SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSaturday, October 31, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Active In-the-Wild Exploitation of GitLab and Drupal RCE Flaws | CRITICAL |
|
5 C2 IPs | 40 OTX IOCs | 35 ARTICLES |
|
■ ANALYST TLDR Threat actors are actively exploiting maximum-severity vulnerabilities in GitLab (CVE-2026-97229) and Drupal Commerce Core (CVE-2026-118539) to execute remote code on compromised systems. Additionally, major supply chain risks have surfaced through trojanized Claude Code developer extensions installing SSH backdoors, hardware-implanted Trezor crypto wallets, and a compromised DevOps laptop leading to a record $6.3 billion Binance breach. |
|
■ CRITICAL STORIES CISA Says Max-Severity GitLab Flaw Exploited in the Wild Tracked as CVE-2026-97229, unauthenticated attackers are actively exploiting this maximum-severity flaw to achieve arbitrary code execution, targeting organizations including Alpine Linux infrastructure. |
Binance Links Record $6.3 Billion Crypto Theft to Compromised DevOps Laptop The largest cryptocurrency theft on record was traced back to an endpoint compromise of a DevOps engineer's laptop, highlighting extreme identity and workstation risks. |
Official Claude Code Extension Trojanized with Persistent SSH Backdoor Up to 5,000 developers were exposed to malicious software via Cursor's extension marketplace after Anthropic's Claude Code extension was spoofed to deploy persistent SSH backdoors. |
Drupal Warns of Critical Commerce Core Authorization Bypass Flaw Exploited in Attacks Tracked as CVE-2026-118539, this critical missing authorization bug allows attackers to bypass security controls on online stores and is currently undergoing active exploitation. |
|
■ CVEs IDENTIFIED CVE-2026-97229 GitLab — Remote Code Execution |
CVE-2026-118539 Drupal Commerce Core — Missing Authorization / Access Bypass |
[CVE-TBD] Linux Kernel (MPTCP) — Remote Unauthenticated Root Code Execution |
[CVE-TBD] WordPress Core — Unauthenticated Race Condition / Remote Code Execution |
|
■ THREAT ACTORS Chinese State-Sponsored Actors | Nation-State APT |
Utilizing Go-based AI-powered framework (ARTEX) to attack over 200 global organizations simultaneously. |
Syrian Electronic Army (Ahmad Umar Agha / "Th3Pr0") | Hacktivist / State-aligned |
Sentenced to 42 months in federal prison for high-profile cyberattacks against Western media outlets and market manipulation. |
Unidentified Threat Actors | Cybercrime |
Actively exploiting CVE-2026-97229 (GitLab) and CVE-2026-118539 (Drupal), and distributing malicious Claude Code developer extensions. |
|
|
|
■ ATT&CK TTPs | T1195.002 | | Supply Chain Compromise: Software Supply Chain | Malicious Claude Code extension uploaded to Cursor extension marketplace. |
| T1195.003 | | Supply Chain Compromise: Hardware Supply Chain | Physical rogue circuit board implant inserted into Trezor Safe 5 wallet. |
| T1190 | | Exploit Public-Facing Application | Active exploitation of unauthenticated RCEs in GitLab (CVE-2026-97229) and Drupal (CVE-2026-118539). |
| T1021.004 | | Remote Services: SSH | Installation of persistent SSH backdoors via trojanized developer tools. |
| T1078 | | Valid Accounts | Abuse of AD CS certificates (ESC1/ESC8) and compromised DevOps credentials. |
| T1566 | | Phishing | Impersonation of Teams support help desk to achieve initial network access. |
|
■ PATCH PRIORITY GitLab — Unauthenticated RCE (CVE-2026-97229) actively exploited in the wild — BleepingComputer |
Drupal Commerce Core — Missing authorization bypass (CVE-2026-118539) actively exploited — SecurityWeek |
Linux Kernel (MPTCP) — Remote unauthenticated root code execution vulnerability — BleepingComputer |
WordPress Core — High-severity unauthenticated race condition leading to RCE under active attack — SecurityWeek |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately patch GitLab instances to address CVE-2026-97229 to block active in-the-wild remote code execution attempts. |
| 2 | [P1] Update Drupal Commerce Core installations to remediate CVE-2026-118539 and conduct an immediate order and permission audit. |
| 3 | [P1] Audit developer endpoints for unauthorized Claude Code extensions installed via Cursor Marketplace on October 29 and inspect SSH authorized_keys. |
| 4 | [P2] Perform physical hardware validation on Trezor Safe 5 wallets purchased through third-party resellers (specifically CryptoBilis) prior to key generation. |
| 5 | [P2] Apply emergency security patches to WordPress Core and Palo Alto Networks firewalls exposed to active PHP RCE exploit vectors. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |