A supply chain attack targeting Polymarket traders involved malicious code injected via a compromised third-party website monitoring tool, DebugBear. The malicious JavaScript hijacked logged-in user sessions to siphon funds by selling positions or transferring tokens to attacker-controlled addresses. Polymarket's international platform was affected, resulting in over $2 million in losses, while the US platform remained unaffected. Polymarket halted trading temporarily, removed the malicious script, and pledged to reimburse affected users. DebugBear confirmed the incident and advised users to remove its monitoring snippet.
This content discusses the remastered Zero2Automated beginner malware analysis course and inquiries about updates from the researcher @0verfl0w_. The course offers a redesigned syllabus covering malware reverse engineering fundamentals and practical analysis techniques. It is a learning resource rather than a security threat or vulnerability.
Binance, the largest cryptocurrency exchange, suffered a record $6.3 billion crypto theft on October 29, 2026. The attack likely originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. The attackers exploited multiple blockchains using valid signatures, indicating control over Binance's hot wallet signing system. Blockchain analysts attribute the attack with high confidence to North Korea's elite hacking unit, TraderTraitor. Approximately $3 billion of the stolen assets have been frozen by stablecoin issuers and security councils, while about $2.4 billion remain unfrozen. Binance is cooperating with law enforcement and has pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
The Rust compiler executable (rustc) version 1.99.0 for Windows has been flagged as malicious by multiple antivirus vendors on VirusTotal. This detection appears specific to version 1.99.0, as version 1.99.1 is not flagged. The issue was reproducible with a fresh installation of Rust 1.99.0 via rustup. The SHA256 hash of the flagged binary is FC40F1C8B65095A22A48C111AADC279C26A049B7E4161E8B99FFE3EB23873E86. No further technical details or confirmed exploits are available.
Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.
This article is a personal narrative by a security leader diagnosed with stage-three prostate cancer, drawing parallels between personal health risk management and cybersecurity risk leadership. It emphasizes the human aspect of risk, resilience, and leadership, highlighting the importance of psychological safety, transparency, and support within security teams. The piece advocates for a more human-centered approach to risk management, encouraging open dialogue and acknowledging vulnerabilities without stigma.
Microsoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The recognition highlights Microsoft Defender's autonomous attack disruption and predictive shielding capabilities that contain ransomware and identity attacks within minutes. The platform integrates AI-driven detection and response across endpoints, identities, email, and cloud, enabling near real-time containment of threats. The solution includes agentic AI through Security Copilot, improving alert accuracy and reducing analyst workload. Microsoft Defender's unified portal correlates signals from multiple sources into single incidents, facilitating rapid and effective response. The platform also supports securing local AI agents used by employees, providing visibility and control over their activity. This integrated approach addresses the increasing speed and complexity of ransomware and AI-driven attacks observed between 2025 and 2026.
Google announced Gemini 4 Carbon, an advanced AI model designed to find, exploit, and fix software vulnerabilities more effectively than previous models. It scored highly on multiple cybersecurity benchmarks and is initially available to vetted cyber defenders through Google's Fairwind Program. The model aims to assist defenders in prioritizing vulnerability remediation by assessing exploitability. It outperforms earlier models in secure code generation and patch quality, with improved safety against prompt injection attacks. The model is not yet broadly available and is undergoing further guardrail development before wider release.
The security of US elections is challenged by unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns. Voting machines certified by the Election Assistance Commission (EAC) may remain unpatched for years, increasing the risk of compromise. The air-gapped nature of these machines offers some protection but can be bypassed with physical access. Ballots include human-readable and QR code elements, but voters cannot verify the QR code data scanned for counting, raising trust issues. Influence campaigns aim to undermine public confidence in election outcomes. Experts recommend treating voting machines as part of a broader hostile system and improving transparency and verification methods.
Cisco has open sourced Project Quarry, a neurosymbolic rule language designed to detect AI agent attacks that manifest only across sequences of individually benign actions. Traditional security controls often fail to detect such attacks because they evaluate actions in isolation rather than as connected sequences. Quarry combines machine learning classifiers and rule-based checks to identify suspicious patterns in AI agent behavior over time. It supports runtime guardrails, post-hoc analytics, and incident response, integrating with Cisco's AI Security & Safety Framework. The project aims to become a shared standard for detecting AI-agent threats and to enable defenders worldwide to rapidly develop and share detection rules, countering attackers' use of AI to create sophisticated multi-step attacks.
BAE Systems experienced a cybersecurity incident that disrupted the US federal judiciary's Bankruptcy Noticing Center (BNC) for over two weeks. The disruption halted the flow of bankruptcy court notices starting around October 9, 2026. BAE Systems has since restored the BNC operations and confirmed that no data was extracted and no personally identifiable information (PII) was breached. The cause of the incident and whether it was a cyberattack remain undisclosed. The Judicial Conference declared a Bankruptcy Rules emergency to mitigate the impact of delayed notices. No ransomware or cybercrime group has claimed responsibility for the incident.
A critical zero-day vulnerability (CVE-2026-20127) in Cisco SD-WAN controllers has been exploited by a sophisticated threat actor linked to the Volt Typhoon 'Silent Train' network. The vulnerability allows remote attackers to bypass authentication and gain administrative access to SD-WAN controllers without credentials. Attackers deployed KeyDrift malware to maintain persistent access and steal encryption keys, targeting organizations in sectors such as defense, aerospace, telecommunications, and critical infrastructure. The campaigns have been ongoing since at least late 2025, affecting entities primarily in the United States, with a focus on regions including Hawaii, California, and Texas.
This content discusses the competitive disadvantage faced by defenders in cybersecurity due to adversaries using uncensored, abliterated AI language models that automate reconnaissance, phishing, and exploit development. The post highlights the availability of such uncensored models through Silk Compute, which removes refusal behaviors and content filters, enabling more aggressive and unrestricted AI usage. No specific vulnerability or exploit is described.
4NTL is a browser extension for Chromium-based browsers that enables quick threat intelligence lookups from the right-click menu. It allows users to check IPs, domains, URLs, or file hashes against VirusTotal and AbuseIPDB without leaving the current page. The extension is designed to improve analyst efficiency by reducing the need to copy and paste indicators into separate tabs. It respects user privacy by only querying VirusTotal and AbuseIPDB, never submitting new samples, and keeping API keys local to the browser profile. No active exploitation or vulnerabilities are reported in the extension itself.
A security researcher demonstrated a remote code execution (RCE) exploit chain against a specific WordPress Docker image dated 21 October 2026. The exploit leverages the WordPress pingback.ping XML-RPC method to achieve unauthenticated Bash shell access. This proof-of-concept targets one exact vulnerable Docker image digest and does not affect the latest official WordPress builds or WordPress core itself.
This is an advance notification from Cisco regarding the publication of security advisories scheduled for November 4, 2026. The notification provides references to Cisco's security vulnerability disclosure policies and instructions for obtaining fixed software and security information. No specific vulnerabilities, impacts, or affected versions are detailed in this notification.
Upwind Security announced a $400 million Series C funding round at a $3.8 billion valuation, significantly increasing its total funding to over $800 million. The company provides a runtime-native cloud security platform that enhances visibility into networks, APIs, and data flows to help organizations identify and remediate security risks. This announcement follows reports of acquisition interest from companies including Datadog, though some reports about acquisition offers remain unconfirmed.
A China-linked threat actor exploited chained vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300, Fragnesia) to gain root access to firewalls of a US government-affiliated organization. The attackers used an internet asset search engine to identify vulnerable firewalls, successfully compromised 25 devices, and deployed persistent PHP root webshells on 24 of them. They further used a reverse SSH tunnel to access an internal firewall management server, extracting sensitive configurations and credentials, and attempted Active Directory backdoor creation. The attacks targeted firewalls in the US, Japan, Taiwan, and South Korea, indicating a strategic focus on these regions. The incident highlights a sophisticated multi-stage exploitation chain with significant impact on network security and domain control.