Tech • AI • Robotics • Game
The worst week in cybersecurity history... so far
9.4/10TL;DR
A week of major security failures saw a compromised coding extension, a supply-chain attack on Polymarket, a $6.3 billion theft from Binance, and a critical Linux kernel flaw shown to be remotely exploitable with AI assistance.
KEY POINTS
Cursor extension exposed developer machines
An official Cursor extension for Claude Code was briefly released with dangerous behavior that scanned local machines for keys and tokens and created a backdoor for later access. The package was available for about 11 hours and was installed by roughly 5,000 users before being pulled. The impact was somewhat limited because the persistence mechanism required administrator rights, permissions many users do not grant to a code editor.
Polymarket users lost funds through third-party script hijack
Users of Polymarket reported funds being drained merely by logging into the site. The breach was traced to a hijacked script from DebugBear, a service used for performance monitoring. Attackers used the script to liquidate users’ active positions and send the proceeds to a hard-coded wallet, stealing more than $2 million before the script was removed.
Binance suffered the largest theft on record
In roughly 20 minutes, attackers moved $6.3 billion in crypto assets from Binance hot wallets across 10 blockchains, making it the largest theft in recorded history. Binance said a compromised DevOps laptop let attackers submit withdrawal requests that were then signed by the exchange’s own systems. The FBI later attributed the attack to the North Korean group TraderTraitor, which has previously been linked to major exchange thefts.
Stablecoin issuers helped contain the Binance losses
The practical losses were quickly reduced because centralized issuers could freeze part of the haul. Tether and Circle reportedly froze about $3 billion in stolen stablecoins within an hour. Binance then halted withdrawals, replenished wallets using treasury and insurance funds, restored withdrawals by Sunday, and later published proof-of-reserves data showing user balances were fully backed.
Users still rushed to pull funds from Binance
Despite the exchange’s recovery measures, confidence was shaken. Users withdrew about $3.6 billion from Binance after services resumed, underscoring persistent concerns about custodial risk even when an exchange can backstop losses internally.
Linux bug had existed since 2016
A severe Linux kernel flaw, later scored 9.8 on the CVSS scale, was traced to connection handling code present since 2016. The bug involved a race condition during new TCP connections: if a client resent an initial packet at precisely the right moment, one kernel path could free memory while another still read it. That opened the door to use-after-free behavior in kernel replies.
Exploit path moved from theory to root access
The flaw originally appeared difficult to exploit reliably, leading Red Hat to rate it a moderate 5.9 and initially treat kernel crashes as the likely outcome. That view changed after testing showed an attacker could force enough attempts to make the timing work. The key risk was that leaked kernel memory could become a stepping stone to full code execution.
Anthropic demonstrated AI-assisted exploitation
On October 27, Anthropic said its red team gave the bug to an unreleased Claude model. In about 48 minutes, the model achieved a kernel memory leak, and about 5 minutes later it was executing commands as root on an unpatched server. The result highlighted how AI systems can automate persistence against low-probability race conditions that once offered defenders some practical protection.
Patch response varied across vendors
Debian and Oracle issued patched kernels within a day of the CVE becoming public. Red Hat took around two weeks to release fixes after reassessing the severity, while Ubuntu had not yet shipped a patch at the time described. The uneven response left many internet-facing Linux servers exposed during a period of heightened attention to the flaw.
CONCLUSION
The week’s incidents showed how modern security failures now span software supply chains, centralized crypto infrastructure, and long-lived core operating system bugs. They also demonstrated that AI can sharply reduce the practical barriers to exploiting vulnerabilities once considered too unreliable to matter.
Ask a question