The October–November 2026 Hacking Playbook

At 23:56 UTC on October 29, 2026, the last unauthorized transfer left a Binance hot wallet. Roughly 20 minutes earlier, the exchange held about $6.3 billion in customer assets spread across 10 blockchains. When the transfers stopped, most of it was gone.

No private key left Binance’s control. No cryptographic assumption failed. The attackers held a deployment token belonging to a wallet DevOps engineer, used it to stand up a container, and asked the internal signing service to move funds. The service complied, because every credential and every permission in that chain was valid.

No key was stolen. No cryptography broke. The signing service trusted itself.

Within a week, Wordfence reported that it had blocked more than 240,000 attempts to exploit CVE-2026-119977, a WordPress flaw that exists only during the few seconds a core update unpacks itself onto disk. Both records share one shape. Both attacks worked by capturing a system at the instant it hands authority to itself.

Four Failures in the Same Second of Trust

Watch the WordPress window open. A site administrator clicks update. Core unpacks the new release into wp-content/upgrade/, a directory any browser can request. For the seconds that unpacking runs, an unauthenticated stranger who asks for setup-config.php from that path can run the installer himself, create an administrator account and upload PHP. The flaw, present in every release from 4.7 through 7.1.3, needs no login and no user action beyond the update everyone is told to perform.

Now watch the SSH window close on a different system. An sshd built against musl libc with PAM disabled compares a supplied password of 257 to 1,024 bytes against the stored hash. The hashing attempt fails and returns an asterisk; sshd then compares that asterisk to the asterisk sitting in the password field of an account configured to reject password logins. The account opens. That is CVE-2026-123158, and Alpine’s advisory says the attack “works every time, and needs no retries.”

Call this shared surface the transition plane. It is the set of operations where a system stops being one thing and becomes another: an update staged into place, a password compared, a certificate chain validated, a wallet delegating execution rights to a contract. These operations run at the highest privilege the system has, they last milliseconds to minutes, and almost nobody treats them as an attack surface in their own right.

Key Takeaways:

• Four products, four vendors, one class of failure: each attack landed inside a routine privileged transition rather than against a hardened perimeter.
• The WordPress, OpenSSH and Ivanti flaws all sit inside a normal operation: a core update, a password check, an authentication handshake.
• Initial access came through job interviews, search ads, editor extensions and third-party scripts, not through perimeter holes.
• Suspending withdrawals cannot cancel an on-chain authorization. Delegation state has to be cleared on-chain.
• AI shows up as speed and tailoring in confirmed reporting, not as an autonomous intruder.

The WordPress fix deserves one detail that most advisories bury: installing 7.1.4 still runs the vulnerable upgrade process one last time. Block PHP execution in wp-content/upgrade/ first, then patch.

Initial Access Arrives as a Job Offer

Binance’s November 3 incident report describes a five-month campaign that never needed a zero-day against Binance’s own code. It opened in June, when a wallet DevOps engineer searched for a popular AI coding tool and installed a tampered Homebrew build delivered through a search ad. Binance’s team caught it, swapped the laptop and reset credentials. The attackers had already learned what he did and who he worked with.

In September a second engineer was approached on a legitimate job platform by someone posing as a project director at a company that did not exist. Two interviews followed. Fake HR shared social media photos to build rapport, then scheduled a chat-app call with the alleged CEO. The last step was a request to download a coding assignment onto his work computer. The repository executed on setup, swapped a rogue build of a legitimate developer tool component into place, and opened a channel to attacker infrastructure. According to SecurityWeek’s account of the Binance report, endpoint protection did not flag it at the time.

The same pattern runs through code supply channels that security teams rarely inventory. A trojanized build of Anthropic’s Claude Code extension shipped through the Cursor marketplace on October 29 and tried to install a persistent SSH backdoor on up to 5,000 developers’ machines. That same week, a compromised page-speed script from DebugBear let attackers drain about $2.7 million from 710 user wallets, a loss Polymarket made whole with $3.9 million in refunds.

Recruiting pipelines, package managers, editor marketplaces and third-party JavaScript are the front door. All four are places where someone you never met supplies something your trusted tooling executes by default. The controls that matter are unglamorous: allowlists for package sources, review before an extension is approved, a script inventory behind a real content security policy, and a hard rule that no candidate-provided archive touches a machine holding production credentials.

The Update and Management Plane Is the New Perimeter

WordPress’s bug is the cleanest example of a transition becoming a vulnerability class on its own. Wordfence, working as CNA, scored CVE-2026-119977 at CVSS 8.1; CISA added it to the Known Exploited Vulnerabilities catalog on November 3 with a November 6 federal deadline. Volume followed: more than 240,000 blocked exploit attempts, peaking above 74,000 on October 30. Blocked attempts are not breached sites, and nobody has published a count of successful compromises.

SSHole (CVE-2026-123158, CVSS 8.1) is a different mechanism with the same shape. It hits OpenSSH built against musl libc with PAM disabled, which is Alpine Linux’s default server configuration. OpenSSH shipped 10.6p2 on November 5; researchers logged the first exploitation attempt within hours and confirmed root on an Alpine honeypot. Patching without restarting sshd leaves the old binary answering on port 22.

Ivanti Connect Secure shows what a chained management-plane attack produces. Three flaws were stitched together by a previously undocumented actor tracked as UTA0576: CVE-2026-104935 for authentication bypass, CVE-2026-111357 for privilege escalation, and CVE-2026-118527 for predictable identifiers enabling file upload, ending in unauthenticated root-level code execution. The goal was not a web shell. Attackers pulled credentials and limited Active Directory metadata, ran host reconnaissance, and searched for administrator passwords and BitLocker recovery keys.

The quarter’s list runs longer. GitLab’s maximum-severity CVE-2026-97229 in its CI/CD regular expression compiler drew active exploitation and a KEV listing in late October, with reporting that over 1,000 self-managed servers stayed vulnerable. Canonical’s LXD and MicroCloud carried a CVSS 10.0 certificate-validation flaw, CVE-2026-112816, that let an unauthenticated attacker authenticate as any trusted client through a crafted certificate chain. The Linux kernel’s TCP stack carried CVE-2026-98432, rated 9.8 by the kernel CVE team, with Multipath TCP exposure that pushed Lightning Labs to ship emergency releases disabling MPTCP listeners.

Case Study: Twenty Minutes Inside a Signing Service

On October 20, with two engineers’ machines compromised and a foothold on the corporate network, attackers used the infected machine and an internal AI tool to take control of the first engineer’s system and a third wallet engineer’s system. Binance’s report does not explain how the AI tool was used, and any reconstruction past that point is guesswork.

The first engineer’s computer held a token permitting container deployments. On October 29, attackers signed into the third engineer’s machine, deployed a container with credentials taken from the first engineer, and used it to reach the internal wallet signing service. That service moved XRP, SOL, OP and BTC out of hot wallets. It was also the lever for abusing Ethereum’s EIP-7702 mechanism, granting a contract under the attackers’ control partial execution rights over a hot wallet.

EIP-7702 lets an ordinary wallet delegate its behavior to a contract by signing an authorization. On-chain analysts reported a batch of 50 such authorizations signed for consecutive nonces, so that one would match the wallet’s transaction count at execution time, with the delegation submitted roughly three minutes before the drain from an address funded through Tornado Cash. The reading that fits is a signing pipeline that authorized whatever it was told to authorize, not a leaked key. As Blockaid’s Ido Ben-Natan put it, “ultimately signer signed transaction that they shouldn’t have.”

The hot wallet used multi-party computation, which is the wrong shape for this failure. No single key existed that Binance could use to cancel the delegation immediately. Suspending withdrawals, the standard exchange reflex, could not touch authorizations that already lived on-chain and ran independently of withdrawal infrastructure. The last unauthorized transfer settled at 23:56 UTC; the delegation was cleared shortly after midnight.

One delegation did not explain the whole loss. The rest left through other routes, including chains with different key types and signing schemes. About $2.85 billion was frozen or intercepted, much of it by stablecoin issuers: Tether and Circle locked about $1.77 billion in USDT and $825 million in USDC by 00:30 UTC on October 30, and Arbitrum’s Security Council used emergency powers to move roughly $30 million out of an attacker wallet. Elliptic traced proceeds through about 12,000 wallets on 11 blockchains in under four days. Chainalysis said an emergency pause at THORChain, triggered by an unrelated technical issue, temporarily slowed laundering.

Binance rebuilt the affected wallet system and the AI tool, replaced devices, retired the engineers’ credentials and tokens, and said it had blocked 57 suspected North Korea-linked threats this year. The FBI attributed the theft to TraderTraitor and published 628 wallet addresses for services to block.

After the Foothold, Ask What the Identity Can Reach

The part that transfers to ordinary enterprises has nothing to do with crypto. Post-exploitation is now an identity problem. Binance’s attackers never held a private key. They held a container-deployment token, then a session on a wallet engineer’s machine, then the ability to submit work to a signing service. Every link in that chain was a token.

The same shape appears in the Ivanti intrusion, where attackers operated in memory and the tooling built to check appliance integrity may not see them. It appears in the LXD flaw, where a crafted certificate chain was enough to be treated as a trusted client. After a foothold, the useful question is what this identity can reach, and which of those paths end somewhere that signs, deploys or authorizes.

Static, long-lived deployment tokens are the weak point in most organizations. A token that lets an engineer deploy a container from a laptop also lets whoever owns that laptop deploy a container. Short-lived credentials bound to a workload identity, scoped to a single service, with deployment requiring an approval the token itself cannot grant, would have broken this chain at its most valuable link.

Crypto Response Is On-Chain and Time-Critical

Every internal control in this incident assumed Binance could stop its own systems. Suspending withdrawals works on withdrawal infrastructure. It does nothing to an authorization that already exists on a public chain and can be executed by anyone holding the right contract.

The controls that did work were external and already in place: stablecoin issuers able to freeze balances within hours, a rollup security council with emergency powers, exchanges and analytics firms sharing addresses fast enough to catch moving funds, and a validator set whose operations could slow a laundering route. None of that can be improvised mid-incident. It requires standing contacts at issuers, exchanges, validators and analytics providers, plus rehearsed procedures for what to ask each of them and in what order.

AI as an Accelerant

Microsoft’s threat intelligence team reported in October that North Korean actors are operationalizing AI across established workflows: launching campaigns through front companies in a single week, generating dozens of tailored lures in minutes, and running an open-source agentic penetration testing framework. Chainalysis disclosed its own breach after an external actor used what the company called “offensive agentic techniques” against internal systems and tools, exposing customer names, emails and roles.

Nothing in the record points to an autonomous intruder. Elliptic found automation throughout the laundering of the Binance proceeds but no sign of AI agents making the decisions. Binance documented an internal AI tool being abused to move laterally without explaining the mechanism. AI compresses the time between steps and sharpens the tailoring of lures, and internal AI tooling is itself an attack surface whose privileges nobody has mapped.

A 12-Point Audit Checklist

Each item below maps to a mechanism above and would have interrupted at least one of the quarter’s incidents.

• Inventory exposed management planes. List every VPN appliance, edge gateway, CI/CD server, self-managed Git host and container orchestrator API answering from the internet, with an owner and a patch SLA.
• Block script execution in update directories. Deny PHP in wp-content/upgrade/ and equivalent staging paths, then run the patch, not the other way round.
• Verify that patches installed. Confirm the running version after the update, and re-check that no staged installer survived in a web-reachable directory.
• Hunt for unexpected administrator accounts. New admin users, new SSH authorized keys and new service accounts created in a short window are the highest-signal artifact of both the WordPress and SSHole cases.
• Read SSH logs for impossible logins. Search for “Accepted password” against accounts that should never accept one, then check doas use and recently created files on any host you cannot rule out.
• Retire static deployment tokens. Replace long-lived container and cluster tokens with short-lived, workload-bound credentials scoped to one service.
• Treat developer endpoints as privileged. No production credentials on machines that run candidate code, downloaded archives or unvetted editor extensions. Reimage on suspicion and rotate everything the machine could reach.
• Control extensions and package sources. Maintain an allowlist, review marketplace updates, and require provenance checks rather than trusting a vendor name in a listing.
• Inventory third-party scripts and enforce CSP. Every script loaded from someone else’s domain is remote code execution against your users’ sessions.
• Monitor egress and identity, not just files. Alert on privileged identities reaching signing systems, deployment APIs or credential stores from unfamiliar hosts.
• Rehearse on-chain response. Hold current contacts at issuers, exchanges, analytics firms and validator or council operators, and know in advance who can freeze what.
• Map which internal AI tools hold privilege. Any assistant with access to endpoints, repositories or admin consoles needs an owner, a permission boundary and logging.

The Series Map

This is the pillar. Each exploit gets a dedicated deep dive: the Binance social engineering and lateral movement chain, reconstructed month by month from the incident report and on-chain analysis; the WordPress upgrade-window race, with the staging mechanics and a blocking configuration that survives the patch; SSHole and the musl authentication path, including what “password disabled” actually guarantees; the developer supply chain behind malicious search ads, trojanized editor extensions and third-party JavaScript; the edge-appliance chain pattern behind Ivanti, LXD and the GitLab compiler flaw; the crypto on-chain response playbook, from delegation revocation to cross-chain tracing; and AI-assisted operations, separated into what is documented and what is still marketing.

Related Reading

More in-depth coverage from this blog on closely related topics:

• PHP core RCE: CVE-2026-109618
• Inside Go’s 7.5-Hour eMudhra CA Response

Sources and References

Sources cited while researching and writing this article:

• CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
• Alpine Linux and OpenSSH patch flaw that’s as bad as it can get
• Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist – SecurityWeek
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
• Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
• Known Exploited Vulnerabilities Catalog | CISA
• 10.6p2
• Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
• EIP-7702 and a Tornado Cash wallet: how the Binance drain may have happened
• EIP-7702 didn’t cause Binance hack, but may have amplified losses
• Binance Hack Funds Spread Across 12,000 Wallets in Under Four Days
• Tracking AI adoption in North Korean threat actor tradecraft