2026-11-02 Daily Cyber News
Billions in stolen assets, actively exploited secure-access weaknesses, and rapidly expanding AI use are forcing leaders to examine who and what can reach critical systems. The FBI attributed the $6.3 billion Binance theft to North Korea-linked TraderTraitor, while Ivanti Connect Secure flaws are already being used in attacks and require urgent remediation. In UK financial services, AI adoption is rising faster than some post-deployment controls, increasing governance and third-party questions. Daily Cyber turns…
- Threat Intelligence$6.3 billion Binance theft puts privileged access in focus
A theft estimated at $6.3 billion forced Binance to suspend withdrawals and absorb a massive financial shock. The FBI attributed the attack to North Korea-linked TraderTraitor. Early findings pointed to a compromised DevOps engineer’s laptop that enabled access to a service container and unauthorized…
- Vulnerabilities & ExploitsActive Ivanti attacks raise the urgency for secure access updates
Organizations using Ivanti Connect Secure face active attacks against two newly identified weaknesses. One can support privilege escalation for a local authenticated attacker, while the other can let a remote authenticated attacker place controlled content at a known disk location. The weaknesses can be…
- AI & Emerging TechnologyFinancial firms embrace AI faster than post-deployment controls
Financial institutions are putting AI into production faster than many are maturing ongoing oversight. A UK survey found that 86% of respondents use AI, while 80% reported having AI agents deployed and another 14% planned deployment within 12 months. Only 2% reported agents with broad autonomy.…
- Incident ResponseAlpine rebuilds GitLab after attack leaves compromise uncertain
Alpine Linux rebuilt its GitLab server and reset all passwords after attackers targeted a critical code-execution weakness. The attempts repeatedly crashed GitLab processes, and some came close to succeeding. Alpine found no evidence of code execution or tampering with packages and releases. Missing logs…
- Vulnerabilities & ExploitsHidden Android messages can disrupt calls and emergency access
A hidden, zero-click Android message can crash the process responsible for phone service and interrupt active calls. The specially crafted WAP Push message is processed automatically and does not appear like a normal text. Repeated processing can extend the disruption and may affect calls to emergency…
- Identity & AccessLinux cluster trust gap can hand attackers control of hosts
Exposed LXD and Incus management interfaces can let remote attackers impersonate trusted clients and control clusters or managed virtual machines. The certificate-checking process proved ownership of one certificate but trusted other attacker-supplied certificates in the same chain. An attacker could…
- Legal & RegulatoryLyft settlement makes in-app privacy choices a compliance test
Lyft agreed to a $1.8 million California settlement over allegations that its app created unlawful barriers to privacy choices. The company had sold or shared personal information for targeted advertising without offering an in-app opt-out. Users instead had to follow links to a webpage and re-enter…