Once Upon a Hack
$ cat /news/today — daily security, IT and crypto happenings, ranked. Sourced, short, no hype.
// front page · Sun Nov 1, 2026
Today's digest: The Hack Sheet #007 →
- 1.
Security Attackers chain three Ivanti Connect Secure bugs for unauthenticated root (thehackernews.com)
Volexity says the UTA0576 group chains auth bypass CVE-2026-104935 with CVE-2026-111357 and CVE-2026-118527 (both added to CISA's KEV list Oct 30) to get root, then steals credentials, admin passwords and BitLocker keys. Fixed in ICS 25.1.1.3 and 22.8R2.6; the federal deadline is Mon Nov 2. Alert: cisa.gov.
- 2.
IT Max-severity GitLab flaw CVE-2026-97229 under active exploitation (bleepingcomputer.com)
The CVSS 10 integer overflow in GitLab's CI/CD regex compiler allows unauthenticated code execution via a crafted pipeline config, and Alpine Linux reports seeing attempts against its instance. Upgrade to 19.4.2, 19.3.5 or 19.2.8; custom Ruby builds also need a patched Ruby. More: alpinelinux.org.
- 3.
Security Fake "Claude Code" Cursor extension planted a persistent SSH backdoor (cursor.com)
Malicious versions 2.1.312 and 2.1.313 of an Anthropic.claude-code-branded extension were live Oct 29 from about 2:27 AM to 1:35 PM PT, adding an attacker SSH key, setting persistence and exfiltrating host info; Sophos estimates up to 5,000 users. Uninstalling doesn't remove it: look for an "svc-telemetry" key in authorized_keys, isolate the machine and rotate credentials. Analysis: microsoft.com.
- 4.
Crypto Binance's $6.3B theft tied to North Korea's TraderTraitor (nbcnews.com)
Reporting links the heist to the TraderTraitor group, which targets the people and systems that control wallets rather than the cryptography itself.
- 5.
Crypto b14g zero-token withdrawals drain 97M CORE (~$1.47M) from Bitcoin staking platform (cryptoslate.com)
On Oct 31 an attacker abused a bug where a zero-value withdrawal was treated as "withdraw all," emptying 91 positions in one transaction. The flaw had been live about 17 months; roughly 9M CORE was frozen and staked BTC is unaffected.
- 6.
Crypto Premia flash-loan attack drains six Arbitrum option vaults (~$437K) (coindaro.com)
Two transactions about a second apart early Nov 1 UTC emptied the pools, with losses estimated at $400K-$465K. No key compromise has been reported and Premia hasn't issued a statement yet.
- 7.
Crypto Troves loses ~8.6 BTC through a deprecated contract that kept live permissions (theblockbeats.news)
An old rebalancer for the xWBTC/WBTC vault was never revoked and was used to pull funds on Nov 1. Troves revoked the access, paused vaults and offered a 1 WBTC bounty. More: kucoin.com.
- 8.
Gaming Kingdom Come developer Warhorse Studios hit by "serious" cyberattack (warhorsestudios.cz)
Warhorse confirmed unauthorized access to systems and data and is checking whether personal information was involved. Staff reports of ransomware, extortion and halted development are unconfirmed. More: thegamer.com.
// tool_of_the_day
Velociraptor · AGPL-3.0 license
Velociraptor is an endpoint visibility and incident-response tool that lets you hunt across Windows, macOS and Linux machines for signs of compromise, like an unexpected SSH key, a new persistence entry or a suspicious process, and collect forensic evidence at scale. It's for IR teams and sysadmins who need to answer "which of our machines got hit?" fast, exactly the question after today's fake Cursor extension backdoor.
// community stories
Red-team war stories, disclosure tales, CTF write-ups. Browse Stories or submit yours (moderated).