Binance's $6.3B Hack, Ivanti KEV Alert, DHS Data Leak

Binance Discloses $6.3 Billion Theft, Possibly the Largest Crypto Heist on Record

Binance disclosed on October 30 that roughly $6.3 billion in cryptocurrency was stolen in what researchers call a potential record crypto heist. The exchange said its initial investigation points to a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawal transactions. Close to $3 billion has been frozen on-chain, deposits have resumed, and withdrawals remain paused during a security revamp. TRM Labs and Chainalysis attribute the theft with high confidence to North Korea's TraderTraitor group. Binance says it will cover all losses from company and SAFU funds. (Help Net Security)

CISA Adds Two Actively Exploited Ivanti Connect Secure Flaws to KEV Catalog

CISA on October 30 added CVE-2026-111357 and CVE-2026-118527, both affecting Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. One is a missing-authentication-for-critical-function flaw; the other involves generation of predictable numbers or identifiers. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation. CISA encourages all organizations to adopt the same risk-based vulnerability management and prioritize remediation of KEV Catalog entries. (CISA)

Hacktivists Leak 41,000 DHS Staff Records, Exposing Undercover Agents

On October 28, a hacktivist group calling itself Department of Peace leaked names, offices, contact details and assignments for more than 41,000 DHS employees, publishing the dataset through Distributed Denial of Secrets. The group says the records came from an Okta single sign-on service used by DHS; Okta disputes that its systems were breached. The leak, named Icepick, includes groups tied to Homeland Security Investigations undercover agents and ICE use-of-force instructors. DHS said it is aware of a potential breach and is working to address the situation. Reuters confirmed personal details for several named employees match other data sources. (Help Net Security)

Poisoned Claude Code Extension Planted SSH Backdoor on Up to 5,000 Cursor Users

A tampered build of Anthropic's Claude Code extension, version 2.1.313, was found on Open VSX and inside Cursor's own VS Code extension marketplace, where it was available for about 11 hours on October 29. The poisoned package added an attacker SSH key to victims' authorized-keys files and opened an outbound tunnel back to the operator's server, giving persistent remote access without requiring any user interaction. Up to 5,000 Cursor users may have been affected; Cursor says it notified them, took the attacker's server offline, rotated keys and rebuilt its marketplace. Removing the extension alone does not remove the backdoor. (Help Net Security)

Active Exploitation Begins Against Patched Oracle E-Business Suite Flaw

Security firm Defused detected exploitation attempts beginning October 27 against CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, affecting EBS versions 12.2.3 to 12.2.15. Oracle patched the flaw in its October 20 update after Horizon3.ai reported it in July. Censys found 2,246 web properties running EBS as of October 28, though it cannot confirm how many remain unpatched. Oracle urges customers to apply patches without delay; Horizon3.ai recommends removing the vulnerable servlet from EBS URL firewall allowlists until patched. (Help Net Security)

Gigamon Names Grant Yacomeni as Chief Information Security Officer

Gigamon appointed Grant Yacomeni as Chief Information Security Officer on October 30, giving him responsibility for information security, product security, cybersecurity, IT operations, and governance, risk and compliance. Yacomeni previously held cybersecurity leadership roles within the US Intelligence Community, including the Department of Defense, where he led enterprise security programs and around-the-clock defensive cyber operations. He also served in intelligence and cybersecurity roles with the Maryland Army National Guard and is a Marine Corps veteran. The move brings more than a decade of national-security-rooted cyber experience to a company whose tools support network visibility. (CXO Spotlight)