Daily brief
Monday, 2 November 2026
Weekend edition: the official Claude Code extension on Cursor was trojanized, the FBI pins the Binance heist on North Korea's TraderTraitor, and Ivanti, Drupal and WordPress flaws are under attack.
Top stories
- Trojanized Claude Code extension pushed via Cursor Marketplace
#breach#supply-chain— Version 2.1.313 shipped under the legitimate publisher identity and tried to install a persistent SSH backdoor; a bug in the malicious code limited damage on some ~5,000 developer machines. Why it matters: IDE extension marketplaces are now a direct path into developer workstations. Microsoft analysis · The Hacker News · Wired - FBI attributes $6.43B Binance theft to TraderTraitor
#threat— The DPRK-aligned group (aka Jade Sleet, Slow Pisces, UNC4899) is blamed; tracers say the heist took about 20 minutes. Why it matters: it dwarfs every previous crypto theft and funds the regime. The Hacker News · Wired - Ivanti Connect Secure chain gives unauthenticated root
#vulnCRITICALEXPLOITEDKEV— Attackers chain three flaws; CISA added CVE-2026-111357 (missing auth) and CVE-2026-118527 (predictable identifiers) to KEV. Why it matters: Ivanti VPNs are a perennial initial-access favourite. The Hacker News · CISA alert - Chinese APT runs AI pentest framework ARTEX against 200+ orgs
#threat#ai— CrowdStrike attributes the Go-based multi-agent framework’s use to “Vapor Panda”, hitting high-value targets in parallel across 14 countries. The Hacker News
Breaches & incidents
- Chainalysis confirms intrusion into internal tools
#breach— An outside actor accessed customer identity data the company calls non-sensitive; investigation content was not touched. The Hacker News - Polymarket traders lose ~$2.7M through hijacked DebugBear script
#breach#supply-chain— A third-party page-speed script was replaced to sell signed-in users’ positions; Polymarket is refunding. The Hacker News - Suspected hardware implant in Trezor wallet sold by reseller
#breach— A Trezor Safe 5 from CryptoBilis reportedly contained an extra board exfiltrating the recovery phrase over mobile networks. The Hacker News
Vulnerabilities & patches
- CVE-2026-118539 — Drupal Commerce Core
CRITICALEXPLOITED— “Highly critical” missing authorization in Commerce Core up to 2.41 and 3.0.0–3.3.13. The Hacker News - WordPress Core RCE draws ~63,000 attempts in 24 h
HIGHEXPLOITED— RCE in WordPress 4.7 through 7.1.3 (CVSS 8.1), exploited right after the patch. Update immediately. The Hacker News - LXD / MicroCloud auth bypass
CRITICAL— CVSS 10.0: with network access to the API and a trusted client’s public certificate, an attacker can log in as that client without its private key. The Hacker News - TeamViewer: the controlled machine can attack the viewer
HIGHPATCH— A malicious host can attack the computer that connects to it; relevant to helpdesks connecting to untrusted machines. The Hacker News - Shared ChatGPT links could run attacker code
PATCH— Parameter showed a share link executing code in the victim’s session and reading private chats; reported via bug bounty. The Hacker News
Threat intel & red team
- VOLTA infostealer uses LLMs to rank victims by value
#threat#ai— The self-deleting stealer uses Claude, Gemini and Kimi to profile victims and prioritise the most valuable stolen data. Cisco Talos · Wired - NetamLoader targets government Windows 10 builds in Asia
#threat— Kaspersky details a sophisticated .NET-injection chain aimed at a custom government OS build. The Hacker News - Game developers extorted with AI game-cloning threats
#threat— Risky Bulletin
Blue team & defense
- From help-desk impersonation to AD CS abuse (ESC1/ESC8)
#defense— Microsoft IR traces Teams support impersonation to remote access, NTLM relay and certificate abuse, with hunting guidance. Excellent AD CS case study. Microsoft Security - Tool releases: YARA-X 1.22.1 and Wireshark 5.0.0rc1
#defense— Bug-fix release for YARA-X and the first release candidate of Wireshark 5. SANS ISC — YARA-X · SANS ISC — Wireshark - Extracting files from OneNote documents
#defense— SANS ISC - Cloudflare Q3: 18.2M network-layer DDoS attacks, up 38%
#defense— Roughly 8,200 L3 attacks per hour. The Hacker News
Industry, policy & developments
- Syrian Electronic Army hacker gets 42 months
#industry— Sentenced for the 2013 fake AP tweet that briefly wiped $136B off markets. The Hacker News - How Operation Blackout against scam centres went down
#industry— Dark Reading