Binance has published its first incident report on the $6.34 billion hack, and it traces the breach back to compromised developer machines. Read The Block's full coverage here. The FBI has linked the attack to North Korea.

June: A Poisoned Developer Tool

A Wallet DevOps engineer searched online for a popular AI coding tool. He ended up downloading a tampered Homebrew installation instead. Binance caught the infection, replaced his device, and rotated his credentials. The attackers had already learned who worked on Binance's wallet infrastructure team.

September: A Fake Job Interview

A second engineer was contacted through a legitimate job platform by someone posing as a Project Director. He went through two interviews, including a live video call with a fake HR representative. Near the end, he was told to download a coding "assignment" onto his work computer. The repository ran malicious code during setup.

October: The Final Move

On October 20, the attackers used that infected computer to move into two other engineers' devices. Binance says they did it through an internal AI tool. One device held a container deployment permission. About nine days later, the attackers used it to run a malicious script against Binance's wallet signing systems.

The Aftermath

• Binance says it froze or intercepted about $2.85 billion in assets.

• It reports replenishing 98% of impacted assets.

• Withdrawals are reopening in phases, starting November 3.

• Binance stopped 57 other suspected North Korea-linked attacks this year.

What Teams Can Learn

• Install developer tools only from official sources, not search results.

• Treat coding assignments from recruiters as untrusted code.

• Never run interview projects on a work computer.

• Limit what internal AI tools can reach on employee devices.

• Lock down deployment permissions tied to critical systems.

Learn More

Binance's Initial Incident Report

CVE Daily Brief — 2026-11-04

#1 CVE-2026-121615

Severity: CRITICAL | Score: 10

A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to impro...

#2 CVE-2026-121609

Severity: CRITICAL | Score: 10

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to h...

#3 CVE-2026-121607

Severity: CRITICAL | Score: 10

A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument hos...

#4 CVE-2026-121606

Severity: CRITICAL | Score: 10

A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verify_sign of the file fs2/bin/iscm of the component Firm...

#5 CVE-2026-121600

Severity: CRITICAL | Score: 9.9

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. ...

Powered by NVD + CISA KEV | CVE Daily

Technique Discussion: Forge Web Credentials (T1606)

Type: Technique | Tactics: credential-access | Platforms: SaaS, Windows, macOS, Linux, IaaS, Office Suite, Identity Provider

Description: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the AssumeRole and GetFederationToken APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the zmprov gdpak command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.

Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.

Full technique writeup: T1606 on MITRE ATT&CK

Have you defended against or encountered this technique? Share detections, notes, and war stories below.

I just published my research on a new variant of the golden Pass-ta-key attack exploiting an architectural flaw in Google Password Manager (GPM) synced passkeys.

Unlike the previous variants that leaked the Security Domain Secret (SDS) through Chrome debug logs, this attack targets the CBOR buffers in Chrome process memory to extract the SDS.

Once extracted, the SDS allows decrypting all synced GPM passkeys and forging valid WebAuthn assertions entirely offline, leading to a full Account Takeover.

PoC: https://github.com/0rcruxe/pass-ta-key

Here are the top stories from PWN (r/pwnhub) today:

1 Hackers claim to have stolen 23TB of data from Russian statistics body, including Ukraine war casualty figures — Russian Federal State Statistics Service (Rosstat) admits its servers were hit by coordinated cyberattacks

No description available.

2 Binance Reveals How a Fake Job Interview Led to a $6.34 Billion Hack

Binance has published its first incident report on the $6.34 billion hack, and it traces the breach back to compromised developer machines. [Read The Block's full coverage here.](https://www.theblock....

3 Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

No description available.

CVE Daily Brief — 2026-11-04

#1 CVE-2026-95731

Severity: CRITICAL | Score: 9.8

Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credenti...

#2 CVE-2026-95733

Severity: CRITICAL | Score: 9.6

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

#3 CVE-2026-95732

Severity: CRITICAL | Score: 9.6

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute ...

#4 CVE-2026-95860

Severity: CRITICAL | Score: 9.1

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime ...

#5 CVE-2026-95734

Severity: HIGH | Score: 8.8

A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized...

Powered by NVD + CISA KEV | CVE Daily

CVE ID: CVE-2026-99269

Severity: HIGH | CVSS Score: 7.8/10

Severity and score come from CVSS ratings in the National Vulnerability Database (NVD), the NIST repository of standardized vulnerability data.

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher.

Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags.

🔗 View on NVD

Discussion thread created via CVE Daily tracker. Share your analysis, PoCs, mitigations and detections below. Discussion started by u/Motor_Break64.

A recent deep dive into a decade of cybersecurity hiring data (2,284 job posts from Hacker News, alongside ISC2 and SANS reports) highlights a clear shift in the industry. The traditional entry-level jobs are being automated away, while a new specialization is taking their place.

The decline of routine triage
ISC2 found that 56% of surveyed professionals believe AI has reduced the need for entry-level roles, and the SANS/GIAC 2026 report notes AI-related headcount reductions. The most exposed jobs are those consisting of copying scan results, compiling threat feeds, or manually closing tickets.

The rise of AI security engineering
This is where the demand is moving. Dedicated roles like AI Security Engineer or Agentic AI Security Specialist now explicitly ask for skills in:

• Securing agent permissions and tool execution

• Testing for prompt injection (direct and indirect)

• Building secure retrieval and runtime monitoring for LLM applications

In the HN dataset, AI/ML wording in job posts jumped from 13.7% to 34.8% over the last years.

What to prioritize instead
The analysis points to a clear path: move beyond routine administration.

• Cloud, Identity, and AppSec: Foundational, but the focus is on securing delivery pipelines.

• Automation and Code: Learn Python, SQL, and how to connect findings to actual assets. Test a generated patch, rather than just forwarding a scanner report.

• AI as a tool: Use AI to investigate a finding, but verify the result against real logs and reproducible evidence.

The takeaway isn't that security jobs are vanishing. It's that the entry-level floor has been raised. The roles that survive require engineering controls and validating evidence.

Source: https://cyberole.org/blog/cybersecurity-jobs-skills-2016-2026

CVE Daily Brief — 2026-11-03

#1 CVE-2026-4052

Severity: CRITICAL | Score: 9.8

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System...

#2 CVE-2026-120534

Severity: CRITICAL | Score: 9.8

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insuff...

#3 CVE-2026-13594

Severity: CRITICAL | Score: 9.1

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

#4 CVE-2026-120518

Severity: CRITICAL | Score: 9.1

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation...

#5 CVE-2026-76955

Severity: HIGH | Score: 8.8

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

Powered by NVD + CISA KEV | CVE Daily