Duna's Kiat
All editions
News

CyberNews: 30/10/2026 Edition

Today’s roundup

  • Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
  • Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
  • CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
  • Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
  • Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
  • As Russia's Cyberwar Evolves, Belarus Steps Forward
  • Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis
  • Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison
  • Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
  • NIK C2 Malware Can Use Victims’ OpenAI Keys for AI Queries

    • Summary

    Binance said a security incident impacted about $6.3 billion in assets, nearly $3 billion of which has been frozen on-chain. Tether and Circle froze more than 1.567 billion USDT and 800 million USDC respectively; crypto analysts attributed the heist, the largest in history, to North Korean hackers.

    Drupal warned that attackers are exploiting CVE-2026-118539, a highly critical missing authorization flaw in Commerce Core versions up to 2.41 and from 3.0.0 to 3.3.13.

    CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-97229 (CVSS 10.0), an integer overflow in GitLab Community and Enterprise Editions allowing remote code execution, and a Cisco firewall denial-of-service flaw.

    CVE-2026-98432, a Linux kernel TCP flaw rated 9.8 by the kernel's CVE team, affects Ubuntu, Red Hat Enterprise Linux and other distributions. Anthropic said its AI model wrote an exploit letting an unauthenticated remote attacker run commands as root on affected servers.

    A trojanized version 2.1.313 of Anthropic's official Claude Code extension was pushed through the Cursor Marketplace as a legitimate update under the real publisher identity and attempted to install a persistent SSH backdoor, prompting Cursor to temporarily shut down the marketplace.

    The Belarus-linked APT FrostyNeighbor launched a destructive attack in Ukraine, raising concerns about deeper alignment with Russian cyber objectives.

    A customer reported that a Trezor Safe 5 bought from the reseller CryptoBilis contains an extra circuit board that sends the recovery phrase over a mobile network. Trezor told everyone who bought from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.

    Ahmad Umar Agha, a Syrian Electronic Army hacker known as 'Th3Pr0', was sentenced to 42 months in U.S. prison for his role in a conspiracy against Western news outlets that included a fake tweet which triggered a $136 billion market drop.

    A campaign dubbed Yoba uses fake GitHub projects posing as ChatGPT and Claude desktop applications to deliver malicious loaders and cryptocurrency miners, abusing signed executables.

    The NIK C2 malware can fall back on its victims' OpenAI API keys to run AI queries.

    Want to dig deeper?

    Vulnerabilities

    CVE-2026-118539 Medium
    CVE-2026-97229 Critical
    CVE-2026-98432 Critical