Open Cyber Threat Intelligence

A penetration test on a major cloud provider revealed a chain of vulnerabilities that enabled complete bypass of tenant isolation. Initial access was gained via misconfigured Kubernetes worker nodes, allowing escape to the host. This was followed by exploitation of Konnectivity to achieve remote code execution on the control plane, privilege escalation using an OverlayFS vulnerability, and lateral movement across managed services including VictoriaMetrics, Kafka, Redis, PostgreSQL, and SaltStack. The attack chain ultimately allowed access to sensitive credentials, control of other tenants' resources, and full compromise of the cloud infrastructure through misconfigurations and logic flaws in multiple components.

A denial-of-service vulnerability was discovered in Intelbras IP cameras, affecting models including iM3B-C, iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The flaw exists in an unauthenticated firmware update endpoint at /firmwareUpgrade_service/Demo, which allows any user on the local network to send a POST request causing the camera to reboot, resulting in a persistent DoS condition. The vulnerability was assigned candidate ID CAN-2026-2035970 and classified as Medium severity (CVSS 4.0: 5.1). Intelbras released a patched firmware version R.260804 to address the issue by enforcing authentication on the endpoint.

NetamLoader is a previously undocumented .NET assembly-loading framework used in a sophisticated infection chain targeting government Windows 10 systems in Asia. The malware is delivered via a malicious CAB file placed in a Windows update directory, leveraging AppDomainManager injection to execute malicious payloads. It uses multiple stages of encoded and compressed XAML and .NET assemblies to load a final plugin that communicates with a command-and-control server, gathers system information, and deletes forensic traces. The attack appears to be a supply chain compromise, though no specific threat actor has been attributed.

The FBI has attributed a record $6.43 billion cryptocurrency heist from Binance to TraderTraitor, a North Korea-aligned hacking group also known as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The group used trojanized Terraform providers to deliver a cross-platform malware implant called FLATROOF, which deploys a Python-based information stealer and the ROOFDECK backdoor for persistent remote access. TraderTraitor employs social engineering via fake job lures hosted on tailored domains, using AI to create convincing personas and target individuals in blockchain, AI, and cybersecurity sectors. A portion of the stolen funds has been frozen on-chain by major blockchain platforms.

Hackers compromised the domain DNS records of DebugBear, a third-party real user monitoring service, and replaced a legitimate script with a malicious one loaded by Polymarket. The hijacked script exploited authenticated trading sessions to steal approximately $2.64 million worth of POL tokens and positions from 726 affected wallets by reusing existing API keys and transaction signers. The attack occurred on October 29, 2026, and was active for about an hour before detection and mitigation. Polymarket responded by pausing trading, removing the malicious script, resetting sessions, and refunding affected users a total of $3.9 million.

A critical vulnerability in Canonical's LXD and MicroCloud, tracked as CVE-2026-112816, allows attackers to impersonate trusted clients without possessing the corresponding private key by exploiting a flaw in mutual TLS certificate validation. The vulnerability arises because the server validates the entire certificate chain against its trust store, but only the first (leaf) certificate's private key ownership is proven during TLS handshake, enabling an attacker to chain a trusted public certificate behind their own. This could lead to full cluster access and potential root access to host machines if a privileged account is impersonated. The flaw affects specific versions of LXD and MicroCloud, with fixed versions now available, though no known exploitation has been observed in the wild.

The FBI has attributed the $6.36 billion cryptocurrency heist from Binance to the North Korean state-sponsored hacking group TraderTraitor, also known as Lazarus Group, Jade Sleet, and APT38. The attackers exploited a compromised DevOps engineer's laptop to access Binance's service container and execute unauthorized withdrawal transactions across ten blockchains. The stolen funds were rapidly laundered, primarily into Ethereum, with the FBI identifying 628 associated cryptocurrency addresses. TraderTraitor has a history of targeting crypto firms using social engineering, including the 'Operation DreamJob' campaign and prior breaches at Bybit, DMM, and Drift.

CVE-2026-111497 is a critical out-of-bounds write vulnerability in the Google Brotli C library, affecting multiple runtimes including Node.js, Python, Bun, .NET, Java brotli4j, Envoy, and Istio. The flaw allows memory corruption during Brotli decompression, enabling attackers to achieve denial of service, heap memory reads, and potentially remote code execution. Exploitation has been confirmed in the wild, with CISA listing it in its known exploited vulnerabilities catalog. The vulnerability stems from a boolean return value ambiguity in DecodeBlockTypeAndLength(), leading to unbounded memory writes and exploitable state corruption.

The article discusses two major security issues: the compromise of eMudhra intermediate CA private keys due to a flawed key-generation process, leading to weak 8-bit keys being used instead of 384-bit keys, and a memory corruption vulnerability (CVE-2026-111497) in the Brotli decompression library. The eMudhra incident allowed potential certificate forgery, with trust chains extending through roots like Sectigo’s AAA Certificate Services, while the Brotli flaw affected multiple runtimes and applications including Node.js, Bun, Python (via requests), and .NET. Despite patches being released, the widespread bundling of vulnerable libraries and certificate stores in applications means updates must be manually propagated, leaving many systems exposed.

A malicious version of the Claude Code extension, 2.1.313, was distributed through Cursor's marketplace, potentially affecting up to 5,000 users. The compromised extension included code that added an SSH authorized key, attempted to establish a reverse SSH tunnel, and installed persistence mechanisms. While initial reports suggested distribution via Open VSX or npm, investigation found no evidence of the malicious version being published to those registries. Cursor confirmed the compromise, removed the extension, rebuilt its marketplace with rotated keys, and worked to take down the attacker's infrastructure.