Nov 3, 2026
3 new incidents, 3 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Started
- LivePatched
Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802)
Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes.
Better Auth (@better-auth/expo, better-auth on npm)Since Nov 3, 2026
- LivePatched
Puppet and OpenVox servers hit by critical RCE and client impersonation bugs (CVE-2026-115731, CVE-2026-115732)
Puppet by Perforce and the OpenVox fork released coordinated fixes on Nov 3 2026 for two critical bugs found by Neodyme that affect all known Puppet and OpenVox versions, going back at least to open-source Puppet 6.24.0 from July 2021. CVE-2026-115731 lets any client holding a CA-signed agent certificate run arbitrary code on the Puppet/OpenVox server as its service user by submitting a report with a crafted rich-data event, because the event is deserialized into Ruby code. CVE-2026-115732 is a flaw in trapperkeeper-authorization's certificate-name matching that lets a certificate such as evil.target.example.com be authorized as target.example.com, exposing that node's catalog and secrets, and in Puppet Enterprise it can lead to CA administration and commands on managed nodes. Where the CA autosigns certificate requests without strong verification, an unauthenticated attacker can get the certificate both bugs need. Neodyme's writeup shows the server RCE being used to steal the CA signing key and run commands as root on managed agents. Upgrade OpenVox to openvox-agent 8.32.0 or 9.3.0, openvox-server 8.18.0 or 9.2.0 and openvoxdb 8.18.0 or 9.2.0, or Puppet Enterprise to 2023.8.13, 2025.12.1 or 2026.0.1 (Puppet Core 9.1.3, Puppet Server 9.0.24.1), then restart the server. OpenVox says open-source Puppet will not get security updates and recommends migrating.
Puppet Server / Puppet Enterprise (Perforce) and OpenVox (openvox-agent, openvox-server, openvoxdb)Since Nov 3, 2026
- LivePatched
Chrome 157 fixes 213 security bugs, 7 of them critical (none known exploited)
Google promoted Chrome 157 to the stable channel on Nov 3 2026 (157.0.8103.38 on Linux, 157.0.8103.38/.39 on Windows and Mac) with 213 security fixes. Seven are rated critical: buffer overflows in Dawn (CVE-2026-121156, CVE-2026-121247), memory corruption in ANGLE (CVE-2026-121229), and use-after-free bugs in WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203) and Core (CVE-2026-121126). Many of the high-severity bugs were credited to AI-assisted research from Anthropic and OpenAI Codex Security. Google has not said any are exploited. The rollout is staged over days or weeks, so update and relaunch rather than waiting.
Google Chrome (desktop)Since Nov 3, 2026
Updated
- LiveMediumPartly patched
WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data
WorkOS, the developer platform that provides enterprise SSO, user management and directory sync APIs to thousands of companies, says it identified unauthorized access to an internal application used by its sales team on Oct 30 2026. In a Nov 2 bulletin it says the attacker accessed business contact details (names, emails, phone numbers, job titles, companies) from its CRM, account and relationship histories, summaries and excerpts from sales calls, support discussions and customer Slack conversations, and operational metadata about customers' product usage and connection or directory health. WorkOS says there is no evidence that WorkOS application data or production services were accessed, and that the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation; CEO Michael Grinich later named it as the ARTEX AI framework. WorkOS disabled external access to the app, hired an outside forensics firm and is notifying affected customers directly. Customers have nothing to patch, but should expect targeted phishing that uses the exposed contact and conversation details.
WorkOS (internal sales application, CRM and support data)Since Oct 30, 2026
- LivePatched
Binance says a fake job interview started its $6.3B hack; it has rebuilt the affected wallet system and will cover all losses
On Oct 29 2026 at about 20:24 UTC, more than $2B in ETH and tokens left Binance hot wallets (labeled Binance 14 and Binance 16 on Etherscan) for an address created that day, according to Etherscan data reported by BeInCrypto. The transfer was triggered by a wallet funded only through Tornado Cash, and the receiving address quickly forwarded about 195,460 ETH (around $450M) to another fresh address. Binance says it is aware of reports of a potential security issue, is actively investigating and that user funds are completely safe; it has not confirmed a breach or a loss total. Founder CZ, who no longer runs Binance, said it does look like a hack and that he expects all user funds to be fully covered. Tether CEO Paolo Ardoino said Tether froze more than 1.567B USDT tied to a potential Binance exchange hack, and Circle CEO Jeremy Allaire said Circle froze more than 800M USDC in coordination with law enforcement; Binance co-founder Yi He later thanked Ripple for freezing about 200 million more. Blockaid says the attacker used an EIP-7702 authorization to turn the Binance 14 hot wallet into a sweeper contract only the attacker can drain. Binance later paused withdrawals, saying they will resume once the security issue is fully resolved, and CZ said the loss might be a bit higher than the roughly $1B left after freezes but will be covered. World Liberty Financial froze $27M in USD1 linked to the hack. Binance.US says it is a separate platform and is not affected. If confirmed, it would be the largest exchange hack on record. Binance then said the current verified total frozen is $2.54 billion and suspended Binance Alpha trading, and co-founder Yi He said Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow; Binance's official account repeated that Binance will cover all losses and that all deposits and withdrawals are suspended. The Arbitrum Security Council moved 74,559,805 ARB and 8,425 ETH held by an exploit-linked Arbitrum One address into a frozen wallet. Binance later updated its verified total frozen to around $3 billion. Chainalysis estimates about $5.912B was stolen at the time of theft, nearly four times the 2025 Bybit heist, which would make it the largest crypto theft on record. Binance then gave its first official figures: its initial investigation suggests a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorized withdrawal transactions, it has found no evidence of a wallet private key leak, the estimated total impact is around $6.3B with about $3B frozen on-chain, and it will cover all losses from the SAFU fund and company funds. It says it revoked the affected address authorisation and will publish a technical post-mortem and an updated Proof of Reserves. Yi He later said deposits are unaffected and operating as normal and that Binance expects to begin resuming withdrawals within the next 48 hours after enhancing the withdrawal service and address controls. Binance then said that while its initial investigation suggested a compromised laptop, its subsequent investigation has uncovered additional points of breach, calling it a complex attack. Co-CEO Richard Teng later said in a video update that the attacker used a self-destruct mechanism to erase traces and an EIP-7702 delegation that bypassed Binance's normal approval controls, that Binance has reserved more than $6.34B of company funds to cover all losses, and that it aims to restore withdrawals by Sunday, with an initial proof-of-reserves update before a full report on Monday. Binance users have nothing to patch: watch for official updates only through Binance's own channels and ignore unofficial links or requests for account details, which Binance warns are circulating. On Nov 3 Binance published its initial findings: in September a software engineer was approached on a legitimate job platform by a fake recruiter and, after two fake interviews, ran a coding assignment whose malware replaced the Homebrew pyenv executable on his work Mac and went undetected by endpoint security; by Oct 20 the attackers used that machine and a compromised internal AI tool to compromise two wallet-infrastructure engineers and obtain credentials and a container deployment token, which they used on Oct 29 to deploy a malicious script and reach Binance's wallet signing service. Binance says it has rebuilt the affected wallet system and internal AI tool, replaced affected devices and revoked the engineers' credentials and tokens; about $2.85B had been frozen or intercepted as of Nov 3.
Binance (exchange hot wallets)Since Oct 29, 2026
- LivePatched
Linux kernel CVE-2026-98432: TCP use-after-free rated 9.8, Anthropic says its AI built a remote root exploit
CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP handshake code (ireq_opt/inet_opt freed without an RCU grace period), fixed upstream on Oct 15 and rated 9.8 by the kernel CNA. On Oct 28 Anthropic said an unreleased Claude model turned the bug into a zero-click remote root exploit against servers running a multipath TCP listener (about 48 minutes to defeat KASLR, five more to get a shell). The exploit was built in a lab and is not known to be used in attacks. Update to a fixed stable kernel.
Linux kernel (IPv4 TCP)Since Oct 15, 2026
