Attacks & Vulnerabilities
|
Binance resumes customer withdrawals after record $6.3bn hack (2 minute read)
Binance has resumed phased withdrawals after a $6.3 billion theft. The FBI attributes the attack to North Korea-linked TraderTraitor, part of Lazarus Group. The breach involved a compromised laptop and malware that deleted evidence. Binance has replenished 90% of stolen assets and pledged to cover the remainder. The FBI warns that stolen funds are being converted into Ethereum and laundered through DeFi and instant swap services.
|
Anthropic VS code extension on Cursor backdoored for nearly 12 hours (2 minute read)
A malicious Claude VS Code extension, version 2.1.313, was published through Anthropic's official Cursor account. It targeted up to 5,000 developers, collected host and environment details, and tried to add an SSH key and open a reverse tunnel. Bugs limited persistence on Windows and macOS. Cursor removed it, blocked its server, rotated keys, and audited the marketplace, but users who installed or updated it on Thursday should check the published indicators of compromise.
|
|
Agentic Offensive Frameworks Hit Real Intrusions (34 minute read)
Google Threat Intelligence Group (GTIG) and Mandiant observed intruders using the open-source ARTEX framework with stolen credentials and letting its six sub-agents run Azure and AWS permission sweeps, Kerberoasting, DCSync, and MySQL log poisoning that wrote JSP webshells in bursts as short as 2 to 25 seconds. ARTEX users included financially motivated extortion groups and suspected PRC-nexus clusters such as UNC7228, which went from a first account to deep access in about four hours, though GTIG noted the agents were forensically noisy and sometimes undid each other's work. Mandiant recommended short-lived, tightly scoped credentials, locking down admin interfaces like Kudu/SCM as privileged infrastructure, and behavioral detection tuned for machine-speed bursts.
|
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (8 minute read)
VOLTA takes a "steal everything, let AI sort it out" approach: it grabs credentials, sessions, wallets, and cloud keys, then uses the victim's own Gmail, DoorDash, and Discord sessions to confirm details like a home address. It sends the resulting dossier through OpenRouter to Claude, falling back to Kimi and then Gemini if a model refuses, and gets back a ranked "WHAT THEY'RE WORTH" assessment of what the victim's assets could fetch. Talos assessed VOLTA as a commodity builder that runs entirely on third-party infrastructure. They recommended that defenders block or alert on non-developer processes launching Chrome with --headless, since that is how the stealer gets around App-Bound Encryption.
|
Discovering a Backdoor and Flaws in More Encrypted USB Drives (10 minute read)
Vector 35 researcher Xusheng Li pointed Codex at Binary Ninja's MCP server and recovered the keys hardcoded in NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure in 7 to 26 minutes each. In each product, the key was fixed in the binary, derived from an embedded seed, or unlocked by a certificate in the viewer, so the user's password never protected the files. Separately, time-travel debugging turned up two hidden accounts in SecZure's YutianDun drive, with passwords as weak as "123456", that could decrypt any file. Li skipped vendor disclosure because drives already in the field can't be patched, and he argued that client-side validation is never secure, so buyers should only trust drives that derive their encryption key from the user's password.
|
|
Northstar Security (Product Launch)
Northstar Security provides a Security Context Graph from existing security and IT tools. It maps identities, assets, applications, vulnerabilities, and business systems, then flags risky combinations and starts supervised fixes such as installing endpoint protection or limiting access.
|
Agentmetry (GitHub Repo)
Agentmetry is an agent observability tool that records every tool call an agent makes on a machine, flags risky sequences, can block a call that your policy forbids, and keeps a record that a third-party can verify and forward to a SIEM.
|
BLA: Blind LLM Agents (GitHub Repo)
BLA is a tool to harden binaries against agentic reverse engineering. When an AI reverse engineering agent opens the binary, the analyzer his resource budgets, follows decoys, and burns tokens.
|
|
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux (2 minute read)
CVE-2026-97229, a CVSS 10 flaw in Ruby's Onigmo regex engine, lets unauthenticated attackers execute code through crafted GitLab CI/CD configurations. Attackers targeted Alpine Linux on October 20 to 21, crashed worker processes, and downloaded its container image. Alpine found no confirmed code execution or repository tampering, rebuilt the instance, and reset passwords. CISA added the bug to KEV. GitLab-only updates may be insufficient for custom Ruby deployments. Use Ruby 3.3.13, 3.4.12, 4.0.9, or later.
|
CVE-2026-98432: which Linux kernels are still vulnerable (5 minute read)
Mattias Geniar found 712 Multipath TCP listeners on his own Ubuntu 26.04 laptop, opened without his knowledge by Go programs like tailscaled, because Go 1.24 and later enable MPTCP on listening sockets by default. That matters because the only known exploit for CVE-2026-98432 needs an MPTCP listener. The bug is a use-after-free in the kernel's IPv4 TCP handshake that dates back to Linux 4.4 and can be reached with a single SYN. Upstream stable kernels were fixed in mid-October, and Debian, Amazon Linux, and Oracle UEK have shipped patches, but Ubuntu and RHEL still had no fixed kernel as of November 1.
|
Legal Exploits May Emerge At Scale (4 minute read)
The authors argue that legal systems may have dormant “vulnerabilities” that an attacker can leverage with an LLM to find and exploit. They present an example from the German legal system, which requires executive regulations to cite their legal basis. The authors then showcase a selection of regulations with provisions lacking proper citations, which could render them void and unenforceable.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments