> InfoSec News Nuggets – 11/02/2026

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack Blockchain analytics firm Chainalysis has disclosed a data breach after an external actor used offensive agentic AI techniques to gain unauthorized access to its systems and internal tools. The company says investigation content, transaction and query results, and clear-text passwords and secrets were not compromised, but non-sensitive customer data such as user IDs, full names, email addresses and organization role labels was accessed. Chainalysis stressed the incident is unrelated to the recent Binance heist, has not said how many people were affected, and is urging users to watch for unexpected authentication prompts and password reset requests and to make sure MFA is enabled.   North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack Hackers linked by researchers to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, the largest crypto theft on record and more than four times the size of the 2025 Bybit heist. Binance says the attackers compromised several systems, including an engineer’s laptop, before reaching a privileged system that let them make massive withdrawals, with most of the money moved in about 20 minutes. Blockchain analysis firms TRM Labs and Chainalysis attribute the attack to the TraderTraitor group, roughly $3 billion has been frozen on-chain, the FBI and Secret Service are investigating, and Binance has promised to cover all customer losses.   Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Palo Alto Networks has warned that threat actors are actively exploiting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) against internet-exposed PAN-OS management interfaces, allowing unauthenticated remote code execution. The warning follows research showing a suspected China-nexus actor chaining the flaws with the Fragnesia Linux kernel privilege escalation bug (CVE-2026-46300) to root 25 servers, including systems in a U.S. government-affiliated environment, before moving on to attack Active Directory. CISA has added Fragnesia to its KEV catalog, patches are now available for all affected PAN-OS branches, and customers are urged to remove public internet access to management interfaces and restrict it to trusted internal IP addresses.   Claude Code extension poisoned with persistent SSH backdoor A tampered build of Anthropic’s Claude Code extension, version 2.1.313, was served through Cursor’s extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 developers. The injected code runs as soon as the extension loads, adds an attacker SSH key labeled svc-telemetry to the user’s authorized keys, opens a persistent outbound SSH tunnel, sets up reboot persistence on macOS, Linux and Windows, and reports host details along with the names of credential-like environment variables back to the operator. Uninstalling the extension does not remove the backdoor, so affected users are advised to check for the planted key, run the published cleanup scripts, consider rebuilding machines and rotate any credentials the machine could reach.   UNM Health ransomware attack disrupts patient care, surgeries The University of New Mexico Health Sciences Center suffered a cyberattack that forced UNM Health to limit new admissions, divert ambulances, suspend outpatient surgeries and appointments, and cancel classes at its health sciences schools. A new ransomware group called Byod claimed the attack, saying it compromised 36,000 systems including Active Directory, the Microsoft Entra tenant and Oracle databases and stole SSNs, payroll, student, research and patient data, while UNM says only some end-user devices were affected and core systems were not penetrated. Critical systems are back online, and patients, staff and students are being advised to stay alert for phishing and unsolicited communications. The post InfoSec News Nuggets – 11/02/2026 appeared first on AboutDFIR - The Definitive Compendium Project.