This week
- North Korean attackers make off with $6.3 billion from Binance exchange
- UK gov pledges consultation on liability of software defects
- Compromised Chinese model speculation distracts from real incidents…
- … like Claude Code extension being compromised to push SSH backdoor
Interesting stats
Open weights…
19% more likely for Alibaba’s Qwen3-Coder model to “hand back an app that can be hacked” when prompted for a US vs Chinese defence contractor, eliminated when ‘Westernising’ the model weight, says Hirundo, a ‘machine unlearning’ startup (who, of course, would have vested interest in this).
’Thousands’ of removable media devices at GCHQ are unaccounted for and have been missing “for years”.
~Five~ Four things
-
Binance, the world’s largest cryptocurrency trading exchange, was compromised and $6.3 billion in Bitcoin, Ethereum, and other cryptocurrencies was stolen. The transfers took place over 20 minutes, following a trial run 36 hours previously, and Co-CEO Richard Teng took to Twitter/X to say the original access vector may have been a compromised developer laptop. The FBI has linked the theft to North Korea, and the “TraderTraitor” group specifically. North Korea has been carrying out attacks against cryptocurrency exchanges for a while now, as a way to fund its regime and nuclear weapons programme. From my own experience responding to the Lazarus Group, these threat actors are meticulous and spend a long time gathering intelligence on targets and planning their attacks. At SWIFT, following the Bangladesh Bank Heist, we saw the bank accounts they ultimately transferred funds into set up over a year in advance (PDF). Binance resumed customer transactions on Sunday morning, and at the time of writing (Sunday afternoon), $3.6 billion (£2.7bn) had been withdrawn from the exchange (around 2.1% of its $171bn total assets under management). The company says that it has covered 90% of the stolen funds but that the remaining 10% may take longer to source. That 10%, remember, is $630 million.
-
Cyber liability: As part of the UK budget on Wednesday, the UK government says it will consult on where liability for cyber defects should lie. The Law Commission of England and Wales will roll the consultation into an existing review of product liability law, and consider “how to tackle insecure technology at source and consider where liability for cyber breaches should sit.” The thinking is that software vulnerabilities, as flaws, should be treated like physical product defects, where the manufacturer can be held liable. Proponents argue that it would increase investment in writing secure code at source, and reduce the burden felt by customers, typically organisations that may end up being breached, or at least incur costs in routinely having to patch duff software. Similar proposals have been made in the US, and have stalled or been rolled back under the Trump administration. I wouldn’t hold my breath for change on either side of the pond anytime soon.
-
AI Models: There was some hyperbole about Chinese models ‘phoning home’ this week. Cohere was testing Qwen3.8-Flash-Next and asked it to write a detection rule to spot the use of curl to download malicious files to a temporary directory. It seems the model then tried to download a test file from Alibaba’s cloud in Beijing to, well, test the rule. While the output said no tools were called, Cohere also says the behaviour is rare and, despite re-prompting the model, occurred less than once every 100,000 evaluation runs. While research suggests that AI models can hide arbitrary capabilities with relatively little effort, doing so reliably as a nation state would be high stakes, and it seems more likely at the moment that folks are more likely to be compromised by backdoored models hosted on platforms like Hugging Face. … or by…
-
Claude Code’s VS Code extension on the Cursor marketplace was backdoored this week, potentially affecting “at most” 5,000 users. A malicious version (2.1.313) was pushed to the official Anthropic account, with Cursor’s update functionality downloading the compromised extension automatically. Cursor has published a security notice, saying the compromised version was available for around eleven hours, and that malware attempted to install a persistent SSH backdoor. Anthropic has remained quiet on the matter.
In brief
-
PHP2Shell: Despite the headlines last week, currently there are only limited reports of PHP2Shell vulnerabilities being exploited in the wild, except for — you guessed it — Palo Alto Networks firewalls. If you’re running those things, you’ll be very familiar with the patching process by now.
-
Hosting horrors: US web hosting firm DreamHost is forcing password resets for email and file transfer accounts of its 400,000 customers. Meanwhile, UK domain registrar 123-Reg says customer data was exposed during an “AI-driven cyberattack”.
-
Homeland security: Someone using the handle ‘Department of Peace’ has published the personal details of 40,000 US Department of Homeland Security staffers. The information, including names, job titles, email addresses, mobile phone numbers, and office locations is allegedly from a DHS Okta tenant, stolen during a previously undisclosed breach earlier this year. Names of Active Directory groups hint at the types of access and applications different users are authorised to use. Some 10,000 records relate to Immigration and Customs Enforcement (ICE) employees.
-
Silent Train is the name being given by Black Lotus Labs to a covert network it says is used by the Chinese Volt Typhoon group. The network is formed from lots of compromised IoT devices and SOHO routers in chains that are “assembled and dismantled every day” to continually refresh the network, with sessions averaging just four hours in an attempt to make tracing campaigns and activities more difficult. More.
-
Tailworm: Security researchers at Cyberdione Labs released details of vulnerabilities in Tailscale SSH server, prompting the vendor to scramble to release patches for the issues (advisory). Proponents of ‘full disclosure’, like Cyberdione in this case, claim that drawing attention prompts fixes and lets users make informed decisions about risk; however, that only really considers consequences, not likelihood. Uncoordinated disclosure like this puts fingers on the (ahem) scales of attackers identifying opportunities they otherwise may not have been looking for and forces a bunch of reactive, rather than proactive, effort.
-
AI Banking: Bank of America has messaged customers asking them not to give AI assistants their online banking login details. The first-order risk of giving an AI agent access to your account is (I’d hope) fairly obvious, however I’m always struck by how far the US financial system is behind compared to the UK. From instant funds transfers (most folks in the UK would be worried if the money didn’t land within a couple of minutes!) to the account protections that’d prevent this type of access (malicious or otherwise). The US does have many, many more small banks and credit unions, though.
-
UEFI: A critical vulnerability in the EDK II PXE driver used in many server motherboards can be exploited to gain remote code execution before Secure Boot or the operating system loads, but it requires local network access and exploitation during the PXE boot sequence, making it unlikely to be widely exploited outside of controlled settings (CVE-2026-97631; 9.5/10; advisory).
-
Quarry: Cisco has open-sourced a Python framework for detecting threats and behaviour patterns in agent conversations. It’s kind of like Snort for AI conversations.
-
LiteLLM’s postmortem says that the supply chain compromise of its LiteLLM Agent Platform in October was because “nobody followed through on revoking the administrative key to the LiteLLM Agent Platform” exposed in a May 2026 breach.
-
Public Discord: Social platform Discord intends to allow search engines to index chat messages from ‘discoverable servers’ with over 1,000 members. If you run a popular server, you may want to check your settings and opt out.
-
General Motors will pay $200 million to settle cases with 36 states over the illegal sale of driving data. The automaker’s OnStar ‘Smart Driver’ programme monitored location data and driver behaviour (such as use of seatbelts) and then sold that to data brokers, who sold it on to insurance companies. As with many data protection cases like this, the settlement required a third-party audit of GM’s privacy programme.
-
Defend, harden, prevail: CISA has published strategy to 2030, built around three pillars to lead national cyber defence, prioritising critical infrastructure security, and mobilising national resilience through collective response.
-
Upwind has announced a $400 million Series C fundraising round, at a $3.8 billion valuation, for its AI tooling that secures cloud environments.
And finally
- NBC News report that over $100 million in data centre equipment has been stolen by thieves infecting US trucking companies with malware to target shipments and spoofing GPS signals to hide vehicle whereabouts. Haulage firms have started hiring off-duty police officers to escort loads. In one case, the escort vehicle of a $13 million shipment was struck in what’s believed to be a deliberate hit-and-run. It’s almost a wild as the 93 pages of risk factors listed by Anthropic in its S-1 filing ahead of the frontier lab’s IPO. While “existential risks to humanity” and AI systems “accelerate[s] AI progress beyond our ability to evaluate and safeguard [a] new model,” more mundane risk scenarios include the fact that just five customers currently account for almost a quarter of Anthropic’s revenue.