Binance's incident report describes a campaign spanning several months, culminating in the theft of approximately $6.34 billion in digital assets. Reports say a tampered installer replaced a Homebrew binary on a work laptop, and that three engineers' computers were compromised. Binance identifies a wider chain of techniques, including malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method. One account says the internal AI tool allowed the attackers to move between teams, while three detection gaps meant no single alert exposed the activity. Binance attributes the theft to North Korean hackers, an allegation Pyongyang has protested. The available reports do not explain how the transaction-authorisation method worked or how the funds were transferred out of Binance.

The cPGuard incident was a supply-chain attack targeting a security product's update infrastructure. Using compromised credentials, the attacker accessed OPSShield's update servers and uploaded trojanised versions of cPGuard, numbered 5.88.12 through 5.88.19. Nearly 3,000 customer servers received the malicious updates. OPSShield also confirmed that the attacker stole customer contact information and hashed passwords from its billing and licensing server. Because cPGuard runs on Linux web-hosting servers, the poisoned releases reached systems on which customers had installed the software to provide protection. Details of the payload have not yet been reported.

The incident involving France's blood service, EFS, had potential physical consequences, although the confirmed impact was limited. Attackers compromised refrigeration supplier Coolworld and altered cold-room settings at three EFS sites. Coolworld says the reported vulnerability was in a third-party component of its remote-monitoring software. EFS says its own systems were not directly targeted, and an on-call technician noticed the abnormal temperature rise overnight. Plasma and other products were transferred to other facilities, and EFS says no stock was lost. The reported reading of 110°C refers to controller measurements, not confirmed product temperatures. The incident adds to the wave of attacks targeting refrigeration control systems across Europe.

Attackers took control of refrigeration controllers at three French National Blood Service sites overnight between 1 and 2 November, reportedly pushing cold room readings from -30°C to 110°C. The controllers are maintained by Coolworld, which said the flaw lies in a third-party component of its remote monitoring software. An on-call technician spotted the temperature rise, plasma was moved to other facilities, and no blood products were lost.

Google promoted Chrome 157 to the stable channel for Windows, Mac and Linux, fixing 213 security vulnerabilities. Seven are rated critical, covering buffer overflows and memory corruption in Dawn and ANGLE, and use-after-free bugs in WebGL, Prerender, Geometry and Core. The update also resolves dozens of high-severity flaws, mostly in V8, PDFium, Skia and GPU components.

A suspected APT29 campaign injected malicious JavaScript into compromised websites, lookalike reverse-proxy domains and the Plerdy analytics tracker, which was compromised from 27 August to 3 September 2026. Visitors were profiled and served n-day exploit chains, including the DarkSword iOS kit, without user interaction. The payloads steal cookies, Wi-Fi passwords and, on iOS 18.5, full device data, without persistence.

The SlippyNunchucks group hijacked DNS resolution for a Sogou Input Method configuration host, serving a malicious configuration over unencrypted HTTP. The configuration made the SGTool.exe component download a renamed Adobe binary, which side-loaded the DarkVigil implant through Sogou's component workflow. Victims in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka were affected, and Tencent fixed the flaw, CVE-2026-120422, in version 16.10.

CISA added CVE-2026-119977, a time-of-check time-of-use race condition in WordPress Core, to its Known Exploited Vulnerabilities Catalogue. The addition is based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritise remediation of high-risk catalogue entries on publicly exposed assets.