|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
💰 Binance loses $6.3B in biggest crypto hack 🔑 State hackers exploit Cisco flaw 🦊 Critical GitLab flaw lets attackers run code 🔓 Fake Claude Code extension hit developers 🛒 Drupal store flaw under active attack Plus: 💡 4 strategies & tactics, 🎁 5 more stories you might like, 🧰 6 tools, and 📚 5 papers.
|
|
Leave Granola and get up to 12 months free of Wispr Flow Notetaker + Dictation
If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.
|
💰 Binance loses $6.3B in biggest crypto hack
LINK
|
- Binance, the largest crypto exchange by trading volume, said attackers stole about $6.3 billion in what it is calling a major security incident, with most funds moving across ten blockchains in roughly 20 minutes.
- The breach likely started with a compromised DevOps engineer's laptop used to reach a service container and send unauthorized withdrawals, though Binance found no evidence of a wallet private key leak and identified extra entry points.
- Firms TRM Labs and Chainalysis blame TraderTraitor, a North Korean hacking group; Binance has frozen around $3 billion with blockchain partners and promised to cover losses from its emergency and company funds.
|
🔑 State hackers exploit Cisco flaw
LINK
|
- A state-linked hacking group used a top-severity Cisco SD-WAN zero-day, tracked as CVE-2026-20127, to break into network controllers and plant a custom malware framework called KeyDrift, Cisco Talos said on Wednesday.
- The flaw scores 10.0 and lets a remote attacker skip authentication entirely to gain admin rights; Cisco says there is no workaround, patching is the only fix, and researchers later released a public proof-of-concept that raised risk for unpatched systems.
- KeyDrift runs in memory, acts as a backdoor, and steals what Talos believes is AES-256 key material for IPsec traffic, hitting space, satellite, defense, aerospace and policy targets; Cisco fixed the bug in February 2026.
|
🦊 Critical GitLab flaw lets attackers run code
LINK
|
- A critical GitLab flaw, CVE-2026-97229, lets an unauthenticated attacker run code on the server by sending a specially crafted regular expression in a CI/CD setup, and it now sits on CISA's actively exploited list.
- The bug, which carries a top severity score of 10, was used against Alpine Linux's own GitLab instance on October 20 and 21, crashing worker processes eight times, though maintainers found no proof the attack succeeded.
- Federal civilian agencies were told to patch by tomorrow, November 1; Alpine Linux rebuilt its instance from scratch as a precaution and blocked later break-in attempts on October 25 and 26.
|
🔓 Fake Claude Code extension hit developers
LINK
|
- A tampered version of Anthropic's Claude Code extension, spread through the Cursor Marketplace, hit up to 5,000 developers by installing a hidden SSH backdoor on their machines during a roughly 11-hour window on October 29.
- The fake extension, posing as Claude Code 2.1.313, added an attacker's SSH key labeled "svc-telemetry," set up a reverse tunnel, installed persistence, and sent host details and sensitive variable names to a server over plain HTTP.
- Cursor pulled the malware and Anthropic published a clean version, 2.1.314; affected users should isolate hosts, delete the rogue key and persistence, and rotate credentials, since auto-update could have pulled the backdoor in.
|
🛒 Drupal store flaw under active attack
LINK
|
- Drupal is telling online store owners to patch a serious access bypass flaw in its Commerce Core module right away, warning that attackers are already taking advantage of it on live websites.
- The bug, CVE-2026-118539, affects a module used on more than 42,000 sites and lets unauthenticated attackers get in no matter how the module is set up, earning a high risk score.
- Drupal has not said how the attacks work or how many sites were hit, but it tells admins to upgrade to one of two fixed versions and check their store orders for anything odd.
|
|
Get matched with a vetted coach and meet 1-on-1 by video. Take a short assessment, get matched, then message your coach between sessions as you work on your next move. • Clarity on what you actually want next • A plan you'll stick to, built with your coach • Confidence to make the move, at work or on your own |
|
|
|
Other
news & articles you might like
-
Accenture employee allegedly gave Claude code AI agent administrative access to Pentagon systems
LINK
-
Hackers weaponize OpenAI API in NIK C2 framework for credential theft and remote system control
LINK
-
$2 million+ drained from Polymarket traders in new supply chain attack
LINK
-
WordPress 7.1.4 fixes 22 security flaws, including an unauthenticated RCE vulnerability
LINK
-
New Kairos DDoS botnet hijacks Linux devices to overwhelm servers with thousands of TCP connections
LINK
|
|
🛠️ Trending tools
|
Google Gemini 3.8 Flash and Cyber: fast, affordable models for agentic coding, multi-step reasoning, autonomous tasks, and vulnerability detection in security workflows.
LINK
|
|
Replay QA Security Scan: runs automated penetration tests against web apps, detecting injection flaws, broken access control, IDOR, and cross-tenant data exposure introduced by AI coding agents.
LINK
|
|
Servor: manages 2 to 50 servers via web terminal, file editor, cron, monitoring, and status pages, using browser-signed commands with no inbound SSH port.
LINK
|
|
face2social: reverse image search matching a photo across Instagram, Facebook, LinkedIn, TikTok, and X to verify identities and spot scammers before trusting them.
LINK
|
|
Off the Record: adds inaudible interference that blocks AI notetakers from transcribing your meetings, including hidden ones running silently on others' devices.
LINK
|
|
mcpgawk: a local guard that intercepts MCP tool calls and holds any that changed after approval until you review and permit them
LINK
|
|
|
|
📚 Trending research papers
|
Tool-using AI assistants can be tricked into secretly forwarding your private queries and responses to an attacker after finishing a legitimate task, succeeding up to 100% of the time while leaving the original job working normally.
LINK
|
|
Invisible text watermarks hide signals equally well across most languages but leave low-resourced scripts like Lao far weaker, needing 93 characters to detect versus 2 for English after copy-pasting.
LINK
|
|
Prompt injection defense teaches AI assistants to read untrusted content without obeying hidden commands buried inside it, cutting a leading attack's success rate to 10% versus 85-97% for rival defenses while preserving accuracy.
LINK
|
|
Reverse-engineering assistants can now run on small, locally hosted models that figure out what inputs produced a chunk of machine code, hitting ~95% accuracy, within four points of frontier models at a fraction of the size.
LINK
|
|
Prompt theft defense catches hackers who try to trick a chatbot into revealing its secret instructions over multiple questions, spotting ~36% more attacks than rivals while rarely flagging legitimate users.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
