Daily digest,
North Korean Hackers Steal $6.34 Billion from Binance via Fake… (+5 more)
Vulnerabilities
High-Risk Authentication Flaw in SurrealDB Exposed
SurrealDB versions 3.1.0 to 3.2.9 have an improper authentication vulnerability (CVE-2026-121419) that allows attackers to hijack sessions using a valid low-privilege token and a victim's mcp-session-id. This flaw enables unauthorized execution of MCP tools with the victim's roles and permissions, posing a high risk to exposed deployments. Attackers need an existing account or token, making credential theft or account compromise a realistic exploitation route. The vulnerability was disclosed on November 3, 2026, and is rated with a CVSS score of 8.6, indicating high severity. Organizations are advised to upgrade to version 3.3.0 or later and to limit network access to vulnerable deployments until a patch is applied.
Vulnerability · 2 sources · score 63 · CVE-2026-121419
CVE-2026-121451: High-Risk CSRF Vulnerability in AB Download Manager
AB Download Manager versions prior to 1.11.2 have a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to write files to arbitrary paths via an unauthenticated browser-integration API. A malicious web page can exploit this by sending a crafted request to the /start-headless-download endpoint, potentially executing code on user login. Users of the software, especially on shared or business- workstations, are primarily affected. The vulnerability has a CVSS score of 8.7, indicating high severity. As of now, there is no confirmation of active exploitation or proof-of-concept (PoC) code available. Users are advised to upgrade to the fixed version or disable browser integration until then.
Vulnerability · 2 sources · score 63 · CVE-2026-121451, Cross-site request forgery
SQL Injection Vulnerability in CloudClassroom-PHP Project
A SQL injection vulnerability, CVE-2026-121502, has been identified in the mathurvishal CloudClassroom-PHP-Project, specifically in the facultydetails.php file. The vulnerability arises from the manipulation of the deleteid argument, allowing remote attackers to exploit the flaw without authentication. The exploit is publicly available, increasing the risk of opportunistic attacks. The vendor has not responded to early disclosure attempts, and there is no confirmed fix available. Affected users include those with internet-facing deployments of the application, particularly self-hosted instances. Successful exploitation could lead to unauthorized data exposure or alteration, impacting student and faculty records. Security professionals are advised to monitor logs for unusual requests and restrict access to the vulnerable function until a patch is available.
Vulnerability · 2 sources · score 54 · CVE-2026-121502
Breaches
North Korean Hackers Steal $6.34 Billion from Binance via Fake Interviews
On October 29, 2026, Binance suffered a $6.34 billion hack attributed to North Korean hackers, who utilized fake job interviews and malicious software to breach the platform. The attackers initially targeted a Binance engineer in June, tricking them into downloading malware disguised as legitimate software. By September, they approached another engineer through a job platform, building trust before deploying malware that allowed access to Binance's internal systems. The FBI has linked the attack to North Korea, which has denied the allegations. Binance has since frozen around $2.85 billion of the stolen funds and replenished 98% of the affected assets. This incident is considered the largest cryptocurrency heist to date, causing significant declines in cryptocurrency prices. The attack's sophistication involved using an internal AI tool to control software used by other engineers before executing the malicious code.
Breach · 2 sources · score 78
GitBook Suffers Security Breach from AI-Driven Attack
On November 2, 2026, GitBook experienced a security incident involving unauthorized access to its infrastructure. The attack, characterized as sophisticated and highly targeted, utilized AI agents to compromise some of GitBook's infrastructure credentials. Following the detection of the breach, GitBook promptly took its app and authenticated documentation sites offline to mitigate further impact. While public content remained accessible, the company invalidated all customer API tokens and replaced every credential across its infrastructure. The investigation revealed that the attacker may have accessed Git Sync secrets and API tokens, but no evidence of content modification was found. GitBook is actively monitoring the situation and implementing additional security measures. A full post-mortem report is expected to be published soon.
Breach · 2 sources · score 58
NSW Health Cyber Breach: 100,000 Documents Compromised
A cyber breach at NSW Health has resulted in the alleged theft of 100,000 sensitive documents from an isolated server. The incident was reported to the NSW Police Cybercrime Squad on October 30, 2026, and has been declared a major incident. Authorities confirmed that no patient data was compromised during the breach. The hacker, identified as 'bytetobreach', claimed to have exploited a misconfigured subdomain, exfiltrating approximately 70GB of data. The breach is currently under investigation by the police, and Cyber Security NSW is involved in the response. Health Minister Ryan Park emphasized the need for continuous improvement in cybersecurity measures. The investigation is ongoing, and updates will be provided as they become available.
Breach · 9 sources · score 52 · Strike Force Civic
New on leak sites
45 victims listed on ransomware leak sites by 18 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-107441, CVE-2026-111357, CVE-2026-111497, CVE-2026-114148, CVE-2026-118527
- Vulnerabilities: OS Command Injection, Buffer overflow, Cross-site request forgery
- APT groups: Salt Typhoon, ShinyHunters
- Ransomware groups: 3AM, 3AM Ransomware
- Malware: BeautyStealer, CosmicPulse, CosmicPulse Backdoor, DarkSword, DarkSword iOS Kit
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.