Daily brief
Binance's Record Heist, Ivanti Zero-Days, and Active GitLab Exploits
Written automatically by AI from the day's headlines. Check the linked sources before you act on it.
North Korean Hackers Linked to Historic Binance Crypto Theft
The FBI and U.S. Secret Service have officially blamed North Korean state-sponsored hackers known as TraderTraitor for stealing over $6 billion from cryptocurrency exchange Binance. Federal authorities have flagged more than 600 wallet addresses linked to the incident as the group attempts to launder the proceeds. Crypto platforms and organizations handling digital assets are urged to monitor and block transactions associated with these addresses.
Sources: SecurityWeek, The Record, BleepingComputer, The Hacker News
Ivanti Patches Connect Secure Zero-Days Under Active Attack
Ivanti has issued urgent patches for two Connect Secure remote access gateway vulnerabilities that attackers have chained together in zero-day intrusions since at least October 1. The Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog following confirmed attacks. Network administrators should apply Ivanti’s latest updates without delay to protect exposed appliances.
Sources: BleepingComputer, SecurityWeek
Hundreds of Exposed GitLab Servers Targeted in Active Exploits
More than 1,000 internet-facing GitLab servers remain vulnerable to a maximum-severity flaw currently being targeted in remote code execution attacks. The ongoing wave of attacks recently led the Alpine Linux team to rebuild its development server and issue blanket password resets after detecting an attempted breach. System administrators running self-hosted GitLab installations should patch immediately and review access logs for unauthorized activity.
Sources: BleepingComputer, BleepingComputer
Polymarket Traders Targeted Through Hijacked Third-Party Script
Attackers manipulated domain registrar settings for performance monitoring service DebugBear to deliver malicious code directly to prediction market Polymarket. The injected script automatically liquidated positions and redirected millions of dollars from signed-in traders before the platform refunded affected users. Developers should tightly audit third-party script dependencies and restrict external code execution through content security policies.
Sources: SecurityWeek, The Hacker News
Critical Flaws in Langflow AI Tool Allow Remote Code Execution
IBM disclosed two critical security vulnerabilities in Langflow, a widely used open-source tool designed for constructing artificial intelligence agents and workflows. The flaws permit remote attackers with no user accounts to bypass access controls or execute arbitrary code on the underlying server. Developers relying on Langflow should update their installations and avoid exposing administrative interfaces directly to the public internet.
Source: The Hacker News
What to do this week
- Patch self-hosted GitLab instances and Ivanti Connect Secure gateways against actively exploited flaws.
- Review and limit third-party JavaScript dependencies on production websites to avoid supply chain script injections.
- Update Langflow and ensure all internal AI agent workflows are protected behind strict authentication controls.
Stories this brief is based on
- FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist (SecurityWeek)
- FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions (The Record)
- FBI links $6.3 billion Binance crypto heist to North Korean hackers (BleepingComputer)
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist (The Hacker News)
- Ivanti patches two more Connect Secure zero-days chained in attacks (BleepingComputer)
- Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain (SecurityWeek)
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacks (BleepingComputer)
- Alpine Linux rebuilds GitLab after attempted RCE attack (BleepingComputer)
- Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack (SecurityWeek)
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script (The Hacker News)
- Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers (The Hacker News)