Every story from the briefings, one by one. Pick a topic; each one has its own RSS feed.https://usevimli.dev/enhttps://usevimli.dev/news/2026-11-02/alpine-linux-rebuilds-gitlab-after-attempted-exploitation-of-cve-2026-97/https://usevimli.dev/news/2026-11-02/alpine-linux-rebuilds-gitlab-after-attempted-exploitation-of-cve-2026-97/Attackers submitted malicious CI configurations to exploit CVE-2026-97229, an unauthenticated remote code execution flaw in GitLab's regular expression compiler, crashing workers on Alpine's GitLab server. Alpine found no evidence of code execution or tampering, but missing logs meant it could not rule out a compromise, so it rebuilt the instance. Users should reset their GitLab passwords and pull the fixed alpinelinux/gitlab:19.3.6 image published October 27.Mon, 02 Nov 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-11-02/cvss-100-flaw-in-lxd-and-microcloud-allowed-client-impersonation/https://usevimli.dev/news/2026-11-02/cvss-100-flaw-in-lxd-and-microcloud-allowed-client-impersonation/A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. The attacker needed network access to the HTTPS API and the trusted client's public certificate. Once in, the attacker could act as that client and reach the cluster and its virtual machines.Mon, 02 Nov 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-11-02/fbi-attributes-63-billion-binance-theft-to-north-korean-tradertraitor-ha/https://usevimli.dev/news/2026-11-02/fbi-attributes-63-billion-binance-theft-to-north-korean-tradertraitor-ha/The FBI confirmed that North Korea's TraderTraitor group, also tracked as Lazarus Group, stole roughly $6.36 billion in cryptocurrency from Binance, moving most of it across ten blockchains within minutes. The breach began with a compromised DevOps engineer's laptop that opened access to a service container. The FBI published associated cryptocurrency addresses and asked exchanges to block them. Binance says it has covered about 95% of the loss and plans to resume first-phase withdrawals on November 1.Mon, 02 Nov 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-11-01/cvss-100-flaw-in-lxd-and-microcloud-allowed-trusted-client-impersonation/https://usevimli.dev/news/2026-11-01/cvss-100-flaw-in-lxd-and-microcloud-allowed-trusted-client-impersonation/A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. The attacker needed network access to the HTTPS API and the trusted client's public certificate. Once in, they could act as that client, with access to the cluster and its virtual machines.Sun, 01 Nov 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-11-01/hijacked-polymarket-script-drained-about-27-million-from-traders/https://usevimli.dev/news/2026-11-01/hijacked-polymarket-script-drained-about-27-million-from-traders/Malicious code on prediction market Polymarket replaced a third-party page-speed script from DebugBear. On October 29 it sold some signed-in traders' positions and moved their funds to the attackers. Polymarket is refunding about $2.7 million to 726 affected wallets.Sun, 01 Nov 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-11-01/reddit-will-lock-content-behind-logins-to-fight-scrapers/https://usevimli.dev/news/2026-11-01/reddit-will-lock-content-behind-logins-to-fight-scrapers/Reddit co-founder Steve Huffman said the site will gradually become a "logged-in service," with limited access for visitors without accounts. He cited personalization and scrapers, noting that most unauthorized data access happens through logged-out pages. A login pilot will start in selected markets outside the United States in the coming months. The front page and pages reached from search results should stay visible.Sun, 01 Nov 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-31/linux-kernel-mptcp-flaw-allows-remote-root-and-anthropic-built-a-working/https://usevimli.dev/news/2026-10-31/linux-kernel-mptcp-flaw-allows-remote-root-and-anthropic-built-a-working/CVE-2026-98432 is a use-after-free race condition in the kernel's IPv4 TCP code, scored 9.8 out of 10 and affecting kernels back to 4.4 across major distributions. Anthropic says an unreleased Claude model built a working exploit that reached remote root on a server running an MPTCP (Multipath TCP) listener. Fixes are available upstream and in Debian, but Ubuntu and RHEL releases were still waiting as of October 30. Note that Go 1.24 enables MPTCP by default on Linux, so some Go services may be exposed without their owners knowing. Disabling MPTCP alone is not enough, since the bug also triggers via ordinary TCP. CIQ says firewall rules blocking IPv4 TCP packets with IP options can help until patches arrive. No exploitation in the wild has been confirmed.Sat, 31 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-31/php2shell-attacks-root-palo-alto-firewalls-but-wordpress-sites-hold-so-f/https://usevimli.dev/news/2026-10-31/php2shell-attacks-root-palo-alto-firewalls-but-wordpress-sites-hold-so-f/A China-linked group chained the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel privilege-escalation bug to install webshells with root privileges on Palo Alto PAN-OS firewalls, compromising at least 25 devices. Palo Alto has patched all affected PAN-OS branches plus Panorama and urges customers to keep the management interface off the internet. Attacks on WordPress sites have failed so far, but Defiant stresses that updating PHP remains essential.Sat, 31 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-31/teamviewer-flaw-let-controlled-machines-attack-the-connecting-computer/https://usevimli.dev/news/2026-10-31/teamviewer-flaw-let-controlled-machines-attack-the-connecting-computer/TeamViewer has fixed a flaw where a compromised host (the machine being controlled) could attack the viewer (the computer connecting to it), crashing its TeamViewer software and potentially more. Update to the latest version.Sat, 31 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-31/chinese-hackers-use-ai-powered-artex-framework-against-200-organizations/https://usevimli.dev/news/2026-10-31/chinese-hackers-use-ai-powered-artex-framework-against-200-organizations/CrowdStrike attributes attacks using ARTEX, a Go-based, AI-powered penetration testing framework, to the China-linked actor it calls Vapor Panda. The campaign targets over 200 high-value organizations worldwide.Sat, 31 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-31/anthropics-vs-code-extension-on-cursor-was-backdoored-for-nearly-12-hour/https://usevimli.dev/news/2026-10-31/anthropics-vs-code-extension-on-cursor-was-backdoored-for-nearly-12-hour/Attackers compromised Anthropic's verified Cursor account and pushed a backdoored version of its VS Code extension for close to 12 hours. How the account was accessed is still unknown.Sat, 31 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-30/linux-kernel-tcp-flaw-cve-2026-98432-rated-98-affects-ubuntu-and-rhel/https://usevimli.dev/news/2026-10-30/linux-kernel-tcp-flaw-cve-2026-98432-rated-98-affects-ubuntu-and-rhel/The Linux kernel's own CVE team rates CVE-2026-98432, a flaw in the kernel's TCP code, at 9.8 out of 10. It affects Ubuntu, Red Hat Enterprise Linux and other distributions. Anthropic said on October 27 that its AI model wrote an exploit for the flaw that lets a remote attacker with no credentials run commands as root on affected Linux servers. Patch as soon as your distribution ships a fixed kernel.Fri, 30 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-30/analysts-attribute-the-roughly-63-billion-binance-hack-to-north-koreas-t/https://usevimli.dev/news/2026-10-30/analysts-attribute-the-roughly-63-billion-binance-hack-to-north-koreas-t/Most of the money was gone within roughly 20 minutes; the previous record was Bybit's $1.5 billion loss. Binance's initial findings suggest the attacker reached a service container from a compromised DevOps engineer's laptop and submitted unauthorized withdrawals. Blockchain analysts attribute the attack to North Korea's TraderTraitor unit. About $3 billion has been frozen, but the attackers still hold about $2.4 billion in ETH and BTC that no issuer can freeze.Fri, 30 Oct 2026 00:00:00 GMTSecurityhttps://usevimli.dev/news/2026-10-30/threatsday-rounds-up-critical-firewall-flaws-banking-trojans-and-token-t/https://usevimli.dev/news/2026-10-30/threatsday-rounds-up-critical-firewall-flaws-banking-trojans-and-token-t/The Hacker News' weekly roundup covers critical firewall vulnerabilities, rented banking trojans, a weaponized PDF campaign and token theft, plus 26 more stories. It notes exposed passwords, old bugs still being exploited, and attackers borrowing trust from familiar apps, websites and AI tools.Fri, 30 Oct 2026 00:00:00 GMTSecurity