Daily Cybersecurity Briefing — November 1, 2026

Paul Baity

1 day ago

7 min read

Sunday, November 1, 2026

ACTIVELY EXPLOITED VULNERABILITIES

CVE-2026-97229 | GitLab CE/EE | CVSS 10.0 - Integer overflow/wraparound enabling unauthenticated RCE via crafted CI/CD pipeline regex. CISA KEV added Oct 29. FCEB patch deadline: November 1, 2026. Alpine Linux disclosed failed exploit attempts Oct 20-21 and rebuilt its instance from scratch.
CVE-2026-76418 | Cisco Secure Firewall ASA/FTD | CVSS 8.6 - NULL pointer dereference causing unauthenticated remote DoS (unexpected reload). CISA KEV added Oct 29. FCEB patch deadline: November 1, 2026.
CVE-2026-109618 / CVE-2026-109619 | PHP (PHP2Shell) | Critical - Two memory-safety RCE flaws. Patched in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. PHP 8.1 and older receive no upstream fix. CISA confirmed mass exploitation. Public PoC available on Sploitus.
CVE-2026-96652 / -96654 / -96655 / -96656 | Plex Media Server - Four-flaw RCE chain enabling admin access and code execution. CISA KEV Oct 20. Fixed in Plex 1.43.3.10861.
CVE-2026-102764 | BeyondTrust Remote Support - Zero-day. CISA KEV Oct 16. Advisory BT26-05.
CVE-2026-116690 / CVE-2026-116692 | MLflow (AI/ML Platform) - Unauthenticated RCE and arbitrary file read, both actively exploited in the wild. Fixed in MLflow 3.17.0.
CVE-2026-97631 | EDK II UEFI (PXE Boot) - Pre-authentication RCE via network boot. Under active exploitation. Most vendors have not yet released patches.
Tailscale Tailworm (multiple CVEs) - Privilege-escalation vulnerabilities in Tailscale SSH and Serve components, including access to privileged Unix domain sockets. Fixed in Tailscale 1.104.4 (Oct 27). No confirmed widespread exploitation.

BR3ACHES

Binance ($6.3B Cryptocurrency Heist) - FBI formally attributed the largest crypto theft in history to North Korea's Lazarus Group on November 1, 2026. Approximately $3B frozen. Binance covered 90% of user losses. Further asset laundering expected.
Sony So-net (Japan) - Unauthorized access Oct 19 exposed 2,585,481 records: 2,141,986 So-net accounts, 443,495 plala accounts, 54,401 email/password pairs, and 16 bank account records. Disclosed Oct 27.
ConnectWise Cloud Backup / Microsoft 365 - Compromised OAuth credentials used to breach 173 Microsoft 365 tenants (Oct 15-17). Services suspended Oct 17; credentials reset Oct 19. China-linked ARTEX actors subsequently leveraged access against 2,250 M365 tenants.
PwC - Everest ransomware group claimed approx. 590 GB stolen from a third-party employee learning platform. PwC confirmed Oct 23; states core network and operations unaffected.
Railway (Cloud Platform) - Unauthorized access Oct 20-22 exposed encrypted customer secrets. Attacker specifically targeted AI provider API keys (OpenAI, Anthropic, Google). Access ended Oct 22 at 03:32 UTC.
Warp (AI Dev Environment) - Third-party infrastructure provider breach exposed AI agent execution traces and telemetry for approx. 1% of users. CrowdStrike engaged for incident response.
State Bank of India (SBI) - Approx. 375,000-record dataset appeared on the dark web; 3,897 records contained PII. Disclosed to exchanges Oct 21. Source under investigation.
Zeabur (Cloud Platform) - Intrusion Oct 14-15 via leaked internal credentials exposed platform DB and customer environment variables. Prior August incident credentials were never fully rotated. Marked resolved Oct 20.

THREATS & POLICY

North Korea / Lazarus Group - FBI announced November 1 that North Korea was responsible for the $6.3B Binance cryptocurrency heist - the largest state-sponsored crypto theft on record. Indictments expected; further laundering operations anticipated.
ARTEX Campaign (China-Linked APT) - Chinese threat actors weaponized ARTEX, an open-source AI agent framework, to automate espionage against 200+ organizations and 2,250 Microsoft 365 tenants following the ConnectWise breach. AI-powered lateral movement at scale.
Gheist GitHub Supply Chain Campaign (Wiz Research, Oct 25) - Stolen GitHub tokens used to inject 13,500+ malicious branches across 850+ GitHub accounts. Malicious GitHub Actions workflows exfiltrated CI/CD secrets via logs. Active since Sept 15. AWS Secrets Manager enumeration also observed.
Black October 2026 - Cybersecurity Awareness Month marked by a historic wave of AI-enabled attacks, record CVE counts, and major state-sponsored operations. Analysts note AI is now central to both offense and defense.
LiteLLM Supply Chain Compromise - Internal master key exposed since May 27, 2026 was exploited Oct 10; malicious PyPI packages published Oct 21 at 11:39 UTC and malicious Docker Hub images at 11:46 UTC. Both removed within approx. 2 hours of detection.

CLOUD & SAAS SECURITY

ConnectWise Cloud Backup / M365 - Compromised OAuth credentials breached 173 Microsoft 365 tenants Oct 15-17. China-linked ARTEX actors subsequently targeted 2,250 M365 tenants using the same access foothold.
AI Provider API Key Targeting - Railway and OpenCode Console incidents revealed attackers specifically targeting stored AI provider credentials (OpenAI, Anthropic, Google). Developers registered before Oct 21 should rotate keys immediately.
OVHcloud CLI Supply Chain (GHSA-862f-55f5-vmvw) - Malicious binaries in OVHcloud CLI versions 0.11.0-0.15.0 distributed Oct 19 for approx. 90 minutes. Versions 0.10.0 and 0.16.0 are clean.
Rank Math PRO WordPress Plugin - Malware embedded in v3.0.123 downloads Oct 15-16 UTC. Fixed in v3.0.124. Site admins should verify plugin version immediately.
eMudhra Intermediate CA Key Weakness - 8 intermediate CA private keys used P-384 elliptic curve values below 256 bits, making them recoverable almost instantly. Vendor attributed to a script error; stated no publicly trusted end-entity certificates were issued by affected intermediates.
PingCAP / TiDB Cloud - Unauthorized access to an internal service account from Sept 9 to Oct 7 reported Oct 19. Customer impact remains unconfirmed.

IDENTITY & AUTHENTICATION

Microsoft Authenticator Android Flaw - Newly disclosed vulnerability allows malicious Android apps to steal Microsoft Authenticator account tokens with zero permissions required - no user interaction needed.
AiTM Token Replay Campaign - Microsoft 365 session token replay attacks compromised 97 accounts across 79 organizations. Attackers bypassed MFA via adversary-in-the-middle phishing, capturing and replaying valid auth tokens.
Passkey Research - Pass the Passkey (Palo Alto Unit 42): Novel attack paths identified in passwordless authentication, including methods to recover synced passkey private keys or bypass phishing-resistant MFA under specific configurations.

MOBILE SECURITY

Malicious Crypto Wallet Browser Extensions - Fake Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets detected stealing credentials and draining cryptocurrency funds from victims.
Android October 2026 Security Bulletin - Google released patches for 25 vulnerabilities, including critical RCE flaws in the System component. Apply the 2026-10-05 security patch level or later.
Browser-Based Spyware Delivery (Axios Research) - Researchers documented attackers weaponizing standard web browsing to silently deliver mobile spyware via browser exploits, requiring no user action beyond visiting a compromised site.

ICS/OT/IoT SECURITY

French Supermarket Refrigeration Attacks (CERT-FR CERTFR-2026-ALE-012, Oct 12) - Confirmed compromises of Danfoss AK-SM and AK-SC refrigeration controllers at 700+ French supermarkets. Attackers maliciously altered temperature and defrost settings. Forescout Vedere Labs found 12,976 exposed controller services across 6,017 IPs in 99 countries. CVEs: CVE-2025-41451 (CVSS v4 8.7) and CVE-2025-41452 (CVSS v4 6.8). Belgian CCB also lists Copeland XWEB and Dixell XWEB.
Kiloview E3 NDI Encoder (CISA ICSA-26-295-01) - 9 CVEs in firmware before v1.30 including command injection, missing authentication, path traversal, and hard-coded credentials. CVSS v3 9.9. Fixed in firmware v1.30 (Oct 10). CVE-2026-107861.
Bitdefender/NETGEAR IoT Research (Oct 2026) - Telemetry from 10.4M home routers (Jan-Sept 2026) reveals approx. 1.2 billion vulnerability observations. Smart TVs, smart plugs, and NAS devices account for 67.1% of all IoT vulnerability observations.
OT Policy Roundup (OT-ISAC, Oct 26) - Japan Common Cybersecurity Standards for Critical Infrastructure in force Oct 1, 2026. India CEA OT power-sector regulations effective April 1, 2027 (50 MW threshold). Singapore CII Code of Practice issued July 29. Australia ASD Essentials for OT published Oct 15.
NERC CIP-003-9 (Effective April 1, 2026) - Standard covers low-impact BES vendor remote access (Attachment 1 Section 6). Statutory maximum penalty: $1,584,648 per violation per day (FERC 2025 adjustment).

RESEARCH & TOOLS

Trojanized Claude Code Extension (Cursor Marketplace) - Official Claude Code VS Code extension versions 2.1.312 and 2.1.313 were backdoored with a persistent SSH backdoor. Attackers added their SSH public key and created systemd/launchd persistence on developer machines. Analyzed by Sophos, Morphisec, OX Security, and StepSecurity. Developer cleanup guide published.
PHP2Shell Public PoC (CVE-2026-109618) - A public exploit proof-of-concept for the PHP2Shell RCE vulnerability has been published on Sploitus, elevating exploitation risk for all unpatched PHP instances.
Anthropic Cyber Mission - Anthropic published its dedicated Cyber Mission, committing to offensive/defensive security research and responsible AI vulnerability disclosure to improve security across the industry.
OpenAI Daybreak - OpenAI released Daybreak, a suite of AI-powered defensive security tools targeting enterprise AI deployment security and threat detection.

AI/SI SECURITY

ARTEX AI Agent Weaponization (China-Linked APT) - Chinese open-source AI agent framework ARTEX weaponized to automate cyber espionage against 200+ organizations and 2,250 Microsoft 365 tenants. Demonstrates agentic AI enabling attack automation at unprecedented scale following the ConnectWise supply chain breach.
Anthropic Model Autonomous Exploit Chaining - An unreleased Anthropic model autonomously discovered and chained browser and OS vulnerabilities (Chrome, Safari, Android, Windows, Linux) into full RCE exploit chains. Vulnerabilities were coordinated-disclosed and patched before exploitation. Raises significant questions about AI capability in offensive security research.
MLflow CVE-2026-116690 / CVE-2026-116692 Exploited in Wild - Unauthenticated RCE and arbitrary file-read flaws in the MLflow AI/ML experiment tracking platform are under active exploitation. Fixed in MLflow 3.17.0. Immediate update required for all orgs running MLflow.
Stolen AI API Key Campaigns - Multiple October 2026 incidents targeted stored AI provider API keys as high-value targets. Attackers abused stolen credentials against OpenAI, Anthropic, and Google AI platforms. Railway and OpenCode Console users should rotate all AI provider credentials immediately.
Developer Tooling Attack Surface - Trojanized AI coding assistant extensions (Claude Code on Cursor) demonstrate attackers pivoting to AI development tools as high-value attack surfaces for persistent developer workstation access.
Black October AI-Enabled Attack Wave - Threat actors used AI for automated reconnaissance, vulnerability discovery, and rapid exploitation throughout October 2026. Vendors and analysts cite this as a turning point in the scale and speed of AI-assisted cyber operations.

SOURCES

CISA KEV Alert Oct 29, 2026: https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog

The Hacker News - CISA Adds GitLab RCE and Cisco Firewall DoS to KEV: https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

Security Affairs - CISA Adds GitLab and Cisco Flaws to KEV: https://securityaffairs.com/202133/security/u-s-cisa-adds-gitlab-and-cisco-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Unosecur - Black October 2026 Cyberattacks, Breaches and Incidents: https://www.unosecur.com/blog/october-2026-cybersecurity-incidents

The Cyberfeed - Daily Summary Oct 29, 2026: https://cloud.thecyberfeed.com/daily-summary/2026-10-29

Euronews - FBI Blames North Korea for $6.3B Binance Crypto Hack: https://www.euronews.com/2026/11/01/fbi-blames-north-korea-for-63-billion-binance-crypto-hack

NBC News - FBI Says North Korea Was Behind the $6.3B Binance Crypto Hack: https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758

The Hacker News - Hackers Use Compromised ConnectWise Credential to Access 173 M365 Tenants: https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html

The Hacker News - China-Linked Hackers Use ARTEX AI to Target 2,250 M365 Tenants: https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html

The Hacker News - Official Claude Code Extension on Cursor Trojanized with SSH Backdoor: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

BleepingComputer - Malicious Claude Code Extension on Cursor Planted SSH Backdoors: https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/

Security Boulevard/Viakoo - Daily OT Security News Oct 29, 2026: https://securityboulevard.com/2026/10/daily-ot-security-news-october-29-2026/

Industrial Cyber - OT-ISAC Asia-Pacific Policy Shifts: https://industrialcyber.co/regulation-standards-and-compliance/ot-isac-tracks-2026-asia-pacific-cybersecurity-policy-shifts-affecting-critical-infrastructure-ot-and-industrial-operations/

Lumu - Black October: A Sign of the Times?: https://lumu.io/blog/black-october-2026

CyberSecurity News - Microsoft Authenticator Flaw: https://cybersecuritynews.com/microsoft-authenticator-flaw/

Android Security Bulletin - October 2026: https://source.android.com/docs/security/bulletin/2026/2026-10-01

Axios - Hackers Turning Web Browsing into a Spyware Trap: https://www.axios.com/2026/10/22/spyware-phones-security-threats

Palo Alto Unit 42 - Pass the Passkey: https://unit42.paloaltonetworks.com/passwordless-authentication-security-risks/

Anthropic Cyber Mission: https://www.anthropic.com/news/anthropic-cyber-mission

OpenAI Daybreak: https://openai.com/index/daybreak-securing-the-world/