Cybersecurity News Briefing: October 31, 2026
Saturday, October 31, 2026 · 15 stories · 2 exploited vulnerabilities
Today's briefing highlights a wave of critical remote‑execution flaws, including a Linux kernel exploit for Multipath TCP, a TeamViewer integer overflow (CVE‑2026‑111585), and an active Drupal Commerce Core authorization bypass (CVE‑2026‑118539). It also covers the record $6.3 billion Binance theft linked to North Korean actors and emerging threats to AI‑enhanced IDEs and credential‑based extortion. Readers should prioritize applying available patches and verifying that privileged accounts are secured.
Top Stories
- CriticalVulnerabilityGlobalBleepingComputer
Critical Linux Kernel Vulnerability Enables Remote Root on Multipath TCP Servers
Researchers at Anthropic have created an exploit for a critical Linux kernel flaw that permits unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners. The vulnerability grants remote root access without requiring credentials. No mitigation information was provided.
Why it matters: Administrators of MPTCP services should apply kernel patches or mitigate to block remote code execution.
- CriticalData BreachGlobalInfosecurity Magazine
Binance Suffers Record $6.3 Billion Cryptocurrency Heist Attributed to North Korean Hackers
Binance experienced a cryptocurrency theft valued at $6.3 billion, marking the largest cryptocurrency heist on record, and analysts have linked the attack to an elite hacking unit associated with North Korea. The breach resulted in substantial loss of digital assets. No further response was detailed.
Why it matters: Crypto exchanges should strengthen authentication and monitoring to defend against nation-state cyber-theft.
- CriticalVulnerabilityGlobalSecurityWeek
TeamViewer Integer Overflow (CVE-2026-111585) Could Enable Remote Code Execution
An integer overflow identified as CVE-2026-111585 in TeamViewer may allow a malicious host to execute arbitrary code on the viewer’s system. Exploitation could let attackers take control of machines used by support technicians. No remediation status was provided.
Why it matters: Patch or mitigate the vulnerability to prevent unauthorized remote access via support sessions.
- CriticalVulnerabilityGlobalThe Hacker News
Active Exploitation of Drupal Commerce Core Authorization Bypass (CVE-2026-118539)
Drupal reports that threat actors are exploiting a highly critical authorization bypass flaw in its Commerce Core component, identified as CVE-2026-118539. The vulnerability affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. No mitigation details were provided.
Why it matters: Organizations using Drupal Commerce should apply patches or mitigations to block unauthorized access to e-commerce functions.
- CriticalData BreachGlobalThe Register
Binance Halts Trading After Compromised Engineer Laptop Enables Unauthorized Withdrawals
Binance halted all trading, deposits and withdrawals after discovering that an attacker accessed a service container via a compromised DevOps engineer’s laptop, enabling unauthorized withdrawal transactions. The exchange froze billions of dollars in assets, warned customers of scams, and pledged to cover any losses while investigations continue. The estimated amount at risk was later raised.
Why it matters: Protect privileged accounts and workstations to prevent large-scale financial theft.
- HighMalwareGlobalDark Reading
Trojanized Claude Code Extension Targets Cursor IDE, Underscoring AI-IDE Security Risks
Two significant security issues were reported on the same day affecting Cursor’s integrated development environment, including a trojanized version of the Claude Code extension that introduced malicious functionality. The incidents demonstrate the potential threats posed by compromised AI-powered IDE extensions. No remediation status was noted.
Why it matters: Developers should verify extension integrity and employ security controls when integrating AI tools into development environments.
- HighThreat IntelligenceGlobalThe Register
AI-Assisted Extortion Group Leverages Stolen Credentials, Leaves Own Server Exposed
A criminal group spent thousands on AI services to support extortion attacks targeting 23 organizations in 14 countries. The operators combined AI-generated tools with stolen credentials, relying on weak or compromised logins and using RDP scanning and FortiGate SSL-VPN credential stuffing, while leaving their own server exposed with methods visible. No vulnerability exploitation was observed.
Why it matters: Strengthen credential hygiene and monitor for AI-facilitated extortion attempts.
- HighData BreachGlobalThe Record
Fashion Retailer Resolve Discloses Hack Exposing Customer Payment Card Numbers
Resolve, a fashion retailer targeting Millennial and Generation Z consumers, reported that a recent cyberattack resulted in the theft of customer payment card information. The breach exposed card numbers of affected shoppers. No further details on scope or response were provided.
Why it matters: Retailers must secure payment data and monitor for unauthorized access to protect cardholder information.
- HighMalwareEuropeThe Register
Malicious Claude Code Extension on Cursor Marketplace Contained Persistent SSH Backdoor
Anthropic stated that a tampered copy of its Claude Code extension was uploaded to Cursor’s marketplace by a malicious actor, not by Anthropic, and that the compromised version infected up to 5,000 developers. The extension, version 2.1.313, was available for roughly eleven hours and contained a persistent SSH backdoor that gathered host information and attempted a reverse tunnel. Anthropic’s official channels remain unaffected.
Why it matters: Verify the provenance of IDE extensions and monitor for unauthorized code that could provide persistent remote access.
- MediumThreat IntelligenceGlobalBleepingComputer
Flaws in SS7 and Diameter Signaling Allow Phone Tracking and Call Interception
Vulnerabilities in the SS7 and Diameter signaling protocols can be exploited to locate phones, intercept calls and SMS verification codes, and impersonate subscribers without compromising the devices themselves. Cape outlines how these attacks exploit inter-network trust and offers a security-focused mobile service to defend against them. No incident data was provided.
Why it matters: Mobile operators should implement signaling security measures to prevent unauthorized tracking and interception.
- MediumVulnerabilityEuropeHelp Net Security
Bitdefender Report Finds Smart TVs and Plugs Lead IoT Vulnerability Findings
Bitdefender’s 2026 IoT Security Landscape Report, analyzing over ten million home routers, identified smart televisions and connected plugs as the top device families with recorded security weaknesses, accounting for roughly 22% each of observed vulnerabilities. Many televisions and plugs contain unpatched flaws that could be exploited. No remediation status was noted.
Why it matters: Consumers and businesses should ensure smart TVs and plugs receive firmware updates or consider network segmentation to reduce risk.
- InformationalPolicy & RegulationGlobalThe Record
DOJ Calls for Consumer Privacy Ombudsman to Oversee Character.AI Data Sales
The Department of Justice’s Executive Office for U.S. Trustees stated that a consumer privacy ombudsman should be appointed to guide the court on how to regulate the sale of data derived from Character.AI chats. The statement highlights concerns about how such data could be sold and under what terms. No further action was reported.
Why it matters: Organizations handling AI conversation data should consider privacy oversight mechanisms.
- InformationalPolicy & RegulationGlobalDark Reading
Operation Blackout Dismantles Scam Centers, Threat Intel Expert Highlights Success
A recent law-enforcement operation named Operation Blackout successfully dismantled multiple harmful scam centers, according to a threat-intelligence expert who discussed the operation’s outcomes and advocated for continued similar actions. No further details on the scope were given.
Why it matters: Ongoing law-enforcement actions against scams can reduce fraud threats and protect consumers.
- InformationalThreat IntelligenceGlobalSecurityWeek
Multiple Security Issues Highlighted Including UEFI Flaw and Cloudflare AI Leak
SecurityWeek highlighted several recent security topics, including a dispute over an Anthropic breach, a UEFI vulnerability affecting many servers, and a Cloudflare AI data leak. Additional items mentioned were potential Iranian interest in military freezer hacks, a breach at Copenhagen University, and AI-powered malware. No further details were provided.
Why it matters: Awareness of varied threats helps organizations prioritize defenses.
- InformationalAI SecurityEuropeHelp Net Security
Bedrock Data Introduces AI-Assisted Workflow to Remediate Data Exposure
Bedrock Data announced an AI-assisted remediation solution that identifies owners of exposed datasets, creates tickets in existing Jira or ServiceNow workflows, and validates that the exposure is resolved, reopening tickets if needed. The approach federates remediation across the enterprise. No further status was indicated.
Why it matters: Automating data exposure remediation can improve response speed and ensure issues are fully resolved.
Newly Added Known Exploited Vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. If you run any of these products, patch or mitigate first.
| CVE | Product | Vulnerability | Ransomware use |
|---|---|---|---|
| CVE-2026-118527 | Ivanti Connect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Unknown |
| CVE-2026-111357 | Ivanti Connect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Unknown |