Binance says about US$6.3 billion in assets was affected by a breach that began with a compromised engineer's laptop, and analytics firms link it to North Korea. Ivanti patched the last two flaws in an exploited Connect Secure chain, now on CISA's exploited list with a 2 November deadline, and a tampered Claude Code extension reached up to 5,000 developers through Cursor's marketplace. Drupal Commerce and WordPress flaws are under active attack.
Australia
- Defence told to reduce VMware use. iTnews sources describe a mandate driven by licence costs and sovereignty; Defence declined to comment. iTnews
Global threats
- Binance: about US$6.3 billion affected, nearly US$3 billion frozen. Compromised DevOps laptop and service container; TRM Labs attributes it to TraderTraitor, the group behind Bybit, and Chainalysis also links it to North Korea. The Hacker News; BleepingComputer; iTnews
- Ivanti Connect Secure: CVE-2026-111357 and CVE-2026-118527 patched and added to CISA KEV. Fixed in 25.1.1.3, 25.1.3.1 and 22.8R2.6; CVE-2026-111357 due 2 November with forensic triage. CISA; The Stack; Canadian Centre for Cyber Security
- Drupal Commerce Core access bypass exploited (CVE-2026-118539). Fixed in Commerce Core 3.3.13 and 8.x-2.41, which also fix five lower-rated Commerce advisories; update and audit orders. Drupal; BleepingComputer; The Hacker News
- WordPress Core upgrade race draws about 63,000 attempts in a day. Fixed in 7.1.4. The Hacker News
- TeamViewer CVE-2026-111585 lets a host attack the viewer. Fixed in 15.83. The Hacker News
- Trezor warns CryptoBilis buyers of a suspected hardware implant. Single customer report, not yet lab-verified. The Hacker News
- Polymarket halts trading after a third-party script compromise. About US$2.1 million traced. The Record
- Florida student financial aid breach exposes data on nearly 5 million. The Record
- NetamLoader targets a government-only Windows build in Asia. Kaspersky, single detection. The Record
AI security
- Tampered Claude Code extension 2.1.313 on Cursor's marketplace. SSH key, persistence and host beaconing; check for an svc-telemetry SSH key, remove it and the persistence, and rotate credentials. The Hacker News; BleepingComputer; The Register
- CrowdStrike: Vapor Panda used ARTEX against 200+ organisations. Human-steered AI agents exploiting long-standing hygiene gaps. The Hacker News
- Hugging Face trust_remote_code mining campaign returns. BleepingComputer
- Embedded-browser flaws in five AI developer tools. Codex and VS Code issues reported unpatched. The Register
Industry
- NZ researchers plant canary session cookies in infostealer logs. About three days from infection to sale. iTnews
Outlook and patch priorities
- Critical: Ivanti Connect Secure (patch and check for compromise); Drupal Commerce Core; remediate Claude Code 2.1.313 installs from Cursor's marketplace.
- High: WordPress 7.1.4; TeamViewer 15.83; Cisco ASA and FTD and GitLab (CISA due 1 November).