Security news.
Federal authorities have officially attributed the record-breaking $6.3 billion Binance cryptocurrency heist to North Korea's TraderTraitor group. Meanwhile, critical infrastructure and developer tools face severe risks following the disclosure of a maximum-severity authentication flaw in Canonical's LXD and active zero-day exploitation chains targeting Ivanti Connect Secure and Alpine Linux's GitLab instances.
FBI Links Record $6.3B Binance Heist to North Korea
Federal agencies confirmed that North Korean state-sponsored threat actors known as TraderTraitor were behind the historic multi-billion dollar crypto theft from Binance.
Critical CVSS 10.0 Flaw in Canonical LXD and MicroCloud
A vulnerability in Canonical's LXD and MicroCloud HTTPS API allows unauthenticated remote attackers with a public certificate to impersonate trusted clients without holding private keys, gaining full control over clusters and virtual machines.
Attackers Chain Ivanti Connect Secure Flaws for Root Access
Threat actors are actively exploiting a chain of vulnerabilities, including CVE-2026-111357 and CVE-2026-118527, prompting CISA to add both to its Known Exploited Vulnerabilities catalog.
Alpine Linux Rebuilds GitLab Infrastructure After RCE Attack
The Alpine Linux project rebuilt its GitLab server and forced a sitewide credential reset after attackers attempted to exploit a critical remote code execution vulnerability (CVE-2026-97229).
Polymarket Users Lose $2.7M in Script Supply Chain Hijack
Attackers compromised a third-party DebugBear page-speed script loaded on Polymarket, injecting malicious code that hijacked active trader sessions and drained funds.
Critical Linux Kernel Vulnerability Enables Remote Root via MPTCP
Security researchers released exploit details for a critical Linux flaw that lets unauthenticated remote attackers execute arbitrary commands as root against systems running Multipath TCP listeners.
Northflank Breach Triggers Abuse of Customer AI Keys
Cloud host Northflank is urging customers to rotate all secrets and credentials after unauthorized intruders accessed the platform and abused stored third-party AI API keys.
Malicious Claude Code IDE Extension Drops Persistent SSH Backdoors
Attackers distributed a trojanized Claude Code-branded developer extension on the Cursor marketplace designed to establish persistent SSH backdoors on developer workstations.