Daily Summary of Cybersecurity · Final editionSunday 1 November 2026 · UTC
Cybersecurity News: 1 November 2026
Linux kernel flaw, $6.43B Binance heist and GitLab rebuild lead day
A critical Linux kernel flaw and a $6.43 billion Binance heist were the day's main cybersecurity developments, with the FBI linking the largest cryptocurrency theft in history to North Korea's TraderTraitor. Alpine Linux rebuilt its GitLab server after attackers tried to exploit a critical GitLab remote code execution flaw in its development infrastructure.
Other reports covered an Android SMS crash, a LXD impersonation flaw, a Polymarket script hijack and a government Windows malware campaign.
Alpine Linux rebuilds GitLab after CVE-2026-97229 attack attempts
Alpine Linux, a base for Docker images, rebuilt its GitLab server and reset passwords after attackers tried to exploit CVE-2026-97229, a critical GitLab remote code execution flaw. The project said eight worker crashes occurred on October 20-21, with four attempts partially successful, but found no tampering in commits, packages or releases through October 27. Missing logs and absent outbound records prevented it from ruling out code execution.
Critical Linux kernel flaw could allow remote root access
A critical Linux kernel flaw, CVE-2026-98432, caused by a use-after-free in IPv4 TCP code could let an unauthenticated attacker gain remote root access, especially on servers running MPTCP listeners. Anthropic demonstrated an exploit that bypassed KASLR and reached root in about 53 minutes, and Go 1.24 can expose MPTCP by default. Patches are available upstream, but updates were pending for some distributions as of October 30, 2026.
Invisible Android SMS can crash phone service and block emergency services
A specially crafted WAP Push SMS message can crash Android's phone service, interrupt ongoing calls, and temporarily render the smartphone unusable without any user interaction. The zero-click attack, dubbed SMS of Death and documented by independent researcher Mark Blaszczyk, lets a remote attacker send one message over the mobile network. It can also compromise the ability to contact emergency services.
Critical LXD and MicroCloud flaw lets attacker impersonate trusted client
A critical flaw in Canonical's LXD and MicroCloud, CVE-2026-112816 with CVSS 10.0, lets an attacker with network access to the HTTPS API and a trusted client's public certificate log in as that client. The attacker can reach the cluster and virtual machines, and if the account is privileged, gain root access to the host. Canonical released fixed versions, and Incus fixed the same flaw in version 7.6.0.
Hijacked DebugBear script steals $2.7 million from Polymarket traders
Malicious code on Polymarket sold some signed in traders' positions and moved funds to hackers on October 29 after replacing a DebugBear page speed script. Polymarket is refunding about $2.7 million to 726 affected wallets, and blockchain records show about $2.64 million reached the hackers' wallet in under an hour. DebugBear said its DNS records were compromised through its domain registrar and early findings point to one customer's website.
NetamLoader malware targets government Windows 10 systems in Asia
Kaspersky said NetamLoader, a previously undocumented .NET assembly loading framework, targeted a custom Windows 10 build used by government entities in Asia. The malware was detected in the first half of 2026 inside a Windows cabinet archive placed in an operating system update directory. Kaspersky suspects a supply chain attack, but no known group has been named and it is unclear whether more than one system was compromised or data was stolen.
FBI links North Korea's TraderTraitor to $6.43 billion Binance heist
The FBI attributed the theft of $6.43 billion in virtual assets to TraderTraitor, a hacking group linked to North Korea and tracked as Jade Sleet. The FBI and other U.S. agencies said the group converted stolen assets mainly into Ethereum and provided wallet addresses used for laundering. Binance resumed phase one withdrawals after pausing them, and the heist is the largest cryptocurrency theft in history.
Illustration 
