[gitbook]

November 6, 2026

• GitBook’s postmortem traces its production breach from SSO to GitHub and Cloudflare. The company says an SSO flaw, a misconfigured GitHub integration and a Cloudflare API key enabled production access. GitBook is treating all customer data as exposed and cannot determine whether the attacker acted inside connected customer repositories; customers should rotate GitBook tokens, integration secrets and custom-backend signing keys. GitBook (earlier coverage). · Cloud, Identity & Incident Response

in ARTEX Operator Consoles Expose Near-Autonomous Cybercrime

November 4, 2026

Binance Traces $6.3 Billion to a Fake Interview and an Internal AI Tool

Binance disclosed a four-stage $6.3 billion heist beginning with fake job interviews and a compromised Homebrew pyenv binary, followed by lateral movement using an internal AI tool to breach two wallet engineers and steal container deployment tokens; the FBI attributes it to TraderTraitor/Lazarus. Google and partners dismantled the XCPE botnet, which shipped with 1.3 million Android TV boxes from Videostrong and compromised 10+ million additional systems for residential proxy abuse. Supermarket refrigeration systems across seven European countries experienced a second wave of attacks traced to authentication-bypass flaws in Copeland XWEB controllers with fixes available since August. GitBook revoked all personal API tokens after a sophisticated AI-agent attack, and Nextron identified a cluster of five backdoored npm packages sharing identical VM-detection code and credential-harvesting payloads.