Daily Briefing

Patch Chrome now — Google lists six critical flaws; FBI pins $6.3bn Binance heist on North Korea

By The IT Security Desk

Good morning. Google's advisory lists six critical vulnerabilities in Chrome. CVE-2026-119263 and CVE-2026-119261, each carrying a CVSS 3.1 base score of 9.6 (vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), are fixed in Chrome 156.0.8078.79. CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340, also scored 9.6 on the same vector, are fixed in 156.0.8078.73, as is CVE-2026-118337 (CVSS 9.3, vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). None are listed on CISA's Known Exploited Vulnerabilities catalog. All six are network-reachable and require user interaction. Google's advisory states earlier Chrome builds are affected up to these fixed releases; update desktop Chrome to the named version and restart the browser to apply it.

The Hacker News reports a critical flaw in Canonical's LXD and MicroCloud that lets an attacker log in as a trusted client without holding that client's private key. The Hacker News says the attacker needs network reach to the HTTPS API and the trusted client's public certificate, after which they act as that client. Follow Canonical's advisory for the fix.

Two third-party supply-chain incidents land the same day. BleepingComputer reports that Northflank is warning customers to rotate all credentials and secrets stored on its platform after a breach led to unauthorized use of customers' AI API keys. The Hacker News reports that malicious code on Polymarket's website — which had replaced a page-speed script loaded from DebugBear — sold some signed-in traders' positions and moved funds to the attackers on 29 October; The Hacker News says Polymarket is refunding about $2.7 million to 726 affected wallets. BleepingComputer also reports that hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on 20–21 October, prompting the project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.

Read the full briefing →

Zoom out: Help Net Security's week in review names the $6.3 billion Binance theft and the impact of a Brotli vulnerability among last week's most interesting stories.

Vulnerability in focus

CVE-2026-119263 — Google. CVSS 9.6

Affected: chrome.

What to do: Follow the vendor advisory for the fixed release and any interim mitigation.

Elsewhere

Help Net Security: Byoky: Open-source wallet for AI API keys Read it
BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers Read it
BleepingComputer: Alpine Linux rebuilds GitLab after attempted RCE attack Read it
SecurityWeek: Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations Read it
The Hacker News: CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key Read it
Help Net Security: Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability Read it
The Hacker News: FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist Read it
The Hacker News: Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script Read it

Sources

FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer
Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations SecurityWeek
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability Help Net Security
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News
Alpine Linux rebuilds GitLab after attempted RCE attack BleepingComputer
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script The Hacker News
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection The Hacker News
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist The Hacker News
Northflank security breach leads to abuse of customers' AI API keys BleepingComputer

Share this issue

Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky

Every briefing is on the site, with the advisory record behind it. All briefings