Weekly Security Roundup — week ending 1 November 2026

Security Stories

North Korea's TraderTraitor Executes Largest Crypto Theft in History

North Korea's TraderTraitor group drained Binance hot wallets of $6.3 billion — the largest single cryptocurrency theft on record — via a single compromised DevOps engineer's laptop. By Saturday, Binance co-CEO Richard Teng confirmed 90% had been replenished using the SAFU fund and industry partner reserves, with the remainder pledged from company funds. Sources: Slashdot

Malicious Claude Code Extension Backdoors ~5,000 Developer Machines

A backdoored version of the official Claude Code extension appeared in Cursor's marketplace, establishing a persistent reverse SSH tunnel to attacker infrastructure across roughly 5,000 developer machines during a 12-hour window. Microsoft's detailed technical analysis documented host reconnaissance, SSH credential harvesting, and Protocol Tunneling (MITRE T1572). Sources: Microsoft Security Blog · Ars Technica

VOLTA Infostealer Embeds LLM to Rank Victims by Monetisation Value

Cisco Talos published analysis of VOLTA, an infostealer that packages stolen credentials and wallets into a structured bundle and submits it to an LLM to rank the victim's assets by monetisation value — falling back to a secondary model if the first refuses. Separately, Chainalysis — the blockchain analytics firm — disclosed a breach via "offensive agentic techniques," exposing customer names, emails, user IDs, and org roles. Sources: Cisco Talos · BleepingComputer

Two Critical Linux Kernel Vulnerabilities in One Week

Anthropic researchers disclosed a critical RCE vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation allowing unauthenticated remote root access. Days later, a separate use-after-free in the IPv4 TCP stack was disclosed as CVE-2026-98432 (CVSS 9.8). Two critical kernel network-stack vulnerabilities in seven days is exceptional. Sources: BleepingComputer · atlasum.net

Rhysida Claims Phoenix Charter Academy — Student Immigration Records Exposed

Rhysida claimed Phoenix Charter Academy, a Massachusetts charter school network serving primarily low-income and immigrant families. The alleged 445 GB includes student special education IEP/504 records, CBP I-94 entry documents and parole application statements for families, staff W-2 forms with SSNs, and bank statements. The presence of immigration records for minors creates risks beyond the financial.

Northflank Breach, Android SMS of Death PoC, and Florida 4.9M SSN Leak

UK cloud platform Northflank disclosed a breach in which AI service API keys stored on the platform were actively abused — rotate all secrets if you're a customer. A proof-of-concept for CVE-2026-58882 ("SMS of Death") was released, enabling remote Android device disruption via crafted SMS with no user interaction; exploitation should be considered imminent. Florida's Department of Education notified approximately 4.9 million residents that Social Security numbers were exposed in a financial aid website breach. Sources: BleepingComputer (Northflank) · BleepingComputer (SMS of Death) · The Record (Florida)

Ransomware: Holcim, SilentRansomGroup Law Firm Campaign

Emperador ransomware claimed Holcim, the Swiss construction materials giant (CHF 15.7B revenue, 43 countries) — one of the largest manufacturing sector victims of the year if confirmed. SilentRansomGroup claimed ArentFox Schiff LLP as its third major US law firm in a single week, alongside Moritt Hock & Hamroff and Susman Godfrey, suggesting a deliberate legal sector campaign rather than opportunistic targeting.

Key Themes

The AI Toolchain Is the Attack Surface. The Cursor/Claude Code backdoor, the Northflank AI API key theft, and the AI startup breach of Anthropic employee data all target the infrastructure developers use to build AI products — not the AI models themselves. Extension marketplaces, cloud secret stores, and IDE plugins are now front-line attack vectors.

AI Is Going Offensive. VOLTA's embedded LLM represents a qualitative shift: AI is no longer just used to write phishing emails or generate malware variants — it is now operating mid-intrusion, making real-time decisions about which victims to prioritise. Chainalysis being breached via agentic techniques, a ransomware operator spending $7,000 on AI services, and the ghost student AI fraud story all point to the same direction of travel.

The Human Is Still the Weakest Link — at Every Scale. $6.3 billion moved because one laptop was compromised. North Korea's most sophisticated cyber unit did not need a zero-day to execute the largest heist in crypto history. The lesson is not new, but the scale it enables keeps growing.

NCSC

The NCSC published joint guidance with the Financial Conduct Authority clarifying that sharing cyber incident information with the NCSC is compatible with UK Market Abuse Regulation obligations for publicly listed companies. A practical resolution to a compliance friction point that has likely delayed incident intelligence sharing. Read the NCSC blog post (27 October 2026, Mark K, Senior Resilience Lead).

CISA KEV: No new Known Exploited Vulnerabilities were added to the CISA KEV catalogue this week.

HaveIBeenPwned Activity

One new breach was added to Have I Been Pwned this week: AfD (Alternative für Deutschland), the German political party. The breach originated in September 2026 and exposed 345,439 accounts, with email addresses and email messages in the dataset — a more sensitive combination than credential data alone given the political context. View on HIBP