An AI model wrote an exploit for a critical Linux kernel flaw, CVE-2026-98432 rated CVSS 9.8, that lets attackers run root commands on Linux servers with a multipath TCP listener. Attackers are actively exploiting a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices running Node-RED to run malicious code. Attackers escalated to root on Ivanti Connect Secure 22.8R2.4, and the October 13 fixes didn't stop it. WorkOS reported unauthorized access to an internal sales app that exposed customer contact info and business conversation records. And the new Volta infostealer uses AI to rank its Windows victims by financial worth, then sends stolen cookies and cards out over Telegram.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-11-03-2026

0:00 Linux kernel use-after-free flaw and patch versions
1:10 Active exploitation of Siemens IoT2050 devices
2:12 Ivanti Connect Secure privilege escalation
3:10 WorkOS investigates access to internal sales app
3:39 Volta infostealer uses AI to assess victims

#Cybersecurity #Linux #Siemens #Ivanti #Infostealer

An attacker abused ConnectWise credentials to access 162 Microsoft 365 tenants, and in one tenant a ConnectWise cloud app added itself to the Global Administrator role. BeyondTrust Remote Support 2.6.2.3 and earlier has a flaw that lets an unauthenticated attacker write files and run code. LiteLLM version 1.107.0 spread credential-stealing malware, and tens of thousands of users lost their API keys. DebugBear code drained 710 Polymarket wallets of $2.7 million in a supply chain attack. A TeamViewer flaw, rated CVSS 8.8, lets a compromised machine hijack the support technician's computer the moment a session opens. And French supermarket refrigeration controllers were compromised overnight, forcing staff to clear damaged stock.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-11-02-2026

0:00 ConnectWise access reaches 162 Microsoft 365 tenants
2:07 BeyondTrust flaw enables unauthenticated code execution
3:13 LiteLLM supply-chain malware steals API credentials
4:08 DebugBear code linked to Polymarket wallet theft
4:47 TeamViewer session flaw threatens support technicians
5:41 Compromised refrigeration controllers affect French stores

#Cybersecurity #ConnectWise #Microsoft365 #SupplyChain #TeamViewer

Anthropic's unreleased Claude model chained zero-days into working exploits, including a CVSS 9.8 Linux kernel flaw that leaves unpatched servers open to root access without any user interaction. A group calling itself the Department of Peace leaked records on more than 41,000 DHS employees, copied from the agency's Okta single sign-on system. Polymarket traders lost funds to malicious code served from Debug Bear. A Volt Typhoon-linked actor has exploited a Cisco SD-WAN zero-day since 2023. The FBI arrested a third ShinyHunters suspect as the group claims more than $70 million in extortion. And Binance lost $6.3 billion to Lazarus subgroup TraderTraitor, the largest crypto heist in history.

The hot sheet: https://blog.thehotdrop.live/blog/the-hot-drop-for-10-30-2026

0:00 Claude Model Chains Zero-Days Into Root Exploits
1:52 41,000 DHS Records Leaked From Okta
4:24 Polymarket Traders Drained by Debug Bear Script
6:01 Volt Typhoon-Linked Cisco SD-WAN Zero-Day
6:32 Third ShinyHunters Arrest, $70M Extortion Claim
7:35 Lazarus Hits Binance for $6.3 Billion

#Cybersecurity #ZeroDay #Anthropic #DataBreach #Binance