The FBI has now formally attributed the roughly $6.4 billion Binance theft to North Korea’s TraderTraitor and published 628 addresses for exchanges to block, while Binance began phased withdrawals and says it has covered about 95% of the loss. In travel, Cathay Pacific, Malaysia Airlines and Japan Airlines all trace customer-data exposure to a breach at reservation provider Amadeus. On the patch front, BTCPay Server told operators late on 1 November to shut their instances down after hot wallets were swept, and Canonical’s LXD and MicroCloud carry a CVSS 10.0 authentication bypass.

Do today

  • BTCPay Server: if you run an instance with a server-side hot wallet, take it offline with the project’s shutdown script until BTCPay finishes its investigation, then move funds to a key held off the server and upgrade to 2.4.7. (BTCPay notice, 2.4.7 release notes)
  • LXD, MicroCloud and Incus: refresh to LXD 6.10.1, 5.21.9, 5.0.11 or 4.0.15, MicroCloud 3.4.1 or 2.1.5, or Incus 7.6.0, and firewall the HTTPS API to trusted hosts until the refresh lands. (Canonical advisory, Incus advisory)
  • Ivanti Connect Secure: CVE-2026-111357 reaches its KEV due date today. Close it out and confirm you are hunting for compromise, not only patching. (CISA KEV)
  • Exchanges, bridges and swap services: load the FBI’s Binance address list (608 Ethereum, 19 Bitcoin, 1 Solana) into your screening rules. (FBI alert, Elliptic blocklist)
  • Electrum: upgrade to 4.8.3, and until then check output addresses before you fee-bump anything. (GHSA-6jp4-8v48-cc5v)

AI and agent security4 stories

  • Microsoft: North Korean groups have built AI into the whole operation, and two have started using ARTEX — Microsoft Threat Intelligence ranks North Korean actors by how far AI has spread through their work. Jade Sleet, Coral Sleet and Jasper Sleet are rated “operationalized”, and four more are “accelerating”. In the examples, Onyx Sleet churned out more than 100 target-specific PDF lures in bursts, Coral Sleet built a workflow that trojanizes private GitHub repositories, and since late October Onyx Sleet and Pearl Sleet have used the open-source ARTEX agentic pentest framework. Microsoft’s framing matters: operations are still human-directed, and AI makes them faster and more scalable rather than autonomous. Our take: the defensive advice is old (block device-code flow, verify remote hires on camera, isolate web-facing systems), but the window to apply it is shrinking. (Microsoft Threat Intelligence)
  • Google: ARTEX, PentAGI, Hexstrike and CAIRN show up in incident response, at machine speed — GTIG and Mandiant document multi-agent offensive frameworks in active use since late 2025. Users include UNC7228 (which Microsoft tracks as Storm-0940), extortion crews and suspected PRC-nexus clusters. In the cases described, execution came in bursts of 2–25 seconds, one run logged 27 events in 23 seconds, and the time from first compromised account to deep access was about four hours, in one case 15 minutes. One agent enumerated more than 110,000 Active Directory objects, and another sent results to 491 rotating webhook.site URLs. Our take: these tools give up stealth for speed. Alerts on control-plane bursts, bulk storage reads and new webhook egress are the cheapest detections available, and the rate limits on email and notification APIs that GTIG recommends are worth adding now. (Google Threat Intelligence Group)
  • Wiz lists seven fingerprints of an agent-driven intrusion — Drawing on public cases and three of its own investigations, Wiz describes what agentic attacks look like in logs. The signs: machine-paced but variable timing, natural-language reasoning left in scripts, self-correction after errors, breadth-first technique coverage and descriptive throwaway file names. In one case an agent ran about 150 scripts over 21 hours against roughly 25 organizations, mostly exchanges and fintechs, and stole cloud and Kubernetes credentials in bulk. Some artifacts even named the framework and referred to “the other” instance of the agent. Our take: the fingerprints are a vendor’s interpretation of a small sample, but “noisy and fast” matches what Google reports, and it argues for behaviour-based detections over IOC feeds. (Wiz research)
  • Wiz survey: 55% run autonomous agents, 17% have a current AI inventory — The other Wiz post this week surveys 100 senior IT and security decision-makers. Over half say they deploy agentic systems, 52% found unauthorized AI applications in the past year, and 35% let teams deploy AI tools without central approval. The concerns they rank highest are agents reaching sensitive data (70%) and unmonitored autonomous decisions (54%). Our take: 100 respondents and a vendor with a product to sell make this a weak benchmark, but the gap between agent adoption and asset inventory is the number to bring to a governance meeting. (Wiz survey summary)

Application security6 stories

  • Nuxt 4.6.3: four dev-server flaws, including arbitrary file read — Nuxt fixed four moderate bugs in its development tooling. In CVE-2026-119198, a client that reaches the HMR socket can name an absolute path in a fake error report and read the file back. The others expose the generated appSecret and private runtime config through the dev bundle and let dot segments slip past page-route middleware. Production builds don’t include the dev-server code, and the default localhost bind limits reach. The real risk is dev servers exposed with --host, tunnels or shared preview proxies, which describes a lot of agent and cloud-IDE setups. If one was exposed while running 4.6.0–4.6.2, rotate whatever the dev process could read.
    CVSS 5.9 (v3.1, GHSA) EPSS 0.0029 KEV no (GHSA-x287-wcfc-q46c, GHSA-3xf4-9g3c-4h4w, GHSA-648h-gw55-m2g7, GHSA-9v7c-q64q-vv33)
  • MariaDB Connector/J: a hostile server can pull local files from the client (CVE-2026-119210) — The driver approved a server’s LOAD DATA LOCAL INFILE request by searching the command text, so quoted identifiers, literals or comments could satisfy the check. A malicious or impersonated server could then read any file the JVM can see. allowLocalInfile is on by default. Fixes ship in 3.3.7, 3.4.5 and 3.5.11, together with four smaller bugs where server-supplied lengths drive allocations or truncate. Our take: if you can’t upgrade yet, set allowLocalInfile=false, and treat any JDBC path that crosses a network you don’t control as exposed.
    CVSS 5.9 (v3.1, GHSA) EPSS 0.0030 KEV no (GHSA-fhx5-2xqw-2cgm, GHSA-h599-m3w5-9m7x)
  • @sigstore/oci 0.7.2: registry credentials sent to a cross-host upload URL (CVE-2026-118763) — signIn() puts the registry credential on a shared HTTP client, and uploadBlob() then PUTs to whatever Location the registry returns, even on another host. A malicious or compromised registry could therefore collect Basic credentials, bearer tokens or custom Docker-config headers. The reporter says this is left over from an earlier fix (CVE-2026-59891) that missed this code path, and that it was found by source review without a live hostile registry. Upgrade signing pipelines that push attestations to third-party registries.
    CVSS 7.4 (v3.1, GHSA) EPSS 0.0030 KEV no (GHSA-j63v-mwhm-56jx)
  • russh 0.65: keys added with ssh-add -c signed without asking (CVE-2026-116794) — An old commit replaced the russh agent server’s confirmation call with a hard-coded true. From 0.50.0-beta.12 through 0.64.1, any local process, or any host you forward the agent to, could use confirm-constrained keys silently while ssh-add still reported the constraint. The private key itself never leaked. The advisory names one desktop password manager built on russh 0.62.7 as possibly affected, based on untested code review. Our take: if you rely on confirm prompts as a guard against agent forwarding, check which agent actually holds the key.
    CVSS 8.3 (v4.0, GHSA) EPSS 0.0016 KEV no (GHSA-vp5q-ff62-jwqv)
  • OAuthLib 4.0.0: one authenticated client can borrow another client’s grants (CVE-2026-118669) — In the client_credentials and password grants, OAuthLib didn’t check that a client_id in the request body matched the client that had authenticated. Applications whose validators authorize on that argument could hand out another client’s scopes or grant types. The attacker needs valid credentials for some client, so this is a privilege-boundary bug, not an unauthenticated one. The fix is a major-version bump, so test before you roll it out.
    CVSS 8.4 (v4.0, GHSA) EPSS 0.0031 KEV no (GHSA-7984-qgvg-3j9c)
  • follow-redirects 1.16.2: cross-realm arrays drop the sensitive-header list (CVE-2026-116689) — Because sensitiveHeaders was checked with instanceof Array, an array built in another JavaScript realm (a vm context or iframe, for example) was swapped for an empty list. Custom credential headers could then follow a cross-origin redirect. The built-in Authorization, Proxy-Authorization and Cookie protections still held in testing, and the advisory doesn’t claim Axios is affected. Only 1.16.0–1.16.1 are vulnerable, so this mostly concerns lockfiles refreshed recently.
    CVSS 8.2 (v4.0, GHSA) EPSS 0.0027 KEV no (GHSA-mrwp-f3q8-3g9p)

Exploited and critical CVEs3 stories

  • KEV: still no additions since 30 October; Ivanti due today, Plex and Siemens tomorrow — CISA’s catalog remains at version 2026.10.30. Ivanti Connect Secure CVE-2026-111357 is due today, and the second Ivanti flaw from the same chain (CVE-2026-118527) is due 13 November. Plex Media Server CVE-2026-96652 and CVE-2026-96655 and Siemens Software Center CVE-2026-110936 fall due on 3 November. The names don’t match: KEV calls CVE-2026-111357 “missing authentication for a critical function”, while the NVD description calls it a privilege escalation to root. Treat it as part of the root chain covered earlier this week, whichever label applies.
    CVSS 7.0 (v3.1, MITRE via NVD) EPSS 0.0053 KEV yes (CISA KEV feed mirror, NVD CVE-2026-111357)
  • Electrum 4.8.3: a malicious server can trick users into paying the attacker through a fee bump (CVE-2026-117601) — Electrum didn’t verify signatures on mempool transactions. A rogue server could hide a payment the user had just broadcast and show a conflicting, invalid transaction that pays the attacker. If the user then used replace-by-fee on that transaction, they signed a real payment to the attacker. The maintainers report two users hit in the wild, one of whom lost funds. 4.8.3 now verifies signatures on inputs the wallet owns. Users who connect only to their own server are not affected. Our take: the EPSS score is low, but this is confirmed in-the-wild theft against a widely used wallet, so treat it as urgent for anyone on public servers.
    CVSS 9.3 (v4.0, GHSA) EPSS 0.0018 KEV no (GHSA-6jp4-8v48-cc5v)
  • WAVLINK and Oray routers: another batch of critical CVEs with public write-ups and no fixes — Since 1 November, NVD has published more than a dozen critical command-injection records for WAVLINK WN553X1-B, WN536AX6-A, WN701AE and other models, scored 9.1–10.0. It has also published two new Oray Pugongying X5 Pro records: a factory reset reachable through the JSON batch API (CVE-2026-120224) and a path traversal in configuration restore (CVE-2026-120225). Public proof-of-concept write-ups exist, and none of the records lists a vendor fix. Our take: with no fixes listed for this consumer kit, the practical answer is to keep management interfaces off the internet and replace devices that no longer get firmware.
    CVSS 10.0 (v3.1, NVD listing, CVE-2026-120276) EPSS not yet scored KEV no (NVD CVE-2026-120276, NVD CVE-2026-120231, NVD CVE-2026-120224, NVD CVE-2026-120225)

Cloud and infrastructure3 stories

  • LXD, MicroCloud and Incus: a forged certificate chain authenticates as any trusted client (CVE-2026-112816) — LXD’s mutual-TLS check compared every certificate in the client’s chain against the trust store, but only the leaf proves the client holds the private key. An attacker could place a trusted certificate as an intermediate and be accepted as that identity. Depending on the identity’s privileges, that means root on the host and control of the cluster’s VMs and containers. Incus found the bug and fixed it in 7.6.0. Canonical’s fixed snaps are LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5. Canonical warned that the stable channels were still filling when it published. CISA’s assessment on the CVE record says no known exploitation. One discrepancy: the NVD record lists affected ranges starting at 4.0.14, 5.0.10, 5.21.8 and 6.9.0, while Canonical’s advisory gives only fixed versions, so assume older builds are affected too.
    CVSS 10.0 (v4.0, Canonical via NVD) CVSS 10.0 (v3.1, Incus GHSA) EPSS 0.0030 KEV no (Canonical advisory, Incus GHSA-xg75-xf37-cph9, Ubuntu CVE page)
  • Linux TCP use-after-free: AWS’s patched images are out, and Ubuntu still has no fixed kernel (CVE-2026-98432) — AWS updated its bulletin on 1 November. EKS-optimized AL2023 AMIs (v20261031) and ECS-optimized AMIs (20261031) are released, and Fargate runs new tasks on a patched platform as of 1 November, 09:00 PST. RDS and Aurora OS patches are due 3 November, managed GameLift fleets by 4 November and EKS Auto Mode by 6 November. AWS says patching with a reboot is the only complete fix, and that disabling MPTCP reduces risk without removing it. Ubuntu’s CVE page still shows 22.04, 24.04, 26.04 and 26.10 as vulnerable with fixes in progress. Our take: AMI-based fleets can roll now, while Ubuntu-based nodes still have to rely on the IP-options drop rule.
    CVSS 9.8 (v3.1, kernel CNA and Red Hat) KEV no (AWS bulletin 2026-160-AWS, Ubuntu CVE page)
  • Microsoft: fake help-desk Teams calls led to AD CS abuse and DCSync within seconds — Microsoft describes two intrusions that began with Teams messages and calls from fake IT staff, then Quick Assist, then portable Python, Bun or Java runtimes started from KB-named folders. In one, a misconfigured certificate template (ESC1) yielded certificates for privileged accounts, DCSync started seconds later, and an account excluded from automated containment was used to send data out over Rclone. In the other, PetitPotam coercion relayed to AD CS Web Enrollment (ESC8) yielded a domain controller certificate before the workstation was isolated. Our take: containment exclusions are the lesson here. Every identity your automation can’t contain needs a manual plan, and revoking certificates doesn’t invalidate Kerberos tickets already issued. (Microsoft Security blog)

Crypto and Web33 stories

  • Binance: FBI attributes the theft to TraderTraitor, publishes 628 addresses; phase-one withdrawals reopen — Reported in BleepingComputer and The Hacker News, an FBI alert issued with the Secret Service and IRS-CI says North Korea took “more than $6 billion” on or about 29 October. It lists 608 Ethereum, 19 Bitcoin and 1 Solana address and asks exchanges, RPC and THORNode operators and swap services to block them. We could not load the FBI page itself, so these details rest on that coverage. Binance’s Recovery Update #4 reopened withdrawals for 15 networks from 06:00 UTC on 1 November and says about 95% of the impacted amount is now covered, up from about 90%. It names no attacker and promises a post-incident report. The tracing firms still disagree on the totals: TRM says $6.36 billion and about $2.7 billion frozen, Elliptic says $6.43 billion and $2.85 billion frozen, and Chainalysis says $6.4 billion and about $2.8 billion frozen. (Binance Recovery Update #4, FBI alert, TRM Labs, Elliptic, Chainalysis, BleepingComputer)
  • BTCPay Server: hot wallets swept, operators told to shut down — At 22:25 UTC on 1 November, BTCPay Server’s official account warned of reports that hot wallets on BTCPay instances were being swept. It told every operator to run the shutdown script and stay offline until the investigation ends. No loss total, affected-version list or root cause has been published. Press reports quote the project founder as linking the drains to versions older than 2.4.2, which in August fixed a critical flaw the project says was exploited, and as saying public 2.4.7 servers were not hit. That remains unconfirmed by the project. Version 2.4.7 (29 October) fixed 85 findings from a scanner report, one of them critical. Our take: watch-only setups with keys on an external signer are not exposed this way. Anyone storing a seed on the server should assume it is gone and move funds once the server is back up. (BTCPay Server notice, BTCPay releases, BTCPay 2.4.2 advisory)
  • Polymarket: the vendor is DebugBear, entered through DNS, and refunds reach $3.9 million — Polymarket’s postmortem says a compromised third-party performance-monitoring script sold positions and moved funds from active sessions. It has returned $3.9 million: $2.7 million for the attack and $1.2 million for losses during the trading pause, with 95% of affected wallets refunded in full. DebugBear posted at 18:00 UTC on 29 October that it was dealing with a security incident and told RUM customers to remove its embed code. Researcher Ohey traced 28,636,284 POL from 33 accounts to the attacker’s Polygon wallet. Ohey also logged the DebugBear hostnames, including cdn.debugbear[.]com, answering from a different server mid-incident and returning NXDOMAIN later. Our take: if you load a third-party script on a page that can sign transactions, pin it with SRI or self-host it, because a registrar compromise at the vendor bypasses everything else. (Polymarket postmortem, Ohey trace, DebugBear statement)

Incidents and industry2 stories

  • Amadeus breach reaches Cathay Pacific, Malaysia Airlines and Japan Airlines — Several Asian carriers now trace customer-data exposure to unauthorized access at Amadeus, which runs their reservation and check-in systems. Malaysia Airlines says data processed through Amadeus between August 2023 and September 2026 may be affected, its own systems were not compromised, and there is no evidence financial data was accessed. Cathay Pacific’s notice, reported widely on 30 October, puts the figure at about 53,000 bookings. Japan Airlines reports about 92,000 customers, roughly 2,000 of whom also had passport and frequent-flyer numbers exposed. Amadeus has said publicly only that it found a vulnerability in a travel-booking display environment. The figures count different things (bookings, customers, processing periods) and can’t be added up, and we could not load Cathay’s or JAL’s notice pages directly. Our take: expect more carriers to disclose, and expect booking-reference phishing well before anyone publishes a total. (Malaysia Airlines advisory, Cathay Pacific notice, Japan Airlines notice, The Record)
  • Frontline Education: K-12 staff and student records, including SSNs and Medicaid IDs — Frontline says attackers used a vulnerability in third-party software to get into part of its environment on 14–15 August 2026. The incident touched Frontline Central and School Health Management. Depending on the person, exposed data includes Social Security, driver’s licence and passport numbers, other government IDs, Medicaid IDs and student IDs. Letters began going out on or about 26 October, with TransUnion monitoring for adults and minors. Frontline hasn’t given a count, and district notices differ on whether student data was involved. Our take: ten weeks between intrusion and notification is long for data on minors, so districts should check their own exposure rather than wait for letters. (Frontline notice, hosted copy)

Bottom line

  1. TraderTraitor now carries both the FBI’s attribution and the largest theft on record. Anyone moving value across chains should be screening against the published addresses today, not after the next freeze request.
  2. BTCPay, Polymarket and Amadeus all failed at a layer their users couldn’t see: a server hot wallet, a vendor’s DNS, a booking provider’s display system. Inventory those dependencies before an incident makes you do it.
  3. Agentic intrusion tooling is now documented by Microsoft, Google and Wiz in the same week. It is fast and noisy, which favours teams with behavioural baselines on identity and control planes.