Binance says fake job interviews and a tampered installer enabled $6.3B theft
On the radar
05 TOP STORIESBleepingComputer · 4 min read
Binance says fake job interviews and a tampered installer enabled $6.3B theft
Binance attributes the theft to a months-long, multi-stage campaign that started with fake job interviews and used a tampered installer, which The Hacker News identifies as a Homebrew installation. An internal AI tool was also abused, and BleepingComputer attributes the campaign to North Korean hackers. Outlets give different totals ($6.3B, $6.34B, $6.43B), so the final figure is not settled. The entry point was a hiring process, not a software bug.
BleepingComputer · 2 min read
Russia-linked watering-hole campaign uses n-day exploits against iOS and Android
A large campaign linked to Russian hackers targets iOS and Android users through compromised or spoofed sites, using known but unpatched flaws in zero-click attacks. Google's November Android bulletin patches CVE-2026-58868, a critical no-interaction RCE affecting Android 14 through 17. Because the campaign relies on n-days, devices that have not taken recent updates are the exposed ones.
The Hacker News · 5 min read
Red Hat ships fix for kernel TCP RCE; Ubuntu fixes still in testing
Red Hat has shipped fixed kernels for CVE-2026-98432, a CVSS 9.8 remote, unauthenticated use-after-free in Linux IPv4 TCP. Ubuntu's fixes are still in testing, so the gap is now measured against a vendor that has shipped. Ubuntu operators still have to rely on their own mitigations.
The Hacker News · 4 min read
AI-driven intrusions hit GitBook, Chainstack and a UK school estate
GitBook says a targeted attack using AI agents disrupted its app, API and published docs on November 2. Chainstack disclosed a production breach exposing customer data and password hashes, tied to a broader AI-powered campaign. A 3AM ransomware affiliate encrypted about 37 of nearly 50 machines at a UK school estate in a suspected AI-assisted attack. These disclosures arrive as the UK cyber agency warns AI-powered ransomware against critical infrastructure is likely by 2028, which the incidents suggest may be conservative.
Ars Technica · 5 min read
BlackX UEFI bootkit infects fully patched Windows machines
Ars Technica reports the BlackX bootkit infects fully patched Windows systems by exploiting unclear Microsoft Secure Boot protections. The open question is whether Microsoft's protections or its documentation failed. A fully patched machine is not a safe baseline against firmware-level persistence.
Go a little deeper
EXPLORE BY TOPIC- 53 articles
Cyber security
Exploitation of old and newly patched bugs dominated, alongside a run of update-channel and supply-chain compromises. AI features in attacker tooling and in vendor software both appeared as risks. Several breach disclosures were thin on cause.
Read 8 updates - 25 articles
Tech industry
Earnings and funding point to AI infrastructure demand, while financing questions grow. Google's school policy and the NYT suit against Brave show AI features becoming leverage in commercial disputes.
Read 8 updates - 16 articles
AI
Data-use defaults were the main practical story, with users reporting that Gemini and Codex train on chat history. Anthropic's economics and verification work, and DeepMind's staff dispute, filled out the rest. Research on agent attacks continues to pile up.
Read 7 updates - 21 articles
IT & infrastructure
Distro and tooling releases were routine, with openSUSE Leap 16.1 and NetBSD 11.1 shipping. The notable pattern is AI entering maintainer workflows, through LLM package reviews in Debian and AI-generated vulnerability reports in GIMP.
Read 8 updates - 4 articles
CS & research
A thin day, with one notable theory result in lattice cryptography. The rest was systems material and an in-space manufacturing demonstration.
Read 4 updates