The FBI has formally attributed the record Binance theft to North Korea's TraderTraitor and published the laundering addresses. A maximum-severity flaw in Canonical LXD and MicroCloud lets an attacker pose as a trusted client, Northflank customers must rotate every secret after AI keys were abused, and Chainalysis, ChatGPT and GNU Savannah round out a busy day for AI-linked security.
Weekend recap
- Episode 17, Sunday Special: Australia's Cyber Threat Report 2025-26. Patch in days, attackers log in rather than break in, medium businesses took the biggest cost rise, and assume breach. Episode 17 notes
- Episode 16 (Saturday). Binance breach, Ivanti Connect Secure chain closed, tampered Claude Code extension, Drupal Commerce and WordPress attacks. Episode 16 notes
Global threats
- FBI attributes the Binance theft to North Korea's TraderTraitor. More than US$6 billion; laundering addresses published; Elliptic puts the total at US$6.43 billion with US$2.85 billion frozen; withdrawals resuming in phases. FBI alert and address list; The Hacker News; AP
- Canonical LXD and MicroCloud CVE-2026-112816 (CVSS 4.0 score 10.0). Client impersonation with only a public certificate. Fixed in LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15, and MicroCloud 3.4.1 and 2.1.5; confirm the installed version after refreshing. Canonical advisory; NVD; The Hacker News
- Polymarket refunds about US$2.7 million to 726 wallets. DebugBear says its DNS records were compromised through its registrar. The Hacker News
- Android "SMS of Death" (CVE-2026-58882) exploit published. One crafted text crashes cellular service; fixed in October updates for Android 14 to 17 per the researcher, not for 12 and 13. BleepingComputer
- n0n ransomware operator's exposed server. Stolen and weak credentials only, AI-written scripts, data and backup deletion. The Register
AI security
- Northflank breach leads to abuse of customers' AI API keys. Rotate every secret at the issuing provider and check AI billing from 30 October. Northflank status; BleepingComputer
- Chainalysis discloses a breach it attributes to "offensive agentic techniques". Customer user names, emails, IDs and role labels accessed. Chainalysis; BleepingComputer
- ChatGPT shared-link flaw allowed session takeover. Fixed by OpenAI on 26 October. Parameter; The Hacker News
- AI-assisted audit finds a path to backdoor upstream Bash via GNU Savannah. 26 issues fixed; no evidence of supply chain compromise. iTnews; Hacktron; FSF update
Industry
- Cloudflare: 18.2 million network-layer DDoS attacks in Q3, up 38%. Growth in short, small attacks; the largest attacks fell 69%. Cloudflare; The Hacker News
Outlook and patch priorities
- Critical: Ivanti Connect Secure CVE-2026-111357 (CISA deadline 2 November, with forensic triage); LXD and MicroCloud; Northflank secret rotation.
- High: Android October updates; two-factor authentication for Chainalysis users.