The Daily Index — Monday, November 2, 2026 · TLDR Index

ATTACKS & VULNERABILITIES

TLDR InfoSec

TLDR InfoSec

ANTHROPIC VS CODE EXTENSION ON CURSOR BACKDOORED FOR NEARLY 12 HOURS

A malicious Claude VS Code extension, version 2.1.313, was published through Anthropic's official Cursor account. It targeted up to 5,000 developers, collected host and environment details, and tried to add an SSH key and open a reverse tunnel. Bugs limited persistence on Windows and macOS. Cursor removed it, blocked its server, rotated keys, and audited the marketplace, but users who installed or updated it on Thursday should check the published indicators of compromise.

arstechnica.com · 2 min

TLDR InfoSec

HACKERS STEAL ABOUT $2.7 MILLION FROM POLYMARKET TRADERS VIA HIJACKED DEBUGBEAR SCRIPT

A hijacked DebugBear script on Polymarket's site used signed-in traders' browser sessions to sell or transfer their positions on October 29. Attackers received about $2.64 million in POL from 33 wallets within 52 minutes. Polymarket is refunding $3.9 million, including $2.7 million to 726 affected wallets. The compromise began through DebugBear's domain registrar.

thehackernews.com · 3 min

TLDR InfoSec

APPRAISAL BY AI: MODEL-DRIVEN VICTIM PRIORITIZATION IN THE VOLTA INFOSTEALER

VOLTA takes a "steal everything, let AI sort it out" approach: it grabs credentials, sessions, wallets, and cloud keys, then uses the victim's own Gmail, DoorDash, and Discord sessions to confirm details like a home address. It sends the resulting dossier through OpenRouter to Claude, falling back to Kimi and then Gemini if a model refuses, and gets back a ranked "WHAT THEY'RE WORTH" assessment of what the victim's assets could fetch. Talos assessed VOLTA as a commodity builder that runs entirely on third-party infrastructure. They recommended that defenders block or alert on non-developer processes launching Chrome with --headless, since that is how the stealer gets around App-Bound Encryption.

blog.talosintelligence.com · 8 min

TLDR InfoSec

DISCOVERING A BACKDOOR AND FLAWS IN MORE ENCRYPTED USB DRIVES

Vector 35 researcher Xusheng Li pointed Codex at Binary Ninja's MCP server and recovered the keys hardcoded in NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure in 7 to 26 minutes each. In each product, the key was fixed in the binary, derived from an embedded seed, or unlocked by a certificate in the viewer, so the user's password never protected the files. Separately, time-travel debugging turned up two hidden accounts in SecZure's YutianDun drive, with passwords as weak as "123456", that could decrypt any file. Li skipped vendor disclosure because drives already in the field can't be patched, and he argued that client-side validation is never secure, so buyers should only trust drives that derive their encryption key from the user's password.

binary.ninja · 10 min

TLDR InfoSec

NORTHSTAR SECURITY (PRODUCT LAUNCH)

Northstar Security provides a Security Context Graph from existing security and IT tools. It maps identities, assets, applications, vulnerabilities, and business systems, then flags risky combinations and starts supervised fixes such as installing endpoint protection or limiting access.

northstar.security

TLDR InfoSec

MAX-SEVERITY GITLAB VULNERABILITY EXPLOITED AGAINST ALPINE LINUX

CVE-2026-97229, a CVSS 10 flaw in Ruby's Onigmo regex engine, lets unauthenticated attackers execute code through crafted GitLab CI/CD configurations. Attackers targeted Alpine Linux on October 20 to 21, crashed worker processes, and downloaded its container image. Alpine found no confirmed code execution or repository tampering, rebuilt the instance, and reset passwords. CISA added the bug to KEV. GitLab-only updates may be insufficient for custom Ruby deployments. Use Ruby 3.3.13, 3.4.12, 4.0.9, or later.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CVE-2026-98432: WHICH LINUX KERNELS ARE STILL VULNERABLE

Mattias Geniar found 712 Multipath TCP listeners on his own Ubuntu 26.04 laptop, opened without his knowledge by Go programs like tailscaled, because Go 1.24 and later enable MPTCP on listening sockets by default. That matters because the only known exploit for CVE-2026-98432 needs an MPTCP listener. The bug is a use-after-free in the kernel's IPv4 TCP handshake that dates back to Linux 4.4 and can be reached with a single SYN. Upstream stable kernels were fixed in mid-October, and Debian, Amazon Linux, and Oracle UEK have shipped patches, but Ubuntu and RHEL still had no fixed kernel as of November 1.

ma.ttias.be · 5 min

TLDR InfoSec

LEGAL EXPLOITS MAY EMERGE AT SCALE

The authors argue that legal systems may have dormant “vulnerabilities” that an attacker can leverage with an LLM to find and exploit. They present an example from the German legal system, which requires executive regulations to cite their legal basis. The authors then showcase a selection of regulations with provisions lacking proper citations, which could render them void and unenforceable.

felixringe.com · 4 min

TLDR InfoSec

APPLEBEE'S EXPOSED CUSTOMERS' PERSONAL DATA AFTER LEAVING DATABASE PASSWORD IN APP

A researcher found a hardcoded database password in Applebee's Android app.

techcrunch.com · 2 min

TLDR InfoSec

BELGIUM'S TAX AGENCY CONFIRMS CYBERATTACK, PULLS SERVICES OFFLINE

Belgium's FOD Financiën took MyMinfin, Tax-on-web, and Biztax offline after a cyberattack - there are no indications of a data breach, but investigations are ongoing.

theregister.com · 2 min

TLDR InfoSec

IMPLANT REPORTED IN A TREZOR SOLD BY CRYPTOBILIS

An Indonesian customer reported finding an extra circuit board with a cellular modem inside a Trezor Safe 5 bought from former Southeast Asian reseller CryptoBilis.

trezor.io · 5 min