Alpine Linux rebuilds GitLab after attempted RCE, FBI ties $6.3B Binance heist to North Korea

Alpine Linux rebuilt its GitLab instance from scratch and reset all passwords after attackers tried to exploit a maximum-severity GitLab flaw on October 20-21. Separately, the FBI blamed North Korea’s TraderTraitor group for the record $6.3 billion Binance heist.

Security

Alpine Linux rebuilds GitLab after attempted exploitation of CVE-2026-97229

Attackers submitted malicious CI configurations to exploit CVE-2026-97229, an unauthenticated remote code execution flaw in GitLab’s regular expression compiler, crashing workers on Alpine’s GitLab server. Alpine found no evidence of code execution or tampering, but missing logs meant it could not rule out a compromise, so it rebuilt the instance. Users should reset their GitLab passwords and pull the fixed alpinelinux/gitlab:19.3.6 image published October 27.

Source

CVSS 10.0 flaw in LXD and MicroCloud allowed client impersonation

A critical flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. The attacker needed network access to the HTTPS API and the trusted client’s public certificate. Once in, the attacker could act as that client and reach the cluster and its virtual machines.

Source

FBI attributes $6.3 billion Binance theft to North Korean TraderTraitor hackers

The FBI confirmed that North Korea’s TraderTraitor group, also tracked as Lazarus Group, stole roughly $6.36 billion in cryptocurrency from Binance, moving most of it across ten blockchains within minutes. The breach began with a compromised DevOps engineer’s laptop that opened access to a service container. The FBI published associated cryptocurrency addresses and asked exchanges to block them. Binance says it has covered about 95% of the loss and plans to resume first-phase withdrawals on November 1.

Source

AI

Open-weight GLM 5.3 model built working Firefox exploits from unshipped patches

Epoch AI researchers showed that the open-weight GLM 5.3 model could turn Firefox security patches, visible in public code before reaching users, into working attacks. The resulting chains escaped the browser sandbox and read local files across six recent Firefox releases. Mozilla fixed the flaw in Firefox 159.0 on October 27. The same attack could not be reproduced in Chrome.

Source

Open source & development

Linux 7.2.15 is the final release of the 7.2 stable series

Greg Kroah-Hartman announced kernel 7.2.15, the last 7.2.y release, after which the tree is end-of-life. He said the branch retired earlier than normal to avoid keeping too many stable branches alive at once. Systems running 7.2.y should move to 7.3.y.

Source

Releases

Vaultwarden 1.37.5 ships security fixes for website icons and emergency access

Vaultwarden 1.37.5 fixes two medium-severity advisories affecting website icons and emergency access, with details private pending CVE assignment. The update is also required for newer web vault features, including two-step login toggling and emergency account takeover. The bundled web vault is now v2026.10.1, and invalid configuration values now stop startup with an error.

Source

Türkiye

Social media ban for under-15s takes effect in Türkiye

A regulation from the Presidency’s Cybersecurity Directorate took effect on November 1, barring social networks from serving children under 15. Age verification runs through an e-Devlet token that reveals only whether the user is over 15 or 18, not personal data. Existing accounts have until March 31, 2027 to verify. Unverified accounts will be closed and their data deleted. Platforms must give 15 to 18 year-olds a separate, high-privacy service by default.

Source

Bottom line

• If you run Alpine’s GitLab image, pull alpinelinux/gitlab:19.3.6 (October 27) and reset passwords.
• Update Vaultwarden to 1.37.5 for the two security fixes.
• Move any 7.2.y kernels to 7.3.y. The 7.2 series is end-of-life.