Check Point weekly bulletin: $6.3B Binance theft, Polymarket JS supply-chain attack, actively exploited Brotli RCE and Drupal Commerce flaw
Check Point Research's threat intelligence bulletin for the week of 2 November 2026 aggregates several major incidents and actively exploited vulnerabilities. The largest is a reported theft of approximately $6.3 billion in digital assets from Binance, attributed to a North Korean group after the compromise of a DevOps engineer's laptop and abuse of internal wallet infrastructure. Polymarket disclosed a third-party compromise that pushed malicious JavaScript to its site, hijacking authenticated trading sessions, with about $2.7 million traced to an attacker-controlled wallet. Data breaches were reported by Japan Airlines (about 92,000 passengers via the Amadeus reservation system) and the Florida Department of Education (up to 4.9 million individuals, including Social Security numbers, identified on 19 October). The bulletin also covers AI-assisted operations by the GOLD OGRE ransomware group, North Korean actors, and the China-linked VAPOR PANDA group's ARTEX framework used against more than 200 organisations in at least 14 countries with the BLOODALCHEMY backdoor.
Entenda a falha
A vulnerabilidade
The bulletin covers four CVEs. CVE-2026-98432 is a Linux kernel memory management flaw in TCP networking, CVSS 9.8, that allows unauthenticated remote code execution as root on systems exposing Multipath TCP listeners. CVE-2026-111497 (HTTP2Shell) is an actively exploited remote code execution flaw in Brotli decompression implementations, first tied to Node.js but possibly also affecting Python packages, .NET and proxies. CVE-2026-118539 is a highly critical access control bypass in the Drupal Commerce Core module that lets unauthenticated attackers bypass authorization on routes and data fields, and it is exploited in attacks. CVE-2026-76418 is a high-severity flaw in Cisco ASA and Firepower Threat Defense with SSL VPN configured that lets unauthenticated attackers remotely crash devices. The bulletin gives no affected or fixed version ranges.
Como funciona
For the Linux kernel flaw, the articles say only that it sits in memory management in the TCP stack and is reachable through Multipath TCP listeners, so network traffic sent to an exposed listener can lead to code execution in the kernel. For the Brotli flaw, compressed data processed by a vulnerable decompression implementation leads to remote code execution, and the articles give no further detail. In Drupal Commerce Core, requests to application routes and data fields are not adequately protected, so authorization checks can be bypassed without logging in. In Cisco ASA and FTD, traffic sent to a device with SSL VPN enabled can crash it. The articles do not describe the exact steps at which each one goes wrong.
Por que é vulnerável
The articles give only partial causes. For Drupal Commerce Core, the cause is insufficient protection of application routes and data fields, which is a missing or inadequate authorization check. For the Linux kernel, the cause is described only as a memory management flaw in TCP networking. For Brotli and Cisco ASA/FTD, the articles do not state a root cause. They also do not explain why any of the flaws went unnoticed or what the fixes change.
Como foi descoberta
Check Point Research analyzed HTTP2Shell (CVE-2026-111497) and reports automated scanning and suspicious exploitation attempts, and says its IPS provides protection. Cisco patched CVE-2026-76418 and confirmed it had been exploited before the updates were available. Drupal addressed CVE-2026-118539, which the bulletin says has been exploited in attacks. CVE-2026-98432 is described as disclosed with a CVSS of 9.8. The articles do not say who found any of these flaws or how they were reported.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article mentions a published proof of concept. They do show working exploitation in the wild: Brotli HTTP2Shell (scanning and exploitation attempts), Drupal Commerce Core (exploited in attacks) and Cisco ASA/FTD (exploited before the patch). No copy of any exploit is published in the articles. Because these are being used in real attacks, patching the Drupal, Cisco and Brotli components should be treated as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 03:18.
Detalhes técnicos
- HTTP2Shell (CVE-2026-111497): an actively exploited remote code execution flaw in Brotli decompression implementations, initially tied to Node.js but potentially reaching Python packages, .NET and proxies; automated scanning and exploitation attempts have been observed.
- CVE-2026-98432: a Linux kernel memory management flaw in TCP networking rated CVSS 9.8, enabling unauthenticated remote code execution with root privileges on systems exposing Multipath TCP listeners.
- CVE-2026-118539: a highly critical access control bypass in Drupal Commerce Core, exploited in attacks, allowing unauthenticated attackers to bypass authorization on routes and data fields.
- CVE-2026-76418: a high-severity denial-of-service flaw in Cisco ASA and Firepower Threat Defense with SSL VPN enabled, confirmed by Cisco as exploited before patches shipped.
- UAT-11473 exploited a Cisco Catalyst SD-WAN authentication bypass to deploy the KeyDrift framework against aerospace, defense, satellite and policy research targets, extracting encryption material from network controllers.
- The Yoba campaign distributes installers posing as ChatGPT and Claude desktop applications via fraudulent GitHub projects, side-loading malicious components from legitimate signed executables.
- More than 400 incidents involved abuse of Microsoft Teams external chat, with attackers impersonating IT support to obtain remote sessions, in some cases leading to ransomware activity.
Remediação
Apply the Drupal Commerce Core, Cisco ASA/FTD and Linux kernel updates as a priority given confirmed exploitation and the unauthenticated network reach of these flaws, and inventory Brotli decompression dependencies beyond Node.js. Restrict or disable Microsoft Teams external chat and federated access where it is not required, and verify the provenance of AI desktop application installers. Check Point reports IPS coverage for the Node.js Brotli RCE. The bulletin provides no severity scores, affected version ranges or patch identifiers for the Brotli, Linux kernel or Drupal flaws, and no indicators of compromise.
Linha do tempo
-
Check Point weekly bulletin: $6.3B Binance theft, Polymarket JS supply-chain attack, actively exploited Brotli RCE and Drupal Commerce flaw
ler a análise desta fonte ocultar
Check Point Research's threat intelligence bulletin for the week of 2 November 2026 aggregates several major incidents and actively exploited vulnerabilities. The largest is a reported theft of approximately $6.3 billion in digital assets from Binance, attributed to a North Korean group after the compromise of a DevOps engineer's laptop and abuse of internal wallet infrastructure. Polymarket disclosed a third-party compromise that pushed malicious JavaScript to its site, hijacking authenticated trading sessions, with about $2.7 million traced to an attacker-controlled wallet. Data breaches were reported by Japan Airlines (about 92,000 passengers via the Amadeus reservation system) and the Florida Department of Education (up to 4.9 million individuals, including Social Security numbers, identified on 19 October). The bulletin also covers AI-assisted operations by the GOLD OGRE ransomware group, North Korean actors, and the China-linked VAPOR PANDA group's ARTEX framework used against more than 200 organisations in at least 14 countries with the BLOODALCHEMY backdoor.
Technical Details
- HTTP2Shell (CVE-2026-111497): an actively exploited remote code execution flaw in Brotli decompression implementations, initially tied to Node.js but potentially reaching Python packages, .NET and proxies; automated scanning and exploitation attempts have been observed.
- CVE-2026-98432: a Linux kernel memory management flaw in TCP networking rated CVSS 9.8, enabling unauthenticated remote code execution with root privileges on systems exposing Multipath TCP listeners.
- CVE-2026-118539: a highly critical access control bypass in Drupal Commerce Core, exploited in attacks, allowing unauthenticated attackers to bypass authorization on routes and data fields.
- CVE-2026-76418: a high-severity denial-of-service flaw in Cisco ASA and Firepower Threat Defense with SSL VPN enabled, confirmed by Cisco as exploited before patches shipped.
- UAT-11473 exploited a Cisco Catalyst SD-WAN authentication bypass to deploy the KeyDrift framework against aerospace, defense, satellite and policy research targets, extracting encryption material from network controllers.
- The Yoba campaign distributes installers posing as ChatGPT and Claude desktop applications via fraudulent GitHub projects, side-loading malicious components from legitimate signed executables.
- More than 400 incidents involved abuse of Microsoft Teams external chat, with attackers impersonating IT support to obtain remote sessions, in some cases leading to ransomware activity.
Remediation
Apply the Drupal Commerce Core, Cisco ASA/FTD and Linux kernel updates as a priority given confirmed exploitation and the unauthenticated network reach of these flaws, and inventory Brotli decompression dependencies beyond Node.js. Restrict or disable Microsoft Teams external chat and federated access where it is not required, and verify the provenance of AI desktop application installers. Check Point reports IPS coverage for the Node.js Brotli RCE. The bulletin provides no severity scores, affected version ranges or patch identifiers for the Brotli, Linux kernel or Drupal flaws, and no indicators of compromise.