October 31, 2026
Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits
GLM-5.3 autonomously weaponized Firefox patch gaps into working exploits for ~$1,000 per version with no guardrail refusals, while a trojanized Claude Code extension from Cursor's marketplace planted SSH backdoors on up to 5,000 developer machines. CVE-2026-97229 in GitLab (CVSS 10.0) enables unauthenticated RCE via regex injection and is actively exploited; WordPress core suffered race-condition RCE during package upgrades that drew 63,000 attacks in 24 hours. Binance disclosed a $6.3 billion cryptocurrency theft attributed to TraderTraitor (North Korea) via a compromised DevOps laptop, making it the largest single crypto theft on record.