Product & Security Tips — SamHouston (Veracode) asked a question.
Veracode Daily Threat Intel Brief | 2026-11-02
Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!
https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips
CISO Advisory Brief | Monday, November 2, 2026 | Coverage: last 24 hours, 7 and 30 days
1. Executive Snapshot
Five actions for the next 24 to 72 hours, in priority order.
- Patch PHP2Shell and the Linux kernel flaw that chains with it. CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited (added October 26, federal due date October 29) and says Linux kernel CVE-2026-46300 can be chained with them to plant PHP webshells and run commands as root (added October 28, due October 31). Move PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, patch kernels, and include PHP embedded in vendor products and appliances.
- Patch Ivanti Connect Secure, then hunt for compromise. CISA added CVE-2026-111357 (federal due date today, November 2) and CVE-2026-118527 (due November 13) on October 30. Both were used as zero-days alongside CVE-2026-104935. A clean result from Ivanti's Integrity Checker does not rule out compromise (single source: Volexity via Help Net Security), so preserve logs and memory before resetting.
- Upgrade self-managed GitLab. CVE-2026-97229 allows unauthenticated code execution through a crafted regular expression in CI/CD configuration; CISA added it on October 29 and the federal due date passed yesterday. Move to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, which also fix the unexploited CVSS 10 flaw CVE-2026-110264. Then rotate tokens, deploy keys and server secrets.
- Find every bundled copy of the Brotli decoder (CVE-2026-111497, Node2Shell). CISA added it October 27 with a November 10 federal due date. Upgrade Node.js to 26.12.1, 24.22.1 or 22.23.4 and Brotli libraries to 1.0.10, 1.1.1 or 1.2.1, then rebuild and redeploy container images.
- Sweep developer tooling for three confirmed supply-chain campaigns. Search every repository, private ones included, for ci-sync-* branches and a sync-check workflow (Gheist). Look for .github/init.js and unexpected Claude, Gemini, Cursor or VS Code settings files (testmetest). Check developer machines for the SSH key labeled svc-telemetry from the tampered Claude Code extension on Cursor's marketplace. On any machine hit by testmetest, remove persistence before revoking tokens.
2. High-Visibility Breaches
- Binance — About $6.3B in crypto left Binance wallets on October 29, mostly within about 20 minutes; Binance says it will cover customer losses. Attacker/method: FBI attributes it to North Korea's TraderTraitor. Binance's preliminary finding is a compromised DevOps engineer's laptop; TRM Labs assesses the hot-wallet signing infrastructure was compromised. Confidence: Attribution confirmed (FBI). Root cause UNCONFIRMED. Sources conflict on the loss ($6.3B to $6.43B) and on chains hit (10 or 11).
- ConnectWise customers — Storm-0940 used compromised ConnectWise Cloud Backup application identities to attempt sign-ins to more than 2,250 Microsoft 365 tenants; some saw persistence and privileged-role changes. Attacker/method: China-state aligned Storm-0940, using the ARTEX agentic AI framework. In some cases initial targeting to privileged cloud access took under 3 hours. Confidence: Confirmed (Microsoft original report, SecurityWeek, CyberScoop). Tenant count is attempts, not confirmed data loss.
- Polymarket (via DebugBear) — About $2.7M drained on October 29; Polymarket is refunding $3.9M in total, including losses from the trading halt. Attacker/method: DebugBear's DNS was hijacked through its registrar and served a wallet-draining script that reused traders' live sessions. Confidence: Confirmed by both companies. Wallet count differs: 726 (Polymarket) vs 737 (Bitquery).
- Cursor Marketplace — Tampered Claude Code extension versions 2.1.312 and 2.1.313 were live for about 11 hours on October 29; up to 5,000 users. Attacker/method: Adds an attacker SSH key and reverse tunnel with startup persistence. How the attacker published to Cursor's marketplace is not explained. Confidence: Confirmed (Cursor notice, Microsoft analysis). Anthropic says its own channels were unaffected (single source).
- Keystone — Device-authentication key and 25,964 buyer records exposed; 18,835 devices in stock will be destroyed. Attacker/method: A flaw in a third-party data monitoring tool on its website was used to escalate privileges; found October 20. Confidence: Confirmed by company (two sources).
- Chainalysis — Customer user IDs, names, email addresses and role labels accessed. Attacker/method: Company says the attacker used offensive agentic techniques; entry point and actor not disclosed. Confidence: Confirmed by company (two sources); scope still under investigation.
The full brief continues in the answers below: Threat Landscape, Malicious Libraries, Critical Vulnerabilities, OSINT, Foresight, CISO Control Checklist, and Sources.
.png){kind=logo}
3. Threat Landscape
Ransomware (30 days)
Leak sites carried 1,127 victim claims in October, up 25.8% from 896 in September (HackerFeeds). N0n (154), The Gentlemen (143) and Qilin (140) posted 38.8% of them. These are criminals' own claims, not confirmed incidents; Ransomnews, which counts only verified attacks, has confirmed 878 for all of 2026 so far (single source).
AI-run intrusions
Microsoft's October 21 report is the clearest primary evidence this month: Storm-0940 used the ARTEX agentic penetration-testing framework to automate scanning, password spraying and OAuth application abuse, reaching privileged cloud access in some environments in under three hours. CrowdStrike separately documented groups running agentic intrusion campaigns and concluded that token budget, not engineering skill, limits their scale (single source, via Cybersecurity Dive).
Identity
In the run-up to the ConnectWise compromise, Microsoft recorded more than 151,000 failed sign-ins against 327 accounts at eight organizations between October 10 and 14, peaking near 2,900 per minute. Microsoft saw no successful logins in that phase; the successful access came afterwards, through the compromised ConnectWise application identities. Persistence was set by changing application credentials, which can survive the vendor disabling the original connection.
Nation-state activity
Beyond TraderTraitor and Storm-0940, Volt Typhoon has been using a relay network called Silent Train, built from rotating chains of compromised home-office, IoT and enterprise devices, to hide the origin of zero-day attacks (The Hacker News; SecurityWeek links it to Cisco SD-WAN zero-day exploitation). The Ivanti zero-day chain is attributed by Volexity to a cluster it tracks as UTA0576.
Cloud and infrastructure
Gheist shows the gap in GitHub's new safeguard: GitHub holds suspicious workflow runs only in public repositories, so private repositories and GitHub Enterprise Server ran Gheist's secret-dumping workflows, and Wiz then saw the same organizations' cloud credentials used against AWS Secrets Manager. A CVSS 10 flaw in Canonical LXD and MicroCloud (CVE-2026-112816) lets an attacker impersonate a trusted client.
4. Malicious Libraries and Components
Confirmed means an official advisory or the original researcher's report. Single-source items are labeled.
No new Maven, NuGet, Go, crates.io or Composer malware reports were found today. GitHub's malware feed view shows only its 25 most recent advisories, so older entries in those ecosystems may exist.
5. Critical Vulnerabilities
KEV dates and federal due dates were checked against CISA's catalog on November 2.
6. Underground and Leak Signals (OSINT)
Leak-site and forum claims are UNCONFIRMED unless the named organization has confirmed.
7. Foresight: Next 2 to 6 Weeks
Analyst assessment, not confirmed events.
8. CISO Control Checklist
Sources
Main sources: CISA KEV catalog and alerts (Oct 26-30); PHP.net security advisories (Oct 21, 23); Node.js security releases (Oct 21); NIST NVD; FBI alert on Binance (Oct 31); TRM Labs (Oct 29); Microsoft Security Blog on Storm-0940 and ARTEX (Oct 21) and on the Claude Code extension (Oct 30); Cursor security notice (Oct 29); JFrog Security Research on testmetest (Oct 26); Wiz Research on Gheist (Oct 25); GitHub Advisory Database and OSV; Help Net Security, SecurityWeek, BleepingComputer, The Hacker News, The Register, CyberScoop, InfoWorld, Techzine, HackerFeeds and Ransomnews.
Corroborate high-impact actions with your own telemetry and vendor advisories.
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.