Weekly Brief
Weekly Brief, November 2, 2026
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
The FBI has formally attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned group also known by multiple aliases. The scale and attribution make this a significant reference point for defenders tracking state-backed crypto theft and related infrastructure.
Review controls around crypto asset transfers, privileged access and phishing-resistant authentication for staff handling financial systems.
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical’s LXD and MicroCloud allowed an attacker with network access and a trusted client certificate to impersonate that client without its private key. Successful exploitation could give access to the cluster and its virtual machines, making this a serious exposure for hosted infrastructure.
Audit any exposed LXD or MicroCloud APIs and restrict network access so only trusted administration paths can reach them.
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Malicious code on Polymarket’s site used a replaced third-party script to sell signed-in traders’ positions and move funds to attackers. Polymarket says it is refunding about $2.7 million to 726 affected wallets, showing how a single compromised dependency can affect live users at scale.
Inventory third-party scripts on customer-facing pages and add monitoring for unexpected changes to externally hosted code.
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after reports of active exploitation, and attackers chained them to gain unauthenticated root access. Internet-facing remote access appliances remain a high-priority target when flaws are being used in the wild.
Prioritise emergency patching and exposure checks for Ivanti Connect Secure systems, especially any instances reachable from the internet.
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Researchers developed an exploit for a critical Linux kernel vulnerability that can let unauthenticated attackers execute commands as root on servers running Multipath TCP listeners. Any exposed service using the affected path could give attackers full control of the host.
Identify servers running Multipath TCP listeners and fast-track kernel remediation on any exposed systems.
Alpine Linux rebuilds GitLab after attempted RCE attack
Alpine Linux said hackers tried to exploit a critical GitLab vulnerability in its development infrastructure, prompting a rebuild of its GitLab server and a reset of all passwords. The incident underlines the need to treat source code and build systems as high-value targets when exploitation attempts are suspected.
If your development platform shows signs of compromise, rebuild the service, reset credentials and review access logs rather than relying on patching alone.
Chainalysis discloses data breach from "offensive agentic techniques"
Chainalysis disclosed a breach after attackers used “offensive agentic techniques” to access internal systems and tools, exposing customer names, email addresses, user IDs and organisational roles. The incident shows that identity data and internal tooling can be at risk even when core investigation content is not reached.
Tighten access to internal tools and review telemetry for unusual automated or agentic access patterns across administrative systems.
Malicious Claude Code extension on Cursor planted SSH backdoors
A malicious Claude Code extension was distributed through Cursor’s marketplace for about 11 hours and was designed to install persistent SSH backdoors. The incident highlights the risk of trusted developer tooling being used as a delivery mechanism for malware.
Review which IDE extensions are approved in your environment and alert on unexpected SSH key, authorised_keys or startup changes on developer systems.