North Korea Tied to $6.3B Binance Theft; Chainalysis Breach, Ivanti KEV Deadline

CISA Adds Actively Exploited WordPress Core Flaw to KEV Catalog

CISA added CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. The flaw can let attackers execute code on a server during the upgrade window because of predictable, web-accessible staging paths used during core upgrades. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV Catalog entries on internet-facing assets that grant total control after exploitation, and CISA encourages all organizations to adopt the same risk-based patching approach. (CISA)

CISA Orders Agencies to Patch Exploited Ivanti Connect Secure Flaws

CISA added two newly disclosed Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its KEV catalog after Ivanti updated an advisory describing active zero-day exploitation chained with a third flaw, CVE-2026-104935. Volexity found attackers using the chain to gain a network foothold, steal credentials, and query Active Directory for LAPS passwords and BitLocker recovery keys. Federal agencies had to remediate CVE-2026-111357 by November 2, 2026, with a November 13 deadline for the second flaw, and Rapid7 recommends hunting for compromise even after patching since the activity evades Ivanti's Integrity Checker Tool. (Help Net Security)

FBI Attributes $6.3 Billion Binance Crypto Theft to North Korea

The FBI confirmed that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, tying the attack to the TraderTraitor group previously named in the Bybit hack. Working with the US Secret Service and IRS Criminal Investigation, the FBI published 628 associated wallet addresses and urged crypto platforms to block related transactions. Binance began phased withdrawal restoration on November 1, 2026, and has replaced about 95% of the stolen assets with its own funds while investigators continue tracing the laundering trail. (Help Net Security)

Chainalysis Discloses Breach via "Offensive Agentic Techniques," Pulls Products Offline

Blockchain analytics firm Chainalysis disclosed a cybersecurity incident in which external attackers used what it called offensive agentic techniques to access internal systems and tools in October. The company said customer IDs, full names, email addresses, and organization role labels for platform users were accessed. On November 3, Chainalysis said it had proactively taken certain products, including Reactor and Data Solutions, offline while third-party cybersecurity experts complete additional security assessments before restoring service, and it continues to urge customers to watch for unexpected password reset or authentication prompts. (Help Net Security)

Second Wave of Refrigeration Hacks Hits European Supermarkets, Draws CISA, NCSC Scrutiny

A second wave of cyberattacks on supermarket refrigeration control systems hit Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia and the Netherlands on November 2, 2026, following a similar October incident in France that spoiled food at hundreds of stores. The European Commission convened a meeting of the EU interinstitutional task force, the UK NCSC confirmed it is supporting affected organizations, and CISA said it has been "actively monitoring and assessing" the activity targeting refrigeration and cold-chain systems. US military investigators have also worked with French authorities on related refrigerator outages at domestic commissary facilities. (Cybersecurity Dive)

Check Point Names Ex-Fidelity CISO Adam Ely Chief Business Officer

Check Point Software Technologies appointed Adam Ely as Chief Business Officer on November 3, 2026, to lead company-wide growth strategy across its four pillars: Hybrid Mesh Network Security, Workspace Security, Exposure Management and AI Security. Ely previously served as CISO at Fidelity Investments, later led its Digital group, and held security roles at Walmart, Salesforce and The Walt Disney Company. He co-founded Bluebox Security, acquired in 2016, and will work across product, go-to-market, corporate development and strategic partnerships while deepening ties with customers and chief information security officers. (PR Newswire)

Attackers Exploit Critical Node-RED Flaw to Backdoor Siemens ICS Devices

VulnCheck found attackers actively exploiting CVE-2026-58115, an authentication flaw in Node-RED embedded in Siemens' SIMATIC IoT2050 Advanced and rated CVSS 10.0 by Siemens, to deploy a Linux bot and webshells on unprotected servers starting October 30, 2026. The exploit chains a built-in inject node and exec node so a flow runs a shell command with no further interaction, and the same source IP also hit eight other CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla. VulnCheck added the flaw to its own KEV catalog; CISA had not listed it at the time of writing. (Help Net Security)