12 stories · 5 sources · 1 critical · 6 high · ~14 min read

Coverage: Last 24 hours

Today’s Highlights

Rapid patch cycles and active exploitation define this cycle: major platform vulnerabilities (Drupal Commerce, GitLab, TeamViewer, WordPress) are being exploited within hours or days, while high-impact supply-chain and SaaS extension compromises continue to drive organizational risk far beyond traditional perimeter defenses. Widespread exploitation of web and SaaS platforms, rapid weaponization of disclosed vulnerabilities, supply chain trust failures, and credential targeting are key themes. Top stories include an actively exploited TeamViewer remote code execution issue and confirmed Drupal Commerce Core and GitLab remote compromise routes.

Table of Contents

1. TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
2. Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
3. CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
4. Drupal Commerce Core Vulnerability Exploited Against Online Stores
5. Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
6. Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
7. Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

Critical   High   Medium   Low

Top Stories

TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

Source: SecurityWeek | Published: Oct 30 | Risk: HIGH | Impacted: IT support technicians, Remote helpdesk users, Organizations with distributed OT endpoints, Critical infrastructure with TeamViewer deployments | Topics: Threat Intel / Vulnerability

What happened: A high-severity vulnerability in TeamViewer, tracked as CVE-2026-111585, could allow attackers to execute arbitrary code on support technicians’ systems by exploiting an integer overflow in the remote-control screen processing component.

Why it matters: Unauthorized code execution on support technicians’ systems can facilitate deep access, credential theft, and internal lateral movement, increasing business exposure to hands-on-keyboard attacker activity.

How it works: TeamViewer enables remote desktop control for support and administration. The flaw is an integer overflow in its remote screen processing, where a hostile host can send crafted data during a session to execute code on the technician’s machine.

Practitioner Perspective

Remote support tools like TeamViewer are often whitelisted and used in sensitive environments. The disclosed CVE-2026-111585 bug means any support interaction with a compromised host could result in the technician’s endpoint itself getting taken over. If your helpdesk or IT teams rely on TeamViewer, this should trigger immediate threat hunting for IOCs and a push to get endpoints onto updated versions. Beyond patching, evaluate whether new technical compensating controls are feasible, such as isolating support workstations and restricting their access to production assets. The takeaway: treat all remote support sessions as potential attack entry points and assume attackers can flip the relay.

Recommended Actions

• Update TeamViewer installations to versions that address CVE-2026-111585 across all support endpoints
• Monitor TeamViewer connection logs for abnormal or unauthorized remote sessions

Exploits & CVEs

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Source: The Hacker News | Published: Oct 30 | Risk: HIGH | Impacted: E-commerce platforms using Drupal, Drupal site admins, Retail risk/compliance leaders, Third-party payment integrators | Topics: Exploit / Vulnerability

What happened: Drupal has warned that threat actors are exploiting a “highly critical” security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539, is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. “This module enables you to sell goods and services to customers through an included shopping

Why it matters: Real-world attacks targeting Drupal Commerce sites can result in fraudulent purchases, unauthorized account access, and significant disruption to online retail operations.

How it works: CVE-2026-118539 is a missing authorization check in the Drupal Commerce module, directly enabling attackers to perform restricted operations such as order or account manipulation with no authentication required.

Affected / Fix: Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13 affected; patch available.

Practitioner Perspective

This exploit is not theoretical: attackers are finding Drupal Commerce Core instances, bypassing authorization, and manipulating e-commerce flows. Every unpatched deployment is a candidate for monetary loss or data breach, particularly as automation tools probe for default or vulnerable endpoints. Your team should already be triaging logs for aberrant transactions and verifying customer integrity. Expect secondary impacts including service desk overload or reputational fallout if attackers weaponize exposed access. Stay vigilant post-patch, as similar flaws may exist in custom modules or integration layers.

Recommended Actions

• Upgrade Commerce Core to version 2.41 (2.x) or 3.3.13 (3.x) to remediate CVE-2026-118539 immediately
• Hunt for evidence of access bypass or out-of-band admin actions in server/application logs

CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

Source: The Hacker News | Published: Oct 30 | Risk: HIGH | Impacted: Federal agencies, Critical infrastructure, Cloud service providers running GitLab or Cisco firewalls, Compliance teams tracking KEV mandates | Topics: Exploit / Cloud

What happened: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below – CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise

Why it matters: Inclusion in the CISA KEV catalog formalizes risk for both GitLab RCE and Cisco firewall DoS vulnerabilities, escalating audit and patch compliance urgency for regulated entities and infrastructure operators.

How it works: CISA’s Known Exploited Vulnerabilities catalog highlights software flaws with confirmed exploitation in the wild. CVE-2026-97229 allows RCE on GitLab instances, while the Cisco bug can let attackers crash firewall services, threatening network segmentation.

Practitioner Perspective

CISA KEV listing means these flaws (GitLab CVE-2026-97229, Cisco Firewall DoS) are known to be exploited in the wild against real organizations. Security teams regulated under federal or sectoral mandates must now adhere to tight remediation deadlines and demonstrate closure. This is not just about crossing items off a list; it is confirmation that attackers have operational exploits and are targeting unpatched internet-facing systems. Immediate patching and internal communication should be paired with detection engineering for artifacts of exploitation. Prioritize asset discovery, missed internet-exposed instances can create high-impact consequences up the chain.

Recommended Actions

• Patch GitLab Community and Enterprise Edition for CVE-2026-97229 wherever deployed, per CISA KEV requirements
• Update Cisco firewall software to address the listed DoS vulnerability and review device logs for targeted traffic

Drupal Commerce Core Vulnerability Exploited Against Online Stores

Source: SecurityWeek | Published: Oct 30 | Risk: HIGH | Impacted: Drupal Commerce online stores, E-commerce administrators, Retail tech operations, Payment processing infrastructure | Topics: Threat Intel / Exploit

What happened: Drupal has identified and patched a critical access bypass vulnerability in the Commerce Core module, tracked as CVE-2026-118539, which is actively being exploited in online stores. The flaw allows unauthenticated attackers to bypass access controls, potentially leading to financial impacts for vendors. Affected versions include Commerce Core 3.x prior to 3.3.13 and 8.x-2.x before 8.x-2.41. Store owners are advised to update to these versions and audit their orders for inconsistencies.

Why it matters: Attackers can bypass customer access controls to manipulate or steal orders and payment data, exposing organizations to fraud, operational downtime, and regulatory risk if exploited.

How it works: Drupal Commerce Core is an e-commerce module for Drupal sites. CVE-2026-118539 is an access bypass flaw where attackers can skip authorization checks, potentially granting themselves privileged actions normally reserved for authenticated users.

Affected / Fix: Affected versions include Commerce Core 3.x prior to 3.3.13 and 8.x-2.x before 8.x-2.41; patch available.

Practitioner Perspective

Online retailers running Drupal Commerce are in the crosshairs as unauthenticated attackers actively bypass core module access controls. This risk is operationally significant, threat actors can directly undermine e-commerce integrity and harvest sensitive customer or financial data. With active exploitation underway, patch latency translates into real-world loss events, including revenue theft and supply chain disruption. If your team handles Drupal, you must treat this with ’emergency patch’ urgency and immediately audit for suspicious orders or account manipulation. Move fast: attackers are finding and exploiting unpatched stores now.

Recommended Actions

• Identify all Commerce Core installations below 3.3.13 (3.x) or 8.x-2.41 (8.x-2.x) and upgrade to the patched versions for CVE-2026-118539
• Audit historical order and customer-account records for anomalous activity since exposure

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Source: SecurityWeek | Published: Oct 30 | Risk: HIGH | Impacted: Enterprise engineering teams, DevOps staff running GitLab, CI/CD pipeline operators, Linux distribution maintainers | Topics: Threat Intel / Exploit

What happened: A critical GitLab vulnerability, CVE-2026-97229, was exploited against Alpine Linux’s GitLab instance on October 20-21, 2026. The flaw allowed unauthenticated attackers to execute arbitrary code via specially crafted regular expressions in CI/CD configurations. Alpine Linux responded by rebuilding its GitLab instance and resetting all passwords.

Why it matters: Remote code execution on GitLab enables attackers to compromise source code, CI/CD secrets, and internal infrastructure, putting organizational integrity and customer trust at risk.

How it works: GitLab is a source code and DevOps collaboration platform. This vulnerability uses specially crafted regular expressions in CI/CD jobs to trigger an integer overflow, resulting in unauthenticated remote code execution on the server.

Practitioner Perspective

GitLab instances are significant targets because they often contain code, build processes, and credentials. The active exploitation of CVE-2026-97229 via malformed CI/CD regexes shows attackers are probing for unpatched or exposed instances, administrators must prioritize patching before they become part of post-exploitation stories like Alpine Linux. Beyond patching, assume compromise if you were unpatched during the exposure window: attackers can implant persistent access, exfiltrate assets, or poison the CI/CD supply chain. Treat user/password resets and credential audits as mandatory in post-incident response for exploited GitLab environments.

Recommended Actions

• Upgrade GitLab Community and Enterprise Edition instances to fixed releases for CVE-2026-97229
• Perform full compromise assessment and forensic review for suspicious CI/CD pipeline artifacts and user account anomalies

Emerging Signals

Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

Source: The Hacker News | Published: Oct 30 | Risk: CRITICAL | Impacted: Cryptocurrency exchanges, Executive risk teams in finance, Endpoint security teams, Identity and access management teams | Topics: Data Breach / Exploit

What happened: Cryptocurrency giant Binance said on Thursday that a “security incident” on its platform has impacted about $6.3 billion worth of assets. The world’s biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively.

Why it matters: Massive cryptocurrency theft originating from endpoint compromise enables rapid attacker monetization, exposes systemic deficiencies in asset controls, and increases risk of regulatory intervention or customer flight.

How it works: The attack on Binance began with the compromise of an engineer’s laptop, escalating to unauthorized withdrawal requests routed via on-chain smart contracts and advanced laundering techniques indicative of nation-state capability.

Practitioner Perspective

Major crypto exchanges like Binance remain prized targets for state-linked threat actors who bypass infrastructure-level controls by targeting employee endpoints. The breach reportedly started via a compromised engineer laptop, demonstrating the sustained risk posed by endpoint phishing, credential theft, and lack of privileged session controls. Defensive programs focused only on on-chain or perimeter security are missing the real attack vector. Now more than ever, securing the human and endpoint layer, device hygiene, credential hardening, and continuous monitoring for unusual withdrawal activity, should be a top-level board concern. Assess your controls for high-value wallet transactions and assume targeted, persistent attacker interest.

Recommended Actions

• Investigate all recent administrative transactions on Binance and monitor asset withdrawal logs for anomalies indicative of post-compromise activity
• Harden endpoint security controls and enforce least privilege, especially for staff with blockchain asset access

Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

Source: The Hacker News | Published: Oct 30 | Risk: HIGH | Impacted: Developers using VS Code with extensions, Engineering workstations, SaaS marketplace administrators, Organizations with open SSH to dev endpoints | Topics: Exploit / Vulnerability

What happened: The official Anthropic Claude Code extension was compromised on the Cursor Marketplace, installing a persistent SSH backdoor on up to 5,000 users’ systems. The malicious version added an attacker-controlled SSH key to users’ authorized_keys files, enabling potential unauthorized access. The issue was traced to the Cursor Marketplace, which temporarily removed the extension to eliminate the malware. Users who installed the compromised version are advised to isolate their systems, remove the unauthorized SSH key, and perform a thorough security audit.

Why it matters: A popular code editor extension deployed a persistent SSH backdoor to thousands of developer endpoints, allowing attackers direct access to internal systems, code repositories, and potentially sensitive environments.

How it works: The compromised Claude Code extension for Visual Studio Code was modified to add an attacker-controlled SSH public key into users’ authorized_keys file, allowing remote shell access to the machine by the attacker at any time.

Affected / Fix: Extension removed from Cursor Marketplace; users must manually remove the attacker’s SSH key and audit systems.

Practitioner Perspective

Anyone running the compromised Claude Code VS Code extension via Cursor Marketplace must now treat their machine and any accessed codebases as potentially exposed. The SSH backdoor could grant attackers persistent internal access long after initial infection, even after the extension is removed. This threat shatters trust in third-party IDE marketplaces and moves the long-standing supply-chain risk directly onto developer endpoints. Post-incident, security teams cannot rely on removing the extension alone: full host compromise assessment and SSH key reconstruction are mandatory. Communicate to engineering and DevOps: their credentials, code, and any SSH-accessible infrastructure may also be at risk.

Recommended Actions

• Identify endpoints with the affected Claude Code VS Code extension from Cursor Marketplace and forensically scan for unknown SSH keys in authorized_keys
• Remove attacker-planted SSH keys and rotate credentials on compromised hosts

Also Today

• Drupal Commerce Core Access‑Bypass (CVE‑2026‑118539) Exploited in the Wild: A high‑severity access‑bypass flaw in Drupal Commerce Core (CVE‑2026‑118539) is confirmed actively exploited in the wild.
• Binance Investigates Suspicious $5.8B Stablecoin Transfers; Tether and Circle Freeze Funds: Binance is investigating suspicious transfers up to $5.8 billion; Tether and Circle have frozen stablecoins tied to the activity.
• WordPress Core Upgrade‑Window RCE Exploited Hours After 7.1.4 Patch: Unauthenticated RCE in WordPress core (versions 4.7–7.1.3) detected in active exploitation hours after 7.1.4 patch release.
• $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack: Polymarket suspended trading on October 29 after discovering unauthorized withdrawals linked to a compromised third-party provider. Malicious code from DebugBear hijacked user sessions to steal funds.
• $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor: Binance suffered a $6.3 billion cryptocurrency theft attributed to North Korean hackers, likely starting from a compromised engineer’s laptop.

Defensive Actions

• Patch Drupal Commerce Core CVE-2026-118539 immediately across all ecommerce deployments; compromise confirmed in the wild
• Deploy remediations for GitLab CVE-2026-97229 and hunt for abuse; Alpine Linux breach shows active targeting
• Audit and re-secure endpoints running the compromised Claude Code VS Code extension; persistent SSH backdoor confirmed
• Review active TeamViewer deployments for CVE-2026-111585 exposure; update and monitor for anomalous connections
• Monitor for suspicious access and withdrawal events on cryptocurrency-related infrastructure given ongoing North Korean activity
• Perform asset discovery and remediate any overlooked GitLab and Cisco devices per CISA KEV requirements
• Isolate and wipe developer endpoints affected by malicous VS Code extension; rotate all related credentials
• Enhance detection rules for GitLab RCE and Cisco firewall DoS exploitation across your environment

What We’re Watching

• Active exploitation of Drupal Commerce Core CVE-2026-118539: monitor patch compliance and scan for new exploitation attempts
• Enterprise response to GitLab CVE-2026-97229 (CVSS 10.0): prioritize patching and forensics for possible supply chain or CI/CD abuse
• Ongoing investigation of Binance’s $6.3 billion security breach and related stablecoin freezes; watch for further on-chain laundering attempts
• Increase in supply-chain attacks impacting SaaS extension marketplaces and developer endpoints, exemplified by the Claude Code VS Code compromise
• Compliance mandates resulting from CISA KEV inclusion of GitLab and Cisco firewall vulnerabilities: deadlines and threat actor focus likely to drive further targeting

Found this briefing useful? Follow the blog to get the next one as soon as it is published, and pass it along to a colleague who owns patching.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: Exploit, Incident Response, patching, SaaS, supply-chain, Vulnerability