Daily brief
Binance Suffers Historic Crypto Heist as Flaws in Drupal and GitLab Face Exploitation
Written automatically by AI from the day's headlines. Check the linked sources before you act on it.
Massive Binance Hack Siphons Over $6 Billion in Digital Assets
Cryptocurrency exchange Binance confirmed a security breach affecting an estimated $6.3 billion in assets, with nearly $3 billion successfully frozen on-chain so far. Investigators linked the unauthorized intrusion to a compromised DevOps engineer laptop, and blockchain analysts reportedly attribute the attack to North Korean threat groups. Organizations should enforce strict hardware authentication and isolate privileged administrative systems to limit lateral movement.
Sources: BleepingComputer, SecurityWeek, The Hacker News, The Record, BleepingComputer
Critical Drupal Commerce Core Flaw Under Active Attack
Drupal issued an urgent warning that attackers are actively exploiting a critical authorization bypass vulnerability, tracked as CVE-2026-118539, in the Commerce Core module. The defect allows unauthenticated threat actors to circumvent security controls across online storefronts. Administrators running Drupal Commerce should install the latest security updates immediately and audit recent customer orders for fraudulent activity.
Sources: SecurityWeek, BleepingComputer, The Hacker News
Polymarket Halts Trading Following Website Supply Chain Breach
Prediction market platform Polymarket temporarily suspended trading after attackers compromised an integrated third-party monitoring service to distribute malicious JavaScript. The malicious script hijacked active user sessions, draining an estimated $2 million to $2.5 million into an attacker’s cryptocurrency wallet. Users of the platform should revoke suspicious token allowances, clear active browser sessions, and inspect their transaction histories.
Sources: SecurityWeek, BleepingComputer
Max-Severity GitLab RCE Actively Exploited Against Servers
A maximum-severity vulnerability in GitLab, tracked as CVE-2026-97229, is under active exploitation by unauthenticated attackers seeking arbitrary code execution. The flaw has already been leveraged in attacks against Alpine Linux infrastructure and was subsequently added to CISA’s Known Exploited Vulnerabilities catalog. Administrators running self-hosted GitLab servers must apply the vendor’s emergency patches immediately.
Sources: SecurityWeek, The Hacker News
Compromised Claude Code Extension Distributes Persistent Backdoor
Researchers disclosed that the official Claude Code extension on the Open VSX registry was hijacked to install a persistent SSH backdoor on infected systems. The incident was reportedly linked to a compromise involving the Cursor editor ecosystem. Developers who downloaded the affected extension should inspect their authorized SSH keys, terminate unknown remote access credentials, and reinstall tools from verified repositories.
Source: The Hacker News
What to do this week
- Apply urgent security updates immediately to self-hosted Drupal Commerce and GitLab instances.
- Audit developer machines, VS Code extensions, and SSH authorized_keys files for unauthorized backdoors.
- Disconnect active wallet sessions and review token approvals on decentralized finance and trading platforms.
Stories this brief is based on
- Binance links $6.3 billion crypto theft to compromised DevOps laptop (BleepingComputer)
- $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor (SecurityWeek)
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen (The Hacker News)
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds (The Record)
- Binance probes potential $5.8 billion crypto-theft hack (BleepingComputer)
- Drupal Commerce Core Vulnerability Exploited Against Online Stores (SecurityWeek)
- Drupal warns of critical Commerce Core flaw exploited in attacks (BleepingComputer)
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (The Hacker News)
- $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack (SecurityWeek)
- Polymarket halts trading after crypto-draining script breach, $2.5M traced (BleepingComputer)
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux (SecurityWeek)
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV (The Hacker News)
- Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor (The Hacker News)