wallets on 29 October. Binance calls it a security incident, has paused withdrawals on several networks and says $2.54 billion is frozen.
A use-after-free in the Linux kernel's IPv4 TCP handshake, scored 9.8. Red Hat shipped RHEL 8, 9 and 10 fixes on 1 November; Ubuntu kernels are still pending. Status by distribution.
CISA added a CVSS 10 GitLab code-execution bug and a Cisco ASA/FTD SSL VPN crash bug to its exploited list on 29 October. Fixed versions and mitigations.
Rhysida listed MISC Group on its leak site on 26 October, claiming 28.4 GB including crew personal data and shipboard credentials. MISC has not commented.
Billing and insurance claims at Kamalnayan Bajaj Hospital in Maharashtra have been crippled since 18 October. The same group has listed Malaysian distributor Antah HealthCare on its leak site.
Singapore's CSA warns of malware sent as business documents from compromised WhatsApp accounts. It hijacks WhatsApp Web, steals credentials and watches online banking.
