Here are today’s top cybersecurity stories for Friday, October 30, 2026.
Binance Reports $6.3 Billion Theft and Analysts Point to North Korea
Binance said a security incident affected about $6.3 billion in assets. The exchange traced the theft to a compromised DevOps engineer laptop and suspended deposits and withdrawals. TRM Labs and Chainalysis attribute the attack to North Korea with high confidence, and stablecoin issuers and partners froze about $2.67 billion.
Trojanized Claude Code Extension Reaches Cursor Marketplace
Version 2.1.313 of the anthropic.claude-code extension added an attacker SSH key, opened a reverse tunnel, and installed persistence on developer machines. Cursor says at most 5,000 users installed the build on October 29. Anthropic published clean version 2.1.314 and Cursor briefly shut down its marketplace to remove the bad build.
Drupal Warns of Exploited Commerce Core Flaw CVE-2026-118539
The missing authorization flaw affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal rates the advisory highly critical and says attackers are exploiting it in the wild. Fixes arrive in Commerce Core 3.3.13 and 8.x-2.41.
CISA Adds Exploited GitLab and Cisco Flaws to the KEV Catalog
CISA added CVE-2026-97229, a CVSS 10.0 GitLab remote code execution flaw, and CVE-2026-76418, a CVSS 8.6 Cisco ASA and FTD denial-of-service flaw. Federal civilian agencies must apply fixes by November 1, 2026. GitLab released versions 19.4.2, 19.3.5, and 19.2.8, and Shadowserver tracks nearly 2,800 exposed GitLab Community Edition instances.
The Hacker News and BleepingComputer
Trezor Investigates Suspected Implant in Safe 5 Wallet From a Reseller
Trezor received a report of an extra circuit board with a cellular module inside a Safe 5 sold by reseller CryptoBilis in Southeast Asia. The company has not yet examined the device and knows of no stolen funds. Trezor stopped sales through CryptoBilis on October 9 and advises owners of devices bought through it since March 2026 to move funds to a new wallet.
Syrian Electronic Army Hacker Gets 42 Months for Fake AP Tweet
Ahmad Umar Agha, known as “Th3Pr0,” received a 42-month prison sentence in a US federal court. The Justice Department says he hijacked the Associated Press Twitter account on April 23, 2013, and posted a false report of White House explosions, which wiped about $136 billion off the Dow Jones Industrial Average. Prosecutors say he hacked about 47 media outlets, businesses, and government bodies.
Cisco Talos: Fake IT Help Desk Callers Succeed With Basic Employee Details
Talos Incident Response found attackers posed as IT help desk staff by phone, email, and Microsoft Teams, then talked victims into remote access sessions. Ransomware made up 27% of Talos IR cases in the third quarter of 2026, and phishing led initial access at 37%. Insufficient logging appeared in more than 40% of engagements.
Bitdefender Report: Smart TVs and Plugs Lead Home Device Weaknesses
Bitdefender analyzed about 10.4 million protected home routers from January to September. Televisions made up 22.7% of vulnerability observations and smart plugs 22.4%. Automated port scans made up 90.1% of attack-category events, about 4.85 billion attempts.
Stay tuned for today’s in-depth analysis posts.
