Know what changed.
Trace why it matters.

The FBI attributed the October 29 theft of roughly $6.3 billion from Binance to TraderTraitor, a North Korean operation linked to the Lazarus Group. Binance said the incident began when a DevOps engineer’s laptop was compromised, giving attackers access to a service container and enabling unauthorized withdrawal approvals.

Binance said it had replenished about 95 percent of the stolen assets and resumed withdrawals, while the remaining tokens were harder to replace because of limited liquidity.

IBM said two critical Langflow flaws could let a remote attacker with no account bypass authentication or run arbitrary code. Langflow is an open-source tool for building AI agents and workflows, and its vulnerability reports go to IBM.

For teams using workflow builders, the reported authentication boundary is more decision-relevant than the platform’s AI branding.

Sophos reported that the Aur0ra ransomware group, tracked as GOLD OGRE, used AI agents to move through victim networks, collect credentials and pursue domain-administrator access. Sophos recovered late-August artifacts from the Cursor AI coding assistant showing attackers supplied AI agents with VPN logins, proxy access, targets and objectives.

The reported artifacts distinguish use of AI inside an intrusion workflow from claims that AI itself was the compromised victim.