One Shared ChatGPT Link Was Enough to Run Code in Your Session

A malicious ChatGPT share link could execute attacker code inside the victim’s logged-in session and read private conversations; OpenAI rated it P1 and shipped a fix eight days after the report. The FBI formally attributed the $6.3 billion Binance theft to North Korea’s TraderTraitor and published Ethereum addresses tied to the group.

AI & Model Security

• A single ChatGPT share link gave attackers full account access. Researchers at Parameter chained ChatGPT’s HTML “Preview” feature — which runs in a locked-down frame on a separate origin, and held — to a second feature in the same conversation: rendering an interactive graph loaded the MathLive math library into the main ChatGPT page, leaving a postMessage listener that never verified the sender. Attacker code then ran with the victim’s session, enumerated recent conversations, opened a chat never shared with the attacker, and exfiltrated part of it via ChatGPT’s own signed-in APIs. A later variant auto-opened Preview, so opening the link was the only step. Reported Oct 18, fixed in eight days, P1; no real-world abuse reported (The Hacker News).
• Expel’s IR work on the trojanized Claude Code extension found live reverse SSH tunnels. Across four affected customer Macs, Expel observed outbound reverse SSH to the attacker server, with one host first running the malware roughly eight hours after the end of Cursor’s stated exposure window. Cursor’s revised notice names two tampered Anthropic.claude-code builds — 2.1.312 and 2.1.313 — with corrected IOCs worth re-pulling (Expel). Anthropic’s statement puts the compromise squarely at Cursor’s marketplace (Kevin Beaumont); earlier coverage.
• Anthropic’s text watermark can be dropped by changing one sampling parameter on two models. The rollout covers Claude Mythos 5, Opus 4.7, Opus 4.6 and Sonnet 4.6, driven by the EU AI Act’s December deadline, but on Opus 4.6 and Sonnet 4.6 the mark only applies when temperature, top_p and top_k are all left at defaults — any tweak removes it. Anthropic’s mitigation is a warning in its customer email (The Decoder).
• OpenAI will train on Daybreak Blue cybersecurity session data starting November 29, including for users who had training switched off; a follow-up email after the backlash promised a separate opt-out (The Decoder).
• Claude is now refusing game recreation and cloning tasks, with users reporting that generic, non-malicious reverse-engineering requests are being caught by the same restrictions (Tom’s Hardware) (discussion).
• A Claude Code agent reportedly held admin access on NIPRNet. WIRED reported that an Accenture contractor granted the agent administrator rights on the Pentagon’s unclassified network; the claim is circulating secondhand so far (thegrugq).

Exploits & Vulnerability Research

• Chrome’s GPU process can escape its sandbox on macOS (CVE-2026-106378). The sandboxed GPU process could talk to WindowServer and inject keyboard input into the desktop; the public PoC opens Spotlight, types “Calculator” and launches it outside the browser, with Terminal as the obvious next step. It is not a one-click bug — an attacker must already control a renderer or GPU process (DarkWebInformer).
• “SMS of Death” now has a working PoC (CVE-2026-58882). An eight-byte malformed WAP Push sent as a data SMS to port 2948 fails a header-length bounds check, producing a NegativeArraySizeException that kills com.android.phone, dropping cellular service and live calls including emergency calls, with nothing visible in the inbox. Google patched Android 14–17 in October without listing it in the bulletin; Android 12 and 13 remain unfixed. Testing showed 20 messages could induce reboot loops — one Android 12 device rebooted into recovery roughly every 90 seconds until a factory reset (BleepingComputer); earlier coverage.
• Go programs are exposed to the Linux kernel UAF by default. The Go security team notes that since Go 1.24, Go enables MPTCP by default on Linux listen sockets — the precondition for the demonstrated RCE against CVE-2026-98432. GODEBUG=multipathtcp=0 or a godebug line in go.mod disables it, but the team calls per-program disabling fragile, stresses the underlying IPv4 TCP bug is not MPTCP-specific, and says patching the kernel is the fix (golang-announce); earlier coverage.
• PHP2Shell roots PAN-OS management interfaces but keeps failing against WordPress, with 22.6 million exposed instances potentially in scope after more than a week of attacks (SecurityWeek). Intel 471’s hands-on test of a working exploit for CVE-2026-109618/109619 found reliability varies sharply between Apache mod_php and PHP-FPM, and recommends restarting workers after patching plus disabling session.upload_progress and tightening request limits — useful triage given the volume of AI-hallucinated PoCs in circulation (Intel 471); earlier coverage.

New Tools & Releases

• HorusEye ingests BloodHound, Certipy, ldapdomaindump and CrackMapExec/NetExec output and turns it into a ranked, exploitability-scored list of paths to Domain Admin across 13 attack classes — Kerberoasting, AS-REP roasting, DCSync, ACL and GPO abuse, constrained/unconstrained delegation, ADCS ESC1–ESC8, trusts, privileged sessions, weak password policy and stale admins — emitting the exact command to validate each finding against the accounts it actually found. A Tier-0 model promotes anything leading directly to DA to critical; reports are byte-deterministic with a documented exit-code taxonomy for CI, and an optional Claude layer adds narrative context (GitHub).
• wafmeow is a Go rewrite of wafw00f’s fingerprinting, carrying 172 WAF product identities into concurrent pipelines: live scanning, offline classification of saved httpx exports, request/redirect/connection budgets, optional Chromium capture, JSONL/JSON/CSV output and an importable library API. The author is explicit that a match is evidence, not proof a WAF is absent, and that catalogue parity does not mean detection parity (GitHub).

Threat Activity

• FBI names TraderTraitor for the Binance heist and publishes its Ethereum addresses (Catalin Cimpanu), matching TRM Labs’ high-confidence attribution to the North Korean group behind the $1.5 billion Bybit theft in February 2025. Binance’s preliminary finding, disclosed Oct 30, is that the attacker reached a service container via a compromised DevOps engineer’s laptop, with no evidence of private-key leakage; roughly $3 billion is frozen on-chain, including 1.567 billion USDT by Tether and 800 million USDC by Circle (CyberInsider, The Hacker News). Binance’s latest update says 90% of the $6.3 billion has been replenished (DarkWebInformer); vxunderground’s early call that this would turn out to be mundane social engineering rather than a browser zero-day chain looks well aimed. Earlier coverage.
• Chainalysis puts numbers on its “offensive agentic techniques” breach: user IDs, full names, email addresses and organizational role labels for provisioned platform users, with no evidence so far of access to investigation content, credentials or session tokens, and no link to the Binance theft. The company is using LLMs to support a broader platform security review, and has not said whether the intruders used an existing framework such as ARTEX or custom agents (BleepingComputer). On the hunting side, researchers report that a single FOFA favicon query surfaces ARTEX panels, with related frameworks (“Cairn”, others) showing up in the same sweeps (cyb3rops); earlier coverage.
• Northflank’s breach has moved from exposure to abuse, with customers’ AI API keys being used by the attacker; the platform has enabled secret rotation for Postgres and MongoDB addons and is advising customers to disable public exposure on addons (BleepingComputer); earlier coverage.
• Nvidia is notifying developers of a breach at its Brev.dev platform (Kevin Beaumont).
• Gamdom’s founder says ~16 million player records were extracted in the attack that began Oct 12 — slightly above the 15.4M in WhiteArmor’s $15M ransom listing. About 7,000 KYC documents were exposed through Intercom support chats (around 4% of KYC processing, per the company), and an Intercom credential belonging to a former head of support was missed in the initial rotation (Gambling Lore).
• Qilin listed Community Medical Center in Falls City, Nebraska after the critical-access hospital disclosed an intrusion over the Oct 17–18 weekend; staff reverted to paper, appointments slipped, and ambulances diverted critical patients because imaging could not reach radiologists (DailyDarkWeb). DarkFeed’s 2026 leak-site tally puts Qilin first with 1,131 claimed victims, ahead of The Gentleman (929) and Akira (418).
• Yoba’s loader hides behind legitimately signed AI installers. Check Point traces fake “AI” GitHub projects and SEO poisoning to ZIPs pairing a signed OpenAI/Anthropic Setup.exe with a malicious winmm.dll for sideloading, then launch/locale/admin checks and long sandbox delays, a masquerading scheduled task for persistence, and payload retrieval via a Telegram plus DNS-over-HTTPS domain-generation scheme. Observed payload is a Tor-based XMRig miner, but the framework can carry anything (Security Affairs); earlier coverage.
• Cloudflare mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026, about 8,226 L3 attacks per hour and up 38% quarter on quarter (The Hacker News).
• Unverified leak claims worth watching: a free dump of ~911,552 SquareTrade accounts plus ~41.4M additional records (DailyDarkWeb); 1.2M BitMart users (DailyDarkWeb); 110k patient records from a Strasbourg pharmacy with claimed access to French health platforms (DailyDarkWeb); and 2.4M JSONL lines from French chain G La Dalle, allegedly obtained via an exposed unauthenticated production API endpoint that leaked database credentials (DailyDarkWeb). None independently confirmed.

Industry & Policy

• GCHQ cannot account for thousands of removable storage devices holding potentially sensitive material, and still cannot say how many, where they are, or whether they are recoverable. The Investigatory Powers Commissioner’s Office said in its 2025 annual report that it was “very concerned” and “disappointed with the time it has taken GCHQ to investigate,” alongside findings on asset tracking, a software fault contributing to a wrongful detention, and MI5’s handling of an informant (The Record, The Register).
• Proton cancelled its AI “re-interviews” and pledged to open-source internal AI tools after sustained customer revolt over AI strategy and staff treatment, with its own feedback forum and subreddit filling with cancellations and calls for the CEO and CTO to step aside (404 Media, CyberInsider) (discussion).
• A cyberattack knocked the US Federal Election Commission’s filing systems offline for 41 hours, delaying mandatory donation disclosures (SC Media).
• Syrian Electronic Army member “Th3Pr0” got 42 months in federal court in Virginia for a conspiracy run by advisers to Bashar al-Assad, including the hijacked AP account whose fake tweet briefly wiped $136 billion off US markets (The Record, The Hacker News).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .