Today's outlook

Patch Chrome now — Google lists six critical flaws; FBI pins $6.3bn Binance heist on North Korea

By The IT Security Desk

Good morning. Google's advisory lists six critical vulnerabilities in Chrome. CVE-2026-119263 and CVE-2026-119261, each carrying a CVSS 3.1 base score of 9.6 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), are fixed in Chrome 156.0.8078.79. CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340, also scored 9.6 on the same vector, are fixed in 156.0.8078.73, as is CVE-2026-118337 (CVSS 9.3, vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). None are listed on CISA's Known Exploited Vulnerabilities catalog. All six are network-reachable and require user interaction. Google's advisory states earlier Chrome builds are affected up to these fixed releases; update desktop Chrome to the named version and restart the browser to apply it.

The Hacker News reports a critical flaw in Canonical's LXD and MicroCloud that lets an attacker log in as a trusted client without holding that client's private key. The Hacker News says the attacker needs network reach to the HTTPS API and the trusted client's public certificate, after which they act as that client. Follow Canonical's advisory for the fix.

Two third-party supply-chain incidents land the same day. BleepingComputer reports that Northflank is warning customers to rotate all credentials and secrets stored on its platform after a breach led to unauthorized use of customers' AI API keys. The Hacker News reports that malicious code on Polymarket's website — which had replaced a page-speed script loaded from DebugBear — sold some signed-in traders' positions and moved funds to the attackers on 29 October; The Hacker News says Polymarket is refunding about $2.7 million to 726 affected wallets. BleepingComputer also reports that hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on 20–21 October, prompting the project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.

On threat activity: BleepingComputer and The Hacker News report the FBI has attributed the theft of more than $6 billion in virtual assets from Binance to the North Korea-aligned group TraderTraitor, also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. The Hacker News reports that Kaspersky this week detailed NetamLoader, part of an infection chain targeting government organizations in Asia that uses .NET injection against a custom Windows 10 build used exclusively by those entities. Review these indicators against your estate and apply the patches and credential rotations above.