Alpine Linux's GitLab incident illustrates how a security fix can be present upstream yet absent from the software actually deployed. A newly registered account submitted crafted CI configurations to Alpine's GitLab instance on 20 and 21 October, crashing worker processes eight times. In four cases, the attacker had progressed partway through the exploit. The attacker also downloaded Alpine's container image, suggesting the exploit was being adapted to the specific build. Alpine had upgraded to GitLab 19.3.4 on 13 October, missing the fix included in 19.3.5. A subsequent upgrade to 19.3.6 on 22 October did not resolve the issue. The CVE-2026-97229 remediation consists of patches to the Ruby runtime bundled with GitLab's own packages and images, whereas Alpine's image used the system Ruby. Upstream Ruby released the fix on 23 October, but Alpine did not discover that its instance remained vulnerable until 26 October. The investigation found no evidence that exploitation succeeded, although missing logs and the absence of outbound connection logging meant compromise could not be ruled out. Alpine rebuilt the server and reset all passwords. It says external records verified the integrity of its aports repository, packages and 21 October releases, and that signing keys were never stored on the affected server. Organisations running GitLab with their own Ruby installation need Ruby 3.3.13, 3.4.12 or 4.0.9, in addition to the relevant GitLab upgrade.

The FBI has formally attributed the Binance theft to North Korea's TraderTraitor, also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. Working with the US Secret Service and IRS Criminal Investigation, the FBI says the actors are converting stolen assets primarily into Ethereum and anticipates further laundering through decentralised finance and instant-swap services. It has published Ethereum, Bitcoin and Solana addresses associated with the operation and called on THORNode and RPC node operators, instant exchanges, DeFi services and analytics firms to block related transactions. The FBI puts the stolen amount at more than $6 billion; Elliptic's earlier estimate was $6.43 billion. Separately, malicious code that replaced a DebugBear page-speed script on Polymarket caused some signed-in traders' positions to be sold and funds moved on 29 October. Polymarket is refunding approximately $2.7 million across 726 wallets.

Talos's analysis of the VOLTA infostealer describes an AI-assisted stage that operates after data theft. The malware packages stolen credentials, session data and cryptocurrency wallet information, enriching the collection with details such as a home address verified against Gmail receipts. It then submits the data to OpenRouter with instructions for a model to act as a forensic intelligence analyst and rank the victim's valuables as low, medium or high. The default model is Claude Opus 4.6. If a response contains refusal phrases, the malware falls back to Kimi K2 and then Gemini 2.5 Flash; without an API key, it skips the language-model stage. VOLTA deletes itself and communicates only with third-party endpoints. Its build template, which includes six interchangeable slots, suggests the malware is sold to customers. Chainalysis has also disclosed that an external actor using what it describes as “offensive agentic techniques” accessed internal tools and customer user IDs, names, email addresses and role labels. The company says the actor did not access investigation content, clear-text passwords, MFA secrets or session tokens, and that the incident is unrelated to Binance. Chainalysis has not disclosed how the actor gained access.

The FBI, with the US Secret Service and IRS-CI, attributed the theft of more than $6 billion from Binance on or about 29 October to North Korea's TraderTraitor. Investigators have observed the actors converting stolen assets mainly into Ethereum. The agencies published lists of Ethereum, Bitcoin and Solana addresses that hold or have held stolen assets.

Chainalysis detected an external actor using offensive agentic techniques to gain unauthorised access to its systems and internal tools. The actor accessed user IDs, full names, email addresses and organisation role labels for provisioned users. The company found no evidence that investigation content, clear-text passwords, MFA secrets or session tokens were accessed.

VOLTA is a self-deleting Windows infostealer that bundles stolen credentials, sessions and wallet data and sends it to a large language model through OpenRouter. The model returns a dossier ranking the victim's assets by monetisation value. If the first model refuses, the malware falls back through a chain of two further models.

Versions 2.1.312 and 2.1.313 of a tampered Claude Code extension were served on Cursor's marketplace on 29 October. The injected loader adds an attacker's SSH key, opens a reverse tunnel and sets up persistence on macOS, Linux and Windows. Cursor reports that errors and permission requirements blocked SSH access on most macOS and Windows hosts.

Alpine Linux said an attacker tried to exploit CVE-2026-97229, a CVSS 10.0 GitLab flaw, on its instance on 20 and 21 October. The attempts crashed worker processes eight times, and Alpine found no evidence of success but could not rule it out. The flaw sits in Ruby's regular expression engine, and GitLab's fix is a Ruby patch applied only in its own packages.

An unattributed actor delivered NetamLoader through a CAB archive in the Windows update folder, abusing the Patch My PC script runner and AppDomainManager injection. The framework chains XAML payloads that bypass AMSI, delete forensic traces and run the final plugin inside dllhost.exe. Kaspersky identified one victim in Asia and could not link the activity to any known APT group.