Daily brief
Friday, 30 October 2026
Binance loses about $6.3 billion in the largest crypto heist ever, a 9.8-rated Linux TCP bug gets an AI-written root exploit, and GitLab and Cisco flaws join KEV.
Top stories
- Binance hit by ~$6.3 billion security incident
#breach— The world’s largest exchange says the incident affected about $6.3 billion in assets; nearly $3 billion has been frozen on-chain, with Tether and Circle freezing about 1.57 billion USDT and 800 million USDC. Why it matters: the biggest digital heist on record. The Hacker News - Linux kernel TCP flaw, CVSS 9.8 (CVE-2026-98432)
#vulnCRITICAL— Affects Ubuntu, RHEL and other distributions; Anthropic says its AI model wrote an exploit giving an unauthenticated remote attacker root. Why it matters: remote, pre-auth, kernel-level — patch as soon as your distro ships a fix. The Hacker News - Unreleased Claude model chains exploits across browsers and OSes
#industry#ai— Anthropic says the model found and chained vulnerabilities in Chrome, Safari, Android, Windows and Linux. Why it matters: AI-driven exploit development is accelerating the patch treadmill for everyone. Dark Reading
Breaches & incidents
- Poker pros infected with card-revealing malware
#breach— An accused cheater used malware on top online poker players’ machines to see their hands. Wired
Vulnerabilities & patches
- CVE-2026-97229 — GitLab CE/EE
CRITICALEXPLOITEDKEV— Integer overflow leading to RCE, added to KEV on 29 Oct with a 1 Nov federal deadline. CISA alert · The Hacker News - CVE-2026-76418 — Cisco Secure Firewall ASA / FTD
HIGHEXPLOITEDKEV— NULL pointer dereference DoS under active exploitation. CISA alert - PHP2Shell threat brief updated
UPDATE— Unit 42 refreshed its CVE-2026-109618/109619 guidance; Risky Business reports the bugs were used to compromise Palo Alto Networks firewalls. Unit 42 · Risky Bulletin - ICS: Hitachi Energy and Siemens Mendix SAML
MEDIUM— New CISA advisories for Hitachi Energy CoreTec and TRO600 and the Mendix SAML module. CISA — Mendix · CISA — TRO600
Threat intel & red team
- NIK C2: AI-enabled command-and-control in the wild
#threat#ai— Talos documents a new C2 framework with integrated AI features. Cisco Talos - North Korean actors adopt AI in their tradecraft
#threat— Microsoft breaks down how different DPRK groups use AI, at varying levels of maturity. Microsoft Security - “Yoba”: fake ChatGPT and Claude desktop apps drop miners
#threat— Fake GitHub projects deliver signed-executable loaders and crypto miners. The Hacker News - Shadowy relay ships Codex and Claude Code with sandboxes disabled
#threat#ai— A service selling AI coding tools into unsupported regions strips out key security controls. Dark Reading - Belarusian state hackers turn to data wiping
#threat— Risky Bulletin · Dark Reading
Blue team & defense
- Talos IR trends Q3 2026
#defense— Phishing still leads initial access; help-desk vishing is rising and ransomware/pre-ransomware cases increased. Finance and public administration were the most targeted. Cisco Talos - Anthropic-themed phishing slips past leading email gateways
#defense— Obvious phishing with many red flags still bypassed several SEGs; a reminder to test your own filtering. Dark Reading
Worth reading
- Threat modeling with four questions on a whiteboard
#learning— A lightweight, practical threat-modeling method. Dark Reading - Why CTF competitions may matter more than ever
#learning— Dark Reading