1. Binance confirmed a security breach impacting about 6.3 billion dollars in assets, with nearly 3 billion frozen on-chain, linked to a compromised DevOps laptop and possibly North Korea. (The Hacker News, BleepingComputer, The Record)
2. The official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor, traced to a compromise of the Cursor Marketplace. (The Hacker News, Dark Reading)
3. CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog: GitLab CVE-2026-97229 with a CVSS score of 10.0 and a Cisco firewall denial-of-service vulnerability. (The Hacker News)
4. Drupal warned that threat actors are actively exploiting a highly critical authorization bypass flaw in its Commerce Core component, tracked as CVE-2026-118539. (The Hacker News, BleepingComputer)
5. A critical Linux kernel TCP flaw, CVE-2026-98432 with a CVSS score of 9.8, affects Ubuntu, Red Hat and other distributions, with Anthropic stating its AI model wrote an exploit for it. (The Hacker News)
6. A ransomware attack on the University of New Mexico Health Sciences Center diverted ambulances, cancelled surgeries, and sent medical students home. (Fortra)
7. The FrostyNeighbor advanced persistent threat group launched a destructive attack in Ukraine, raising concerns about deeper alignment with Russian cyber objectives. (Dark Reading)
8. Threat actors are delivering malicious loaders and cryptocurrency miners via fake ChatGPT and Claude desktop applications in a campaign dubbed Yoba. (The Hacker News)
9. A flaw in Telegram for Android, fixed in version 12.10.4, could be chained with two other bugs to take full control of a victims phone through a voice call. (The Hacker News)
10. Researchers found 26,400 valid cloud and AI credentials exposed in public Gitee repositories, mostly keys for cloud and AI services. (The Hacker News)
11. Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. (Cloudflare)
12. A security firm patched a decade-old application to prevent takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers. (Dark Reading)
13. Researchers cannot fully explain why cyber threats in Italy are so different from those in any other country. (Dark Reading)
14. The Pentagon is treating August freezer failures at military bases as a suspected cyberattack. (Reddit r/cybersecurity)
15. Over 100 cloned GitHub repositories are pushing the Remus Botnet via password-protected releases. (Reddit r/cybersecurity)
16. A code-execution flaw in UEFI firmware affects most servers on the planet. (Reddit r/cybersecurity)
17. CISA confirmed active exploitation of Node2Shell and HTTP2Shell vulnerabilities. (Reddit r/cybersecurity)
18. A pre-auth remote code execution vulnerability was disclosed in TightVNC Viewer. (Reddit r/cybersecurity)
Be First to Comment