Daily Cybersecurity Briefing — November 2, 2026

Daily Cybersecurity News Briefing

Monday, November 2, 2026

🔴 ACTIVELY EXPLOITED VULNERABILITIES

• CVE-2026-97229 | GitLab | CVSS 10.0 | Remote Code Execution — Critical RCE in GitLab's CI/CD pipeline added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers are actively exploiting this to compromise DevOps pipelines and execute arbitrary commands. FCEB agencies must patch immediately per CISA's binding directive. (Source: The Hacker News, CISO Platform)

• CVE-2026-76418 | Cisco ASA/FTD | CVSS 8.6 | VPN Denial of Service — Attackers are sending crafted packets to crash Cisco ASA and Firepower Threat Defense (FTD) firewall appliances, causing complete loss of VPN gateway availability. Added to CISA KEV. FCEB agencies must remediate by CISA deadline. (Source: CISO Platform, The Hacker News)

• Ivanti Connect Secure — Two additional zero-days patched as part of a chained exploit that previously granted root access to fully patched Ivanti VPN appliances. The full chain enables complete device takeover even on patched systems. Ivanti urges immediate factory reset and re-imaging before applying the latest patches. (Source: SecurityWeek, BleepingComputer)

💀 BR3ACHES

• Binance — $6.3 Billion (Record-Breaking) | FBI formally attributed the largest cryptocurrency theft in history to North Korea's TraderTraitor threat group. Attackers used sophisticated supply chain compromise and social engineering against Binance infrastructure. A secondary wave of phishing scams is now actively targeting anxious Binance customers. (Source: The Hacker News, Help Net Security, BleepingComputer, PBS, Al Jazeera)

• Polymarket — $2.7 Million | Prediction market platform suffered a breach with approximately $2.7M drained from user wallets in October. Investigation indicates no smart contract vulnerability was exploited; attackers targeted platform-level access controls and user account credentials. (Source: CybersecurityNews, DesignRush)

• Hacktober 2026 Supply Chain Wave — October was dubbed 'Hacktober' after a coordinated wave of supply chain and platform compromises: PHP source repository, Node.js package registry, LiteLLM AI gateway, and a Pentagon contractor were all breached within a 31-day window. Full incident review published by SafeDep. (Source: CybersecurityNews, GBHackers, SafeDep, CyberPress)

🎯 THREATS & POLICY

• FBI / North Korea Attribution — The FBI formally named North Korea's TraderTraitor as the threat actor behind the record $6.3 billion Binance heist, the largest single crypto theft ever recorded. DPRK-linked groups are now estimated to have stolen over $10 billion in cryptocurrency over the past decade to fund state weapons programs. (Source: The Hacker News, PBS, Al Jazeera)

• Ransomware Surge — October 2026 logged 1,127 ransomware claims, a 25.8% month-over-month increase. Top actors: N0n (rapidly rising new entrant), Qilin, and The Gentlemen. Most targeted sectors: Manufacturing, Healthcare, and Education globally. (Source: tech-insider.org, QUE.com, Yehey.com)

• Emergency Alert App Hijacking (Ukraine/Russia) — Threat actors compromised emergency alert mobile applications in both Ukraine and Russia, pushing fake nuclear attack warnings to civilian populations. The incident underscores the psychological warfare dimension of modern cyberattacks against critical public safety notification infrastructure. (Source: GBHackers)

☁️ CLOUD & SAAS SECURITY

• OAuth Worm Attacks on SaaS — Security researchers detailed a new attack pattern using malicious OAuth applications ('OAuth worms') that silently propagate through SaaS ecosystems, bypassing MFA by abusing delegated OAuth permissions. Once a single account grants access, the worm spreads to all connected apps without triggering additional MFA challenges. Organizations should audit and immediately revoke unused third-party OAuth app grants. (Source: Security Boulevard)

• LiteLLM AI Gateway Supply Chain Compromise — The widely-used LiteLLM open-source AI gateway was compromised during October's Hacktober wave, creating downstream supply chain risk for any enterprise using it to orchestrate LLM pipelines or build agentic AI workflows. Organizations should immediately audit LiteLLM deployments, update to the latest patched release, and review access logs for IOCs. (Source: SafeDep, CybersecurityNews)

🔐 IDENTITY & AUTHENTICATION

• MFA Bypass Findings (LevelBlue Q3 2026) — LevelBlue's Q3 2026 threat research found significant MFA bypass activity targeting Managed Service Providers (MSPs), leveraging session token theft, Adversary-in-the-Middle (AiTM) phishing proxies, and stolen authentication cookies. SMS- and TOTP-based MFA provide insufficient protection against current attacker toolkits. FIDO2/passkeys are strongly recommended. (Source: Channel Insider)

• ChatGPT Phishing Kit with Real-Time OTP Theft — A new sophisticated phishing kit impersonating ChatGPT uses rotating WordPress-hosted sites to steal payment card details and one-time passwords (OTPs) in real time via AiTM proxying. The rotating infrastructure defeats static URL blocklisting. Targets appear to be ChatGPT Plus/premium subscribers. (Source: GBHackers)

📱 MOBILE SECURITY

• Unpatchable iPhone Hardware Flaws — Security researchers disclosed hardware-level vulnerabilities in older iPhone generations that allow attackers with physical or near-field access to extract cryptocurrency wallet seed/recovery phrases directly from device memory. Because the vulnerabilities reside in hardware, no software patch is possible for affected device generations. Affected users must migrate crypto assets to newer devices or dedicated hardware wallets immediately. (Source: GBHackers, Macworld)

• Android Threat Surge (Q3 2026) — Kaspersky's Android security report and AV-Comparatives' Mobile Security Review 2026 highlight growing threats: NFC skimming attacks, fake app campaigns on third-party stores, and Darksword/Coruna exploit kits targeting crypto wallets. Banking trojans and spyware disguised as productivity apps remain the top Android malware categories. (Source: Kaspersky, AV-Comparatives)

🏭 ICS/OT/IoT SECURITY

• Supermarket Refrigeration Cyberattack (Sweden & Belgium) — Hackers remotely compromised refrigeration control systems at supermarkets across Sweden and Belgium, raising freezer temperatures to 50–55°C and spoiling food inventory. The attack pattern mirrors earlier ICS/OT incidents in France, suggesting a coordinated European campaign targeting internet-exposed commercial refrigeration control systems. Public health authorities are investigating food safety impacts. Operators of internet-facing BMS/SCADA-controlled refrigeration systems should assess and restrict external access immediately. (Source: GBHackers, Cyprus Mail, CP24, TrendingTopics.eu, CyberPress)

• US Army OT Cybersecurity Initiative — The US Army announced advances in OT (Operational Technology) cybersecurity through a Risk Management Center-led program focusing on zero trust architecture and operational continuity for military-connected industrial control systems and defense industrial base environments. (Source: Industrial Cyber)

• CISA/FBI ICS Integrators Advisory & NIST OT Security Guide — CISA and the FBI jointly released updated security guidance for ICS/OT system integrators covering supply chain security, remote access hardening, and network segmentation best practices. Concurrently, NIST published a draft updated NIST SP 800-82 Guide to OT Security for public comment, addressing modern industrial threat scenarios. (Source: SecurityWeek)

🔬 RESEARCH & TOOLS

• Google Gemini 4 Carbon for Security Defenders — Google announced Gemini 4 Carbon with early access prioritized for cybersecurity defenders, targeting threat detection, malware classification, and automated incident triage. The model is purpose-built with defender use cases as its primary design criteria. (Source: EdTech Innovation Hub)

• Anthropic Cyber Mission — Anthropic officially announced its Cyber Mission initiative, committing AI research and engineering resources to defensive cybersecurity — including automated vulnerability discovery, attack surface analysis, and security tooling for enterprise and government defenders. (Source: Anthropic)

• OWASP Gen AI Security Project Update — OWASP updated its Gen AI Security Project (genai.owasp.org) with revised guidance on securing LLM applications: prompt injection defenses, RAG pipeline data exfiltration controls, agentic AI containment strategies, and refreshed Top 10 for LLM Applications list. Required reading for security teams integrating AI into enterprise workflows. (Source: OWASP)

🤖 AI/ML SECURITY

• 'Skynet' Autonomous LLMjacking Agent — Threat researchers disclosed a novel autonomous attack agent named 'Skynet' that scans for and hijacks exposed AI model endpoints (Ollama instances, unprotected LLM APIs, open cloud-hosted models) and uses them to execute multi-step attack campaigns with up to 100,000 autonomous steps — zero human intervention required. Capabilities include GPU compute theft (cryptomining), lateral movement, and using hijacked models to generate phishing content and attack scripts. This represents a paradigm shift to fully agentic cyberattacks. Organizations must immediately audit internet-exposed AI endpoints. (Source: security.com, Computing.co.uk, The Decoder)

• AI Jailbreak Attacks Surging — LLM jailbreak attempts are surging across enterprises in 2026, and most SOC teams lack tooling to detect or respond to prompt injection and model abuse in real time. Research from Axis Intelligence shows significant attack success rates persist even against current frontier models. Real-time monitoring of AI model inputs and outputs is now being recommended as a baseline enterprise security control. (Source: Techvernia, Axis Intelligence)

• LiteLLM Supply Chain Attack (AI Infrastructure Risk) — The October compromise of the widely-deployed LiteLLM AI gateway highlights the under-monitored supply chain attack surface in AI infrastructure. Any enterprise using LiteLLM for multi-model routing, agentic pipeline orchestration, or RAG workflows should urgently update to the latest patched release and audit for indicators of compromise. (Source: SafeDep, CybersecurityNews)

📚 Sources

• FBI Links North Korea's TraderTraitor to $6.43B Binance Crypto Heist — The Hacker News: https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html

• FBI pins $6.3B Binance crypto heist on North Korea — Help Net Security: https://www.helpnetsecurity.com/2026/11/02/fbi-north-korea-binance-hack/

• FBI links $6.3B Binance crypto heist to North Korean hackers — BleepingComputer: https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/

• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV — The Hacker News: https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

• GitLab CVE-2026-97229 Exploited: CI/CD RCE Added to CISA KEV — CISO Platform: https://www.cisoplatform.com/profiles/blogs/gitlab-cve-2026-97229-exploited-cisa-kev

• CVE-2026-76418: Exploited Cisco ASA/FTD VPN Flaw — CISO Platform: https://www.cisoplatform.com/profiles/blogs/cve-2026-76418-cisco-asa-ftd-vpn-exploit

• Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain — SecurityWeek: https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/

• Ivanti patches two more Connect Secure zero-days chained in attacks — BleepingComputer: https://bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks

• Ransomware Attacks October 2026: 1,127 Claims, +25.8% — tech-insider.org: https://tech-insider.org/ransomware-attacks-october-2026-1127-claims-n0n-gentlemen-qilin-2026/

• Hacktober – Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon — CybersecurityNews: https://cybersecuritynews.com/hacktober-cyberattack-wave/

• Hackers Target Supermarket Refrigeration Systems Across Sweden — GBHackers: https://gbhackers.com/hackers-target-supermarket-refrigeration-systems-across-sweden/

• Sweden supermarket freezers hit by suspected cyberattack — Cyprus Mail: https://cyprus-mail.com/2026/11/02/suspected-cyberattack-sends-swedish-supermarket-freezers-to-50c

• Unpatchable Hardware Flaws in Older iPhones Allow Crypto Wallet Theft — GBHackers: https://gbhackers.com/unpatchable-hardware-flaws-in-older-iphones

• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models — security.com: https://www.security.com/threat-intelligence/ai-llmjacking-skynet

• How Fake OAuth Apps & Shadow SaaS Bypass MFA — Security Boulevard: https://securityboulevard.com/2026/08/how-fake-oauth-apps-shadow-saas-bypass-mfa/

• LevelBlue MFA Bypass Findings Put MSP Security to Test — Channel Insider: https://www.channelinsider.com/security/levelblue-q3-2026-mfa-bypass-data-theft/

• Polymarket Hacked — CybersecurityNews: https://cybersecuritynews.com/polymarket-hacked/

• OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators — SecurityWeek: https://www.securityweek.com/ot-security-guidance-nist-drafts-updated-guide-cisa-fbi-advise-on-ics-integrators/

• ChatGPT Phishing Kit Uses Rotating WordPress Websites — GBHackers: https://gbhackers.com/chatgpt-phishing-kit/

• Hackers Target Emergency Alert Apps in Ukraine and Russia — GBHackers: https://gbhackers.com/hackers-target-emergency-alert-apps-in-ukraine-and-russia/

• Introducing the Anthropic Cyber Mission — Anthropic: https://www.anthropic.com/news/anthropic-cyber-mission

• OWASP Gen AI Security Project — https://genai.owasp.org/

• October 2026 Security Incident Review (Hacktober) — SafeDep: https://safedep.io/october-2026-security-incident-review/

• AI Agent Uses 'Skynet Mode' to Hijack Models for Cyberattacks — Computing.co.uk: https://www.computing.co.uk/news/2026/ai/ai-agent-uses-skynet-mode

• This Week in Security — November 1, 2026 Edition: https://this.weekinsecurity.com/this-week-in-security-november-1-2026-edition/

• Daily OT Security News: November 01, 2026 — Viakoo: https://www.viakoo.com/blog/daily-ot-security-news-november-01-2026/