The FBI has attributed the 29 October Binance theft to TraderTraitor, a North Korean group linked to Lazarus, and says the attackers have begun converting stolen assets into Ethereum. Binance estimates the loss at $6.3 billion. TRM Labs reports that most of the stolen funds left within approximately 20 minutes, while Elliptic says $2.85 billion has been frozen or seized. Binance's initial statement suggested that a compromised DevOps engineer's laptop may have allowed an attacker to access a service container and submit unauthorised withdrawals. The exchange has since identified additional points of breach but found no evidence that wallet private keys were exposed. Whether credentials stored on the laptop were stolen or used remains unconfirmed pending its post-mortem. Chainalysis, which disclosed its own breach involving what it called "offensive agentic techniques" during the same period, says the incidents are unrelated.

A second wave of refrigeration attacks has affected Belgium, Sweden, Ireland, Estonia, the Netherlands and Luxembourg, three weeks after approximately 700 victims were reported in France. Belga reports that attackers switched evaporators into defrost mode, while retailers described freezers reaching temperatures of 50°C. Around 40 Delhaize stores were affected, with one manager reporting that all fresh and frozen stock had to be discarded. Installer Sabcobel says the affected units require physical modifications, not simply a software update. Danfoss equipment was reported in Estonia and Copeland equipment in Belgium. Following the French incidents, both manufacturers said the affected devices were mainly discontinued products no longer receiving security updates. The EU Cyber Resilience Act will not require manufacturers to provide support periods until December 2027, leaving no current legal obligation covering these products. No group has claimed responsibility, and Belgium's cybersecurity centre says identifying the perpetrators may never be possible.

Google's takedown of the XCPE botnet addresses a backdoor embedded in devices before they reached users. Google attributes the operation with high confidence to Videostrong Technology, which allegedly used obfuscation to load malicious code after a device's first boot, exploiting a gap in Google's compatibility testing. The backdoor can reinstall itself from the firmware's /oem/ partition if removed by the user. Since August, newer dropper packages disguised as Android system applications have also been installing themselves in the system partition. More than 1.3 million devices were enrolled in the botnet. Google says disrupting the affiliates' command domains should prevent access to at least 10 million further compromised devices. It has banned Videostrong from producing certified Android devices and changed its review process.

Android device manufacturer Videostrong Technology preloaded the XCPE backdoor into firmware, enrolling more than 1.3 million set-top boxes in a botnet. The backdoor sold access to criminal affiliates, whose modules performed ad fraud and enrolled devices into residential proxy networks. Google took legal action against the command servers and banned Videostrong from producing certified Android devices.

Attackers remotely set supermarket freezers to 50°C in early Monday attacks, with more than 50 stores affected in Belgium and over a dozen across Ireland, Estonia, the Netherlands and Luxembourg. A limited number of smaller Swedish stores were also hit. The incident follows an October attack on around 700 French victims, and no group has claimed responsibility for either.

CISA added CVE-2026-111357, a missing authentication flaw, and CVE-2026-118527, a predictable identifier generation flaw, to its Known Exploited Vulnerabilities Catalog. Both affect Ivanti Connect Secure and were added based on evidence of active exploitation. Binding Operational Directive 26-04 requires federal civilian agencies to prioritise rapid remediation of such vulnerabilities on publicly exposed assets.

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake, present since kernel 4.4, where IP options can be freed while another CPU still reads them. The kernel CVE team rates it 9.8, and a demonstrated exploit gave unauthenticated remote root on a server with a multipath TCP listener. No vendor advisory had reported attacks in the wild as of 29 October.

Polymarket reported that a third-party performance-monitoring script loaded on its website was replaced with a malicious version targeting its users. For some people with the site open on 29 October, the script used active sessions to sell positions and move funds out of wallets. Polymarket removed the script, reset all sessions, and refunded $3.9 million to affected traders.