This Week in Cybersecurity
The week belonged to attacks that start with people and tooling rather than exploits. Binance published a post-mortem of its record theft: a tampered Homebrew install in June, a fake job interview in September, and an internal AI tool abused on October 29. It reads as a case study in how one developer machine can open the door to everything behind it.
AI-driven intrusion moved from theory to routine. CrowdStrike links a China-nexus group to ARTEX, a multi-agent AI pentest framework used against 200+ organizations in 14 countries since October 17. This week WorkOS, Chainalysis and Chainstack all disclosed breaches tied to AI-assisted attackers, and Bitdefender suspects an AI agent loop in a 3AM ransomware run against a UK school estate.
Supply-chain trust failed again. A hijacked third-party script on Polymarket drained wallets, and tampered copies of the Claude Code extension sat in Cursor's marketplace for about 11 hours. Meanwhile, old bugs keep paying off: C3RB3R ransomware is hitting Synology NAS units that never applied a 2024 DSM fix.
Top Stories
Binance Post-Mortem: Fake Job Interviews, Tampered Homebrew and an Internal AI Tool Behind $6.4B Theft
Binance details a multi-stage attack: a tampered Homebrew install in June, a fake interview in September, and an internal AI tool abused on October 29. The takeaway for defenders is to treat developer workstations and internal AI tooling as tier-zero assets, and to scope what any single engineer's laptop can reach.
Chinese Hackers Use ARTEX AI Framework in Automated Attacks Against 200+ Orgs
CrowdStrike ties China-nexus Vapor Panda to ARTEX, a multi-agent AI pentest framework used against 200+ organizations in 14 countries since October 17. WorkOS also disclosed that its CEO says an attacker used ARTEX to reach an internal sales app, exposing CRM contacts and call summaries. Expect faster, more parallel intrusions, and tune detection for speed rather than just signatures.
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
DebugBear says its DNS records were hijacked via its registrar, and a malicious script on Polymarket drained logged-in traders' positions. Polymarket is refunding $2.7M in losses plus $1.2M for downtime. Lock your registrar accounts, and audit which third-party monitoring scripts run on authenticated pages.
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
Tampered copies of the Claude Code extension were live in Cursor's marketplace for about 11 hours, attempting host recon and a reverse SSH tunnel. If your developers use Cursor, check extension install logs for that window and review outbound SSH from workstations.
Synology NAS Devices Targeted in C3RB3R Ransomware Attacks Exploiting Patched DSM Flaw
Synology urges DSM updates after ransomware hit NAS units running outdated software. Fixes shipped in 2024, and customers report .L0CK3D encrypted files. Update DSM, and keep NAS management interfaces off the internet.
Security Corner
10 new advisories published to the Security Advisories section this week. Embedded and router firmware dominates the critical list.
CVE-2026-120534 — Advanced Custom Fields: Extended PRO Code Injection (Critical) A code injection flaw in a widely used WordPress plugin add-on. Check your sites and apply the vendor update. Full advisory →
CVE-2026-120518 — BuddyPress XProfile Image Field Arbitrary File Deletion (Critical)
Arbitrary file deletion through the XProfile image field. On WordPress, deleting a file such as wp-config.php can lead to site takeover.
Full advisory →
CVE-2026-120213 — @fastify/http-proxy Prefix Escape via Decoded Route Parameters (Critical) A prefix escape in a popular Node.js proxy plugin caused by decoded route parameters. Review your Fastify dependencies. Full advisory →
WAVLINK command injection cluster (Critical) Five command injection advisories affect WAVLINK devices, including the WN701AE and WN553X1-B:
- CVE-2026-120230 — WN701AE
del_vlan_groupOS command injection → - CVE-2026-120231 — WN553X1-B OpenVPN handler →
- CVE-2026-120238 — WN553X1-B
ovpn_filehandler → - CVE-2026-120239 — WN553X1-B WireGuard CLI handler →
- CVE-2026-120240 — WN553X1-B WireGuard group handler →
Keep these devices' admin interfaces off untrusted networks.
Also this week:
- CVE-2026-120434 — Netpbm
picttoppmstack-based buffer overflow (High) → - CVE-2026-49906 — Android Automotive Cluster permission bypass via confused deputy (High) →
Quick Takes
- Red Hat Patches 9.8-Rated Linux TCP Flaw: CVE-2026-98432, an IPv4 TCP use-after-free present since 4.4, is fixed in RHEL 8, 9 and 10. Ubuntu's fixes remain in the opt-in proposed channel. Read more →
- Google Warns LLMjacking Can Cost Up to $1M: GTIG and Mandiant say hijacked cloud and LLM credentials are resold via "LLM mixers", with fraudulent bills topping $100,000 a day. Read more →
- Gorbag Exploits WinRAR Flaw: The Russia-aligned group targets only Ukrainian organizations, using CVE-2025-8088 and stealers such as GIFTEDCROOK and BeautyStealer. Read more →
- Chainalysis Discloses AI-Driven Breach: An attacker used offensive agentic techniques to reach internal tools and expose customer names, emails and role labels. Read more →
- Chainstack Breach Exposes Password Hashes: The blockchain infrastructure provider ties the incident to an AI-powered campaign. Read more →
- UK School Estate Hit by 3AM Ransomware: Bitdefender says about 37 of nearly 50 machines were encrypted, with command patterns suggesting an AI agent loop. Read more →
- Mercado Bitcoin Confirms Cyberattack: Brazil's largest crypto exchange suspended deposits and withdrawals after more than $46M flowed out. Read more →
- Harvard Breach Counts 851,000 Accounts: Have I Been Pwned lists about 851,000 unique emails from the November 2025 alumni systems breach claimed by ShinyHunters. Read more →
- Europol Seizes 100+ Servers: Seven suspects were arrested in an investment scam crackdown targeting a supplier of fake trading sites. Read more →
- XCPE Botnet Dismantled: Google and partners took down a botnet of 1.3M+ Android TV boxes shipped with malware that rents connections to proxy services. Read more →
- Michigan State Claimed by BYOD Ransomware Gang: The group claims data on 1.3M students, while MSU cites a possible credential compromise and no sign of an AD breach. Read more →
Upcoming
Start with developer endpoints. Review what a single engineer's laptop can reach, check Homebrew and editor-extension provenance, and look at Cursor extension installs from the affected window. Lock down registrar accounts with MFA and registry locks, and inventory the third-party scripts that load on logged-in pages. If you run Synology NAS units, update DSM now and take management interfaces off the internet. Patch RHEL hosts for CVE-2026-98432 and track Ubuntu's fix as it leaves the proposed channel. Audit WAVLINK gear and WordPress plugins against this week's advisories, and watch cloud billing for LLMjacking spikes. We'll follow ARTEX-related disclosures and the Binance fallout in next week's digest.
CosmicBytez Labs — IT & Cybersecurity Intelligence Hub