AI pulled the trigger on both sides this week

Critical Wave: F5, Citrix, GitLab, Atlassian, Cisco, SAP, Check Point, and PHP All Actively Exploited. CERT-EU issued a barrage of advisories this week covering critical flaws across enterprise infrastructure. F5 BIG-IP APM (CVE-2026-94127, CVSS 9.8) has confirmed active exploitation with unauthenticated RCE; Citrix NetScaler ADC and Gateway have two critical unauthenticated RCE flaws under active exploitation; GitLab CE/EE carries a CVSS 10.0 CI/CD RCE (CVE-2026-97229) now on CISA's KEV; Atlassian Data Center products including Confluence, Bitbucket, and Jira have an arbitrary file access flaw (CVE-2026-21589); Cisco Secure Email Gateway allows unauthenticated root-level file writes (CVE-2026-76519); SAP patched two unauthenticated RCE bugs in Kernel and NetWeaver; and Check Point VPN appliances have two CVSS 9.8 RCE vulnerabilities.

PHP2Shell Chained with Kernel Bug to Root Palo Alto Firewalls. China-linked attackers have chained PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation bug to achieve root access on at least 25 Palo Alto Networks PAN-OS firewalls. With over 22.6 million exposed PHP instances potentially in scope, the blast radius is significant even though WordPress exploitation attempts have largely failed. Learn more

Ivanti Connect Secure Exploit Chain Added to CISA KEV. CISA added multiple Ivanti Connect Secure flaws to its KEV catalog after threat actor UTA0576 chained authentication bypass, RCE, and privilege escalation vulnerabilities to gain unauthenticated root access and harvest Active Directory credentials. Volexity documented the exploit chain in detail.

WordPress RCE Draws 63,000 Attack Attempts in 24 Hours. A race-condition RCE in WordPress Core versions 4.7 through 7.1.3 (CVSS 8.1) attracted nearly 63,000 exploitation attempts within a single day of the patch release. WordPress 7.1.4 addresses the flaw; administrators should treat this as an emergency upgrade given the attack velocity.

Key Takeaway

Prioritize emergency patching this week across F5 BIG-IP, Citrix NetScaler, GitLab, Cisco SEG, PHP installations, and WordPress; cross-reference your environment against the full CERT-EU advisory list and CISA KEV updates issued October 30 to 31.

Binance Loses $6.3B in History's Largest Crypto Theft, Attributed to North Korea. A single compromised DevOps engineer's laptop gave attackers access to a service container, enabling unauthorized withdrawals that total an estimated $6.3 billion. Blockchain analysts attribute the attack to North Korean threat actors. Binance has stated customer funds will be covered by its SAFU reserve, and investigation with law enforcement is ongoing. Learn more

Chainalysis Breached via Offensive Agentic Techniques, Customer Identity Data Exposed. Blockchain analytics firm Chainalysis confirmed an intrusion where attackers used agentic AI techniques to access internal tools, exposing customer names, email addresses, user IDs, and organizational roles. Sensitive investigation content and authentication credentials were not accessed, but the exposed data creates a phishing surface for follow-on attacks against high-value crypto investigation targets. Learn more

Florida Financial Aid Site Breach Exposes Social Security Numbers for 4.9 Million People. Florida's Department of Education disclosed a breach of its Student Financial Aid website discovered October 19, exposing SSNs and addresses for nearly 5 million individuals. The site has been taken offline while law enforcement investigates; affected individuals should place credit freezes immediately.

Polymarket Loses $2.7M in Third-Party Script Supply Chain Attack. Attackers compromised DebugBear's third-party performance monitoring script running on Polymarket's platform, hijacking 710 active user sessions to execute unauthorized fund transfers and liquidations during a brief window on October 29. Polymarket halted trading, purged the malicious code, and committed to $3.9M in total refunds, with 95% of wallets reimbursed within 24 hours.

Key Takeaway

Audit all third-party scripts loaded by your web applications, enforce subresource integrity checks, and review developer endpoint security policies treating developer machines as critical infrastructure.

Malicious Claude Code Extension Planted SSH Backdoors on Up to 5,000 Cursor Users. Trojanized versions of the Claude Code extension (builds 2.1.312 and 2.1.313) were available on the Cursor IDE marketplace for approximately 11 hours on October 29, targeting Windows and macOS developers. The malware collected host information, added an attacker-controlled SSH public key named 'svc-telemetry,' and attempted to establish persistent reverse SSH tunnels. Coding errors in the backdoor limited its success rate, but up to 5,000 installs were recorded. Learn more

North Korean DeceptiveDevelopment Group Poisons GitHub and Package Registries. Between April and September 2026, the North Korea-aligned DeceptiveDevelopment group escalated from fake job interview lures to stealing developer Git credentials and SSH keys to inject malware directly into trusted repositories on GitHub, npm, PyPI, Go, and Packagist. The group rewrites commit history to hide changes and distributes OmniStealer and DEV#POPPER RAT to downstream users. Blockchain-based C2 infrastructure is used to evade takedown. Learn more

Trezor Warns of Hardware Implant in Safe 5 Wallet Sold by Compromised Reseller. Trezor received credible reports of an extra circuit board with a cellular module embedded in a Safe 5 hardware wallet purchased from reseller CryptoBilis in Southeast Asia. The implant can read screen data including recovery phrases and exfiltrate them over mobile networks. Trezor halted CryptoBilis sales and urged fund migration; a parallel Ledger compromise through the same reseller was also reported. Learn more

GNU Savannah Flaw Could Have Backdoored Bash. An AI-assisted audit uncovered a critical vulnerability in GNU Savannah that allowed arbitrary code execution via a crafted email address, granting root server access and push rights to the Bash repository. A successful attacker could have injected malicious code into Bash itself, creating a cascading supply chain risk across virtually all Linux systems.

Key Takeaway

Verify extension integrity before installation in AI IDE marketplaces, audit open-source dependencies for unexpected commit history rewrites, and purchase hardware security devices only from verified first-party channels.

China's Vapor Panda Uses AI Pentesting Framework ARTEX to Compromise 140 Targets in 11 Days. CrowdStrike has attributed a campaign by Chinese state-sponsored threat actor Vapor Panda leveraging ARTEX, a Go-based agentic AI penetration testing framework, against more than 200 organizations across 14 countries. The group compromised approximately 140 sensitive targets including foreign ministries, defense agencies, and critical infrastructure in just 11 days, demonstrating an unprecedented speed-to-compromise ratio that traditional defenses are not calibrated to detect. Learn more

Aur0ra Ransomware Group Uses Cursor AI Agents to Automate Domain Takeover. The GOLD OGRE threat group, linked to Aur0ra ransomware, has been using Cursor's Composer AI model alongside Anthropic and xAI agents to automate network intrusion workflows: escalating from stolen credentials to domain administrator, mapping networks, exfiltrating data, and staging ransomware deployment. This represents a documented lowering of the skill floor for complex intrusion operations. Learn more

Syrian Electronic Army Hacker Sentenced to 42 Months After 12 Years as a Fugitive. Ahmad Umar Agha (handle: Th3Pr0), operating under direction from Assad regime advisors, conducted a decade-long campaign targeting approximately 47 Western institutions including the Associated Press, the White House, and US Marine Corps recruitment sites. His 2013 compromise of the AP's Twitter account triggered a $136 billion stock market flash crash. His sentencing closes a 12-year extradition case. Learn more

NetamLoader Targets Asian Government Systems via Trojanized Windows Update Packages. A newly documented APT malware framework called NetamLoader has been discovered targeting a custom build of Windows 10 used by Asian government bodies, concealed within a Windows update package. The malware uses slow C2 communication to evade behavioral detection and deletes its own traces post-execution, indicating a sophisticated operator prioritizing persistence over speed. Learn more

Defense Contractor Pleads Guilty to Enabling North Korean Operatives in Sensitive Roles. A cleared defense contractor with top-secret access pleaded guilty to allowing co-conspirators to use his identity and clearance for nearly 100 job applications, securing nine offers. At least one North Korean operative worked on a military AI project before detection. Learn more

Key Takeaway

Assume AI-accelerated adversary timelines: nation-state actors are now achieving domain compromise in hours, not days, requiring continuous monitoring rather than periodic review cycles.

VOLTA Infostealer Uses LLMs to Profile and Prioritize Victims for Monetization. Cisco Talos documented VOLTA-AUTODOXER, a self-deleting Windows infostealer that sends stolen credential and financial data to OpenRouter-hosted LLMs to generate a ranked dossier of victims by monetization value and operational security posture. The malware includes failover across multiple LLM providers to ensure analysis completion even if one model is unavailable, representing a new tier of automated post-exfiltration intelligence.

Fake Polymarket Clones Sold as Scam Kits by Russian-Speaking Threat Groups. Three Russian-speaking traffer teams, AtlasCore, PolyFucked, and Magnetic Team, are selling ready-made fake prediction market platforms that mimic Polymarket, rig trades, block withdrawals, and harvest personal data. AI-generated fake influencers and customer support personas are used to build user trust before funds are locked. Learn more

Fake GitHub Repo Tricks AI Coding Agents into Installing NetSupport RAT. The SolanaCry campaign uses a convincing fake Solana developer starter kit on GitHub to trigger PowerShell commands that install NetSupport Manager components configured as remote-access malware when processed by AI coding agents. The campaign targets developer cryptocurrency wallets and shows infrastructure overlap with earlier ClickFix campaigns. Learn more

Key Takeaway

Treat AI coding agent permissions as an attack surface: restrict agent access to read-only repository operations and require human approval before any agent-initiated shell command or package installation.

• https://cert.europa.eu/publications/security-advisories/2026-013/
• https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/
• https://www.stepsecurity.io/blog/binance-hack-developer-machine-security
• https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
• https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
• https://cybersecuritynews.com/north-korean-hackers-2/
• https://www.wiz.io/blog/black-october-for-ai-developer-platforms
• https://securityaffairs.com/202162/security/attackers-exploit-critical-drupal-commerce-core-vulnerability-cve-2026-118539.html