Binance published initial findings on the October 29 theft of about $6.34 billion in digital assets, describing a sophisticated, multi-stage campaign. Attackers combined a fake recruitment process, compromised developer tools, stolen credentials and abuse of an internal AI application to reach the exchange's wallet signing systems. The FBI attributed the incident to the North Korea-linked TraderTraitor group, also tracked as Lazarus Group and APT38.
CISA added CVE-2026-119977 (CVSS 8.1), a WordPress core flaw affecting versions 4.7 through 7.1.3, to its Known Exploited Vulnerabilities catalog. Predictable, web-accessible staging directories used during core updates let unauthenticated attackers win a race condition and run code while an update is in progress. WordPress fixed it in 7.1.4, and Wordfence recorded more than 18,500 exploitation attempts in the first 21 hours.
Google's November 2026 Android security bulletin fixes CVE-2026-58868, a critical heap buffer overflow in FrameDecoder.cpp affecting Android 14 through 17 that could allow remote code execution without user interaction. The bulletin addresses 216 vulnerabilities, 23 of them critical, delivered through security patch level 2026-11-01 or later depending on manufacturers and carriers.
An attacker broke into the update system of the cPGuard security tool on November 2 and pushed a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files. Maker OPSSHIELD said about 2,950 customer servers ran it.
Barracuda disclosed two vulnerabilities, a pre-authentication authorization bypass tracked as CVE-2026-116606 (CVSS 9.3) and a command injection flaw, that can be chained to bypass authorization controls and gain root access to a vulnerable device.
Two flaws in the Xen hypervisor let a malicious guest VM read and write the memory of other VMs on the same host, including dom0. All Xen versions from 4.6 onward are vulnerable; patches are out and the Xen Project says there is no known mitigation.
A critical Ruby on Rails flaw in Active Storage lets an unauthenticated attacker write arbitrary files on a server by uploading a crafted file, when the app processes uploads with ImageMagick. It is fixed in Rails 8.1.4.1 and 8.0.5.2.
The China-aligned group SlippyNunchucks has been hijacking DNS requests made over insecure HTTP by Windows versions of Sogou Input Method to deploy the DarkVigil (aka FDMTP) implant in a surveillance campaign observed since July 1, 2026.
A supplier of the French National Blood Service was hit by a cyber-attack in which hackers turned up the temperature of cold rooms holding blood samples to 110°C (230°F).
Blockchain infrastructure provider Chainstack disclosed that an external attacker gained unauthorized access to part of its infrastructure, exposing customer data and password hashes. The company assesses the incident is part of a large-scale, AI-powered attack campaign that came to light the previous week.