← All threat briefs

Daily Cybersecurity Brief — 2026-11-02

SECURITY // 2026-11-02

Daily Cybersecurity Brief — 2026-11-02

Threat Intelligence & Malware Analysis

  • Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script — Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. (Source: The Hacker News)

  • NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection — Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and... (Source: The Hacker News)

Vulnerabilities & Exploits

  • DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work — Deepseek released a research prototype of dsh-superagent, a coding agent that does work on a GitHub repository for you. Who can ask for work The agent gets to work in two situations: an allowed user asks for something, or a rule your team wrote covers it. (Source: Help Net Security)

  • Byoky: Open-source wallet for AI API keys — Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps. Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own device. (Source: Help Net Security)

  • Product showcase: Trust Onion uses rotating codewords to verify callers — Trust Onion is a free app that gives trusted groups three rotating codewords to check who they are communicating with. It also includes signed selfies, message checks, and callback requests. (Source: Help Net Security)

  • Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability — Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is (Source: Help Net Security)

  • CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key — A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. (Source: The Hacker News)

  • Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. (Source: The Hacker News)

  • Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide — Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adv... (Source: The Hacker News)

  • Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) — Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer connection used to start a support session. (Source: Rapid7 Blog)

  • TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them — TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. (Source: The Hacker News)

  • WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours — Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. (Source: The Hacker News)

  • Shufti ties AI agent actions to verified owners and permissions — Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses. Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners. (Source: Help Net Security)

  • Bedrock Data routes data exposure fixes to owners and verifies results — Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise. Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow workflow the enterprise already runs and sup... (Source: Help Net Security)

  • Claude Code extension poisoned with persistent SSH backdoor — A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The company spotted the malicious package, version 2.1.313, on Open VSX, an open-source marketplace for VS C... (Source: Help Net Security)

AI/ML Security

  • The first ten lines of a command policy for AI coding agents — In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity attached when acting on someone’s behalf. (Source: Help Net Security)

  • New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value — Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and... (Source: The Hacker News)

  • Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data — American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentia... (Source: The Hacker News)

  • A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats — A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, ... (Source: The Hacker News)

  • “Black October” for AI Developer Platforms — A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale. (Source: Wiz Blog)

  • Key Takeaways: AI Threat Readiness Survey Report 2026 — Key benchmark findings on shadow AI, orchestration risks, and the imperative for an AI-against-AI defensive model. (Source: Wiz Blog)

Cloud & Infrastructure Security

  • Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% — Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests i... (Source: The Hacker News)

Policy & Regulation

  • Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving — The alert is critical. The fix is known. (Source: The Hacker News)

Law Enforcement & Takedowns

  • Ransomware gang talked AI agents into doing much of its dirty work — The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos. AI-assisted intrusion workflow (Source: Sophos) The company, which tracks the group as GOLD OGRE, recovered... (Source: Help Net Security)

  • FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist — The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. (Source: The Hacker News)

  • The Good, the Bad and the Ugly in Cybersecurity - Week 44 (2026) — PHP2SHELL’s complexity stalls mass exploitation, attackers chain it with Fragnesia to root firewalls, and a silent Brotli fix leaves Node2Shell exposed. (Source: SentinelOne Blog)

  • Assad regime hacker who caused $136 billion market drop sentenced to 42 months — A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as “Th3Pr0”, was sentenced on Thursday by a federal court in the E... (Source: Help Net Security)

  • Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison — Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. (Source: The Hacker News)

Reports & Analysis

  • Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis — A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. (Source: The Hacker News)