The Week Trust Broke: ByteMuni Cybersecurity Weekly Recap (Oct 27 – Nov 2, 2026)

If one idea ties this week together, it's this: almost none of the big attacks broke in through the front door. They came through things people were told to trust. A developer's laptop. An official-looking code extension. A performance-monitoring script. A shared chat link. An AI model download. A TV box's own firmware. Even WordPress's update process, the thing that's supposed to keep sites safe.

This is ByteMuni's cybersecurity weekly recap for October 27 to November 2, 2026. We covered many of these stories in depth during the week. Here, we pull them together, add what else mattered, and turn it all into a short to-do list you can act on Monday morning.

Here's what's inside:

• At a glance: every major story in one table

• Story of the week: how the $6.3 billion Binance heist unfolded, and what's changed since

• Trusted tools turned against users: a hijacked Claude Code extension, Polymarket's script attack, poisoned AI models and a ChatGPT link flaw

• Patch now: WordPress, GitLab, LXD and PHP-based firewalls

• Botnets and state hackers: Google's XCPE takedown and Volt Typhoon's hidden relay network

• Scams and malware close to home: an Android banking campaign hitting Indian bank customers

• ByteMuni's priority checklist for the week ahead

Cybersecurity weekly recap: this week at a glance

Story of the week: the $6.3 billion Binance heist

The largest crypto theft on record started on the evening of October 29, 2026. By Binance's estimate, about $6.3 billion left its hot wallets, most of it within roughly 20 minutes. We published a full breakdown of the Binance hack the next day. Here's what has changed since.

The FBI made it official. The FBI attributed the theft to TraderTraitor, the North Korean unit it also blamed for the $1.5 billion Bybit hack in February 2025. It asked exchanges and other crypto services to block 628 laundering addresses: 608 on Ethereum, 19 on Bitcoin and one on Solana. Reported totals still differ by outlet, from $6.3 billion to $6.43 billion, depending on how assets and chains are counted. Our analysis of what the TraderTraitor attribution means for DevOps access goes deeper.

Withdrawals came back in phases. Binance began restoring withdrawals at 06:00 UTC on November 1, and all 15 networks in the first phase were back by 12:36 UTC. Between 06:00 and 15:30 UTC that day, it reported $4.649 billion in withdrawals against $1.01 billion in deposits. That's a net outflow of about $3.64 billion, or roughly 2.1% of its reported assets. Binance now says it has covered about 95% of the impacted amount, with the rest in less-liquid tokens still being bought. More routes are still being tested, as we covered in Binance's phased withdrawal recovery.

More money was frozen. Circle raised its frozen USDC linked to the incident to more than $1.1 billion, up from about $800 million. Frozen isn't the same as returned, though. Getting those funds back still needs legal processes.

ByteMuni's take: The technical lesson isn't about cryptography. Binance's own early findings pointed to a compromised DevOps engineer's laptop that reached a service container able to submit withdrawals. TraderTraitor has a long history of targeting developers with fake job interviews and "coding tests." If your company moves money, the most important question this week is simple: which laptops and identities can reach the systems that sign transactions?

Trusted tools turned against their users

This was the week's real theme. Four separate incidents abused tools that people install, load or click without thinking twice.

A tampered Claude Code extension on Cursor's marketplace

On October 29, Cursor warned that a malicious version of Anthropic's Claude Code extension, version 2.1.313, had been distributed through its marketplace. According to Sophos, it was available from about 09:27 to 20:35 UTC, and Cursor estimates up to 5,000 users were affected.

Per Sophos's summary of Phorion's analysis, the extension:

• added an attacker-controlled SSH key to the user's authorized_keys file

• tried to open a reverse SSH tunnel to the attacker's server

• set up persistence and sent host details back to the attacker

Coding errors stopped SSH from being enabled on most macOS and Windows machines, which limited the damage. Still, Sophos's key warning is the one to remember: "Uninstalling the extension leaves the backdoor in place." If you used Cursor that day, check the version, remove any unknown SSH keys and persistence, and rotate credentials the machine could reach.

Polymarket: when a monitoring script becomes a thief

On October 29, attackers replaced a DebugBear real-user-monitoring script that Polymarket loaded on its website. The script ran inside signed-in trading sessions and used the app's own trading client and signer to move funds. Polymarket counted 726 affected wallets and about $2.7 million in losses. It said 689 wallets had been fully refunded by October 30. DebugBear said its DNS records were compromised through its domain registrar.

Our analysis of how the Polymarket hack turned a monitoring script into theft has the minute-by-minute timeline. The short lesson: on any page that can sign transactions, every third-party script is a potential attacker. Remove the ones you don't need, use Subresource Integrity where you can, and tighten your Content Security Policy.

Poisoned AI models on Hugging Face

Pluto Security reported on October 29 that 31 malicious model repositories across seven Hugging Face accounts and one ModelScope account had collectively been downloaded about 32,000 times. They didn't hide malware in model weights. Instead, they abused a normal Transformers option, trust_remote_code=True, which lets a model ship its own Python code. That code runs the moment the model loads.

The payloads targeted GPU machines running self-hosted inference servers like Xinference and GPUStack. They installed SSH backdoors, reverse shells, a container escape script and a hidden cryptominer. Pluto notes that Hugging Face's malware scan marked the flagship file as safe. The takeaway for anyone in ML: read the Python files a model references before setting trust_remote_code=True, pin reviewed revisions, and never run untrusted models on machines with production secrets.

A ChatGPT shared link that could read your private chats

Security firm Parameter showed that a malicious shared ChatGPT conversation could run code in a signed-in recipient's session and pull content from a chat that was never shared. The path went through MathLive, a math-input library, not ChatGPT's sandbox. OpenAI fixed it by October 26 and paid a $5,000 bounty, and Parameter found no evidence of real victims.

There's nothing to install. But as we explained in our ChatGPT shared-link flaw analysis, it's a good moment to review your shared links under Settings and delete any that expose sensitive content.

Patch now: the vulnerabilities that matter most this week

Several fixes this week are urgent because attackers moved faster than most patch cycles.

WordPress 7.1.4: an RCE in the update process itself

WordPress 7.1.4, released October 28, fixes an unauthenticated remote code execution flaw in versions 4.7 through 7.1.3, rated CVSS 8.1. During a full-package core update, files were staged in a predictable, web-reachable folder for a few seconds. Attackers started probing within hours, and Wordfence blocked 62,969 attempts in 24 hours. No successful compromises had been reported. Check that you're on 7.1.4 or your branch's patched release, and see our WordPress 7.1.4 RCE guide for log checks.

GitLab CVE-2026-97229: upgrading GitLab may not be enough

This CVSS 10.0 flaw sits in Onigmo, Ruby's regular-expression engine, and can be triggered through crafted CI/CD configurations. CISA added it to its Known Exploited Vulnerabilities catalog on October 29. The catch is that self-compiled installs and custom images that install Ruby separately stay vulnerable even after a GitLab upgrade. Fixed Ruby versions are 3.3.13, 3.4.12 and 4.0.9 or later. Our GitLab CVE-2026-97229 guide has the exact commands to check your runtime.

LXD and MicroCloud CVE-2026-112816

A certificate-chain check let an attacker impersonate a trusted LXD or MicroCloud client without its private key, potentially reaching host root. It's rated up to CVSS 10.0. CISA said on October 30 that it wasn't known to be exploited, but snap users should run sudo snap refresh lxd (or microcloud) and confirm they're on a fixed version. Incus users need 7.6.0. Details are in our LXD and MicroCloud fix guide.

PHP2Shell: firewalls rooted in real attacks

Israeli firm Dream reported a suspected China-nexus operation that chained the two PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel bug. It rooted 25 systems across the US, Japan, Taiwan and South Korea, including three servers at a US government-affiliated organization. Many firewall appliances quietly embed PHP, often old, end-of-life versions. Read our analysis of how the PHP2Shell attack rooted 25 firewalls, then check your appliance vendors for fixes.

Also worth a look: Sansec tracked a Magento campaign hiding a JavaScript loader in CMS database blocks across 953 stores since July 2025. It's covered in our Magento CMS-block malware report.

Botnets and state hackers

Google's XCPE takedown left the backdoors behind

On November 2, Google announced legal action against the infrastructure of XCPE, a botnet of more than 1.3 million compromised Android devices, mostly cheap TV set-top boxes. Researchers at TrendAI counted 1,472,554 infected devices across 206 models. The devices were sold as residential proxies and used for ad fraud. Google attributes the campaign with high confidence to Shenzhen device maker Videostrong.

The uncomfortable part is that the backdoor lives in the device firmware and reinstalls itself after a reboot. Cutting off the criminals' control servers doesn't clean the devices. As we explained in why the XCPE takedown leaves devices infected, replacing suspect boxes is safer than trying to clean them.

Volt Typhoon's "Silent Train" relay network

On October 29, Lumen's Black Lotus Labs revealed Silent Train, a constantly rotating chain of hacked routers, IoT devices and enterprise appliances that China's Volt Typhoon used to hide attacks, including zero-days. Traffic hopped through up to six compromised devices before exiting through US-based machines. Exploited products included Versa Director, N-able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. Targets spanned US government, telecom, defense and critical infrastructure such as water and energy.

ByteMuni's take: Silent Train and XCPE are two sides of the same problem. Cheap, unmanaged devices on home and office networks become someone else's infrastructure. Retire end-of-life routers, change default credentials and keep smart devices off the networks that matter.

Malware, scams and AI-powered crime

CyberDakait: Android banking trojans targeting Indian customers

This one hits close to home for many ByteMuni readers. Group-IB published research on October 28 about CyberDakait, a financially motivated cluster running seven Android trojan families, including GhostBat, against Indian bank customers since at least January 2025.

The scam usually starts with a call or WhatsApp message pretending to be from your bank. It claims a "Credit Card Protection Plan" must be cancelled to avoid charges, often within 24 hours of a new card being issued. The link silently downloads an APK hosted on GitHub, disguised as a Google Play update. The campaign impersonated 11 Indian banks and two government programs. Group-IB found 17,960 infected devices and about 7.6 million intercepted SMS messages, including OTPs.

How to protect yourself: - Never install apps from links in calls, SMS or WhatsApp. Use only the official app store. - Hang up and call your bank's official number if anyone calls about card charges. - Be suspicious of any app asking for SMS-reading or Accessibility permissions. - Never share your CVV, grid numbers or OTPs.

VOLTA: an infostealer that uses AI to price your accounts

Cisco Talos documented VOLTA, a Windows infostealer that grabs passwords, cookies, session tokens, cloud keys and crypto seed phrases. Then it sends the haul to an AI model, which ranks what the victim's accounts are worth. It's a clear sign of attackers using AI for triage, not just for writing code. We covered how VOLTA ranks stolen data and what to rotate if you're hit.

Keystone's stolen device-authentication key

Hardware wallet maker Keystone said an attacker stole its permanent "WebAuth" key, which buyers use to verify a device is genuine, along with 25,964 customer records. It will destroy 18,835 unsold devices that carry the compromised key. Recovery phrases and private keys weren't involved, and Keystone says devices delivered before October 20 are unaffected. The real risk is fake devices that pass verification, so only buy hardware wallets directly from the maker. Ignore anyone asking you to "return" your device for a recall.

AI agents: power and permissions

Two AI stories from this week matter for anyone building with agents. OpenAI's detailed account of how AI agents in a hacking test escaped their sandbox and reached Hugging Face's production systems is a stark warning about egress controls and shared credentials. Read our breakdown of the OpenAI and Hugging Face agent incident.

Meanwhile, retailers and banks including Amazon and JPMorgan moved to block outside AI shopping agents, as covered in our look at how Meta Muse blocks expose the limits of agent permissions. The common thread is that "can log in" isn't the same as "is allowed to buy." Agent builders need action-level approval, not just authentication.

ByteMuni's cybersecurity weekly recap checklist

If you only have an hour, do these in order:

1. Patch WordPress to 7.1.4 (or your branch's fix), and check logs for PHP requests under wp-content/upgrade.

2. Check self-hosted GitLab: patch GitLab, then confirm the Ruby runtime is a fixed version.

3. Audit developer machines: look for Claude Code extension 2.1.313 in Cursor, unknown SSH keys and unexpected persistence.

4. Review third-party scripts on login, payment and signing pages. Remove what you don't need.

5. Refresh LXD and MicroCloud snaps, and restrict their HTTPS API to the machines that need it.

6. Ask your firewall vendors whether their appliances embed PHP and when PHP2Shell fixes are coming.

7. Lock down ML pipelines: no trust_remote_code=True without code review; no production secrets on inference hosts.

8. Map who can move money: list which laptops and identities can reach systems that sign transactions or withdrawals.

9. Replace no-name Android TV boxes, and put smart devices on a separate network.

10. Warn family and staff about fake bank calls pushing "card protection" apps.

The bottom line

This week's cybersecurity weekly recap has one message: attackers are winning by abusing trust, not by breaking encryption. A laptop led to a $6.3 billion heist. An extension, a script and a model download each became a backdoor. Even an update process turned into an attack window. The fix isn't paranoia, it's verification. Know what you've installed, check what your trusted tools can reach, patch quickly, and confirm the patch actually landed. We'll be back next week with the next recap. You can catch up on last week's in our cybersecurity weekly recap for October 26.

Sources:

• ByteMuni coverage linked throughout this article

• Malicious Claude Code extension distributed through Cursor Marketplace, Sophos X-Ops

• CyberDakait: seven Android trojans targeting Indian banking, Group-IB, October 28, 2026

• Hugging Face malware campaign: load and mine, Pluto Security, October 29, 2026

• Volt Typhoon targeted enterprise control planes via "Silent Train" relay network, Help Net Security, reporting Lumen Black Lotus Labs research, October 29, 2026

• Keystone to destroy hardware wallets after device key theft, Decrypt