Daily digest,
GitLab Issues Emergency Patch for Critical RCE Vulnerability (+7 more)
Vulnerabilities
GitLab Issues Emergency Patch for Critical RCE Vulnerability
GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially crafted regular expressions in pipeline configurations. The vulnerability carries a CVSS score of 10.0 and affects all versions from 19.2 prior to 19.2.8, 19.3 prior to 19.3.4, and 19.4 prior to 19.4.2. GitLab has confirmed that GitLab.com is already patched, while self-managed installations must upgrade immediately. The flaw was reported by a researcher known as 'joaxcar' through GitLab's HackerOne bug bounty program. This incident highlights a growing trend of critical vulnerabilities in GitLab's software, with multiple serious flaws disclosed in 2026.
Vulnerability · 20 sources · score 80 · CVE-2026-0723, CVE-2026-14814, CVE-2026-16301, CVE-2026-19478, CVE-2026-42016
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models.
APT · 20 sources · score 73 · CVE-2012-1823, CVE-2015-4024, CVE-2017-5340, CVE-2019-11043, CVE-2024-4577
Critical Node2Shell Vulnerability (CVE-2026-111497) Under Active Exploitation
On October 21, 2026, Node.js disclosed CVE-2026-111497, a critical out-of-bounds write vulnerability in Google's Brotli decoder, with a CVSS score of 9.2. This flaw allows attackers to exploit specially crafted compressed data, potentially leading to remote code execution (RCE) and memory disclosure. Active exploitation attempts have been reported, particularly against Node.js version 24.22.0, and the vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog. Multiple security vendors, including Cisco and Palo Alto Networks, have released advisories and patches. Organizations are urged to apply updates immediately to mitigate risks. The vulnerability affects various software frameworks that utilize the Brotli decoder, including Node.js, Python, and .NET. Security researchers have confirmed successful exploitation in testing environments, highlighting the urgency of remediation.
Vulnerability · 8 sources · score 73 · CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-109618, CVE-2026-109619
AI-Driven Vulnerabilities Surge, DevSecOps Overwhelmed
HackerOne's report reveals a significant rise in unresolved vulnerabilities, with a 131% increase over two years. Although the average resolution time has decreased from 135 days to 62 days, 70% of security leaders report that new findings are arriving faster than they can be addressed. The use of AI in vulnerability discovery is accelerating the rate of new findings, putting pressure on DevSecOps teams. Additionally, there has been a 557% increase in system prompt leakage reports and a 264% increase in output handling issues. Security researchers are actively upskilling with AI, leading to a 75% tracking of exposure debt among organizations. The report highlights the urgent need for teams to adopt AI for faster remediation as cybercriminals also leverage AI for exploit development.
Vulnerability · 20 sources · score 56
Threat actors and malware
North Korean Hackers Steal $6.3 Billion from Binance in Record Cyber Heist
On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack attributed to North Korean hackers known as TraderTraitor, resulting in the theft of approximately $6.3 billion in digital assets. The attackers exploited vulnerabilities in Binance's hot wallet system, allowing unauthorized withdrawals across multiple blockchains. The FBI confirmed the involvement of TraderTraitor, a group linked to previous high-profile hacks, including the $1.5 billion Bybit theft. Binance reported that it has replenished 95% of the stolen assets using its own funds, including its Secure Asset Fund for Users (SAFU). As of November 1, 2026, Binance began restoring withdrawals in phases, with a significant spike in customer withdrawals observed. Approximately $3 billion of the stolen assets have been frozen through cooperation with law enforcement and industry partners. The incident has raised concerns about the security of centralized exchanges and the ongoing threat of state-sponsored cybercrime.
APT · 20 sources · score 78 · CVE-2026-109618, CVE-2026-109619, CVE-2026-112816, CVE-2026-46300, CVE-2026-97229
Google Disrupts XCPE Botnet in 1.3 Million Android TV Boxes
Google and industry partners have dismantled the XCPE botnet, which infected over 1.3 million Android TV set-top boxes, primarily manufactured by Videostrong Technology Co. The company is accused of intentionally embedding a backdoor in the firmware to sell access to criminal affiliates, who used the devices for ad fraud and to route unauthorized traffic through victims' connections. The backdoor, identified as x.cpe, operates with system-level privileges and reinstalls itself if removed. Google's actions included legal measures to shut down command-and-control domains, disrupting access to at least 10 million additional compromised devices. The operation involved collaboration with Japan's National Police Agency and several security firms. Google has cut ties with Videostrong, banning the company from producing certified Android devices. This incident raises significant concerns about supply chain security in the Android ecosystem.
Malware · 20 sources · score 68 · AppSalt, Backdoor, Badbox, GaGaNode, HiddenView
Mercado Bitcoin Suspends Operations After $49M Security Incident
On November 2, 2026, Brazilian cryptocurrency exchange Mercado Bitcoin suspended all deposits and withdrawals following a significant security incident that reportedly drained approximately $49 million from its wallets. The exchange claimed that no customer funds were lost and no personal data was compromised, although it did not disclose how the breach occurred or the specific systems affected. Blockchain security firm Hypernative estimated that over $40 million was transferred across multiple blockchains, including Bitcoin and Ethereum, in unauthorized transactions. Tether confirmed it froze over 4.5 million USDT related to the incident. The exchange is currently investigating the breach and working with authorities to trace the stolen assets. Despite the suspension, some funds continued to move from affected addresses after the announcement, raising concerns about the effectiveness of the containment measures. Mercado Bitcoin has published destination addresses for tracking purposes but has not provided a timeline for resuming operations.
Malware · 19 sources · score 67 · TraderTraitor
Mercenary Spyware Targets German Lawmakers' iPhones, BSI Issues Alerts
Germany's Federal Office for Information Security (BSI) has warned members of the Bundestag and federal government that their iPhones may have been compromised by mercenary spyware. The alerts began on October 29, 2026, following notifications from Apple indicating targeted attacks. Digital Minister Karsten Wildberger confirmed the situation, advising affected individuals to assume their devices may be compromised. The specific attackers or methods remain unknown, but the BSI emphasized the severity of the threat, as such spyware can access messages, calls, and even activate microphones and cameras. Apple has issued similar warnings to users in 99 countries, indicating a broader campaign. No confirmation of successful breaches has been provided, and the BSI is still gathering information.
Malware · 20 sources · score 58 · Mercenary, Mercenary Spyware, Pegasus
New on leak sites
28 victims listed on ransomware leak sites by 13 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-98432, CVE-2026-109618, CVE-2026-109619, CVE-2026-53016, CVE-2026-68426
- Malware: Hermes, TraderTraitor, AppSalt, Backdoor, Badbox
- Ransomware groups: Kraken, Akira Ransomware, BYOD
- Campaigns: Partner To Win, Arsenal Of Freedom Campaign, Blinder Tunnel
- APT groups: APT34, Bitter, Bitter APT
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.