by sig9
Hacker Wars - October 30, 2026
Your daily dose of infosec chaos
Some weeks the internet quietly bleeds in the background, and some weeks 6.3 billion dollars walks out of the world’s largest exchange through one compromised DevOps laptop with North Korean fingerprints all over it. Today also brought a perfect-10 GitLab RCE being exploited against Alpine Linux, a supply chain attack fleecing Polymarket traders through a poisoned monitoring tool, an auth bypass actively exploited in Drupal Commerce, and a TeamViewer bug that lets the client pwn the support tech. Pour something strong.
Binance’s $6.3 Billion Heist Started On One DevOps Laptop
Attackers walked away with roughly $6.3 billion in crypto from Binance, and the entry point was a DevOps engineer’s compromised laptop - nearly $3 billion has since been frozen on-chain with an assist from Tether and Circle. Blockchain analysts see the hallmarks of North Korea’s TraderTraitor crew, which makes this a long-game social engineering job against a privileged developer rather than some clever smart contract exploit.
What to do: Treat developer workstations as tier-0 assets - enforce hardware-backed MFA, keep build and deployment credentials away from daily browsing, and put out-of-band approvals on anything that can move funds.
Perfect-10 GitLab RCE Is Being Exploited Against Alpine Linux
CVE-2026-97229 is a max-severity flaw that lets unauthenticated attackers execute code on the server, and it has already been used against Alpine Linux’s infrastructure. CISA has added it to the known-exploited catalog, so if your GitLab instance is internet-reachable, assume someone is already knocking.
What to do: Patch GitLab to the fixed release today, restrict access to your GitLab endpoints, and review runners, pipelines, and tokens for anything created or modified in the last few days.
Polymarket Traders Lose $2 Million To A Supply Chain Trojan
Attackers poisoned a website monitoring tool in a supply chain attack that hijacked logged-in Polymarket sessions and siphoned more than $2 million from traders. No phishing required - the malicious code rode in through a tool the site itself loaded, grabbed live session cookies, and went shopping with them.
What to do: Inventory and pin the third-party scripts on anything handling money or sessions, use subresource integrity, and keep session lifetimes short for high-value accounts.
Drupal Commerce Auth Bypass Is Being Exploited In The Wild
Drupal is warning that a missing authorization flaw in Commerce Core, CVE-2026-118539, is being actively exploited against a wide range of releases up to 3.3.13. An auth bypass on an e-commerce backend is exactly as bad as it sounds: order data, customer details, and checkout flows reachable without valid credentials.
What to do: Update Commerce Core to the patched release now, and until you do, restrict admin and checkout endpoints at the web server or WAF level.
TeamViewer Flaw Turns The Tables On Support Technicians
An integer overflow in TeamViewer, CVE-2026-111585, flips the usual remote support risk: a malicious host can execute code on the technician’s machine instead of the other way around. That is a dream setup for anyone who likes to fish for enterprise access straight through the help desk.
What to do: Patch TeamViewer everywhere, and have support staff connect only from isolated, hardened workstations - never from their daily-driver admin machines.
Catch you tomorrow. In the meantime, go check your attack surface.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.