Critical Linux TCP flaw and record $6.3B Binance hack lead the day

A severe Linux kernel TCP flaw rated 9.8 on the CVSS scale leads today: Anthropic says its AI model wrote a working exploit that gives unauthenticated remote attackers root command execution. The record $6.3 billion Binance heist, which may have started with a compromised DevOps engineer’s laptop, is the day’s other big story.

Security

Linux kernel TCP flaw CVE-2026-98432 rated 9.8 affects Ubuntu and RHEL

The Linux kernel’s own CVE team rates CVE-2026-98432, a flaw in the kernel’s TCP code, at 9.8 out of 10. It affects Ubuntu, Red Hat Enterprise Linux and other distributions. Anthropic said on October 27 that its AI model wrote an exploit for the flaw that lets a remote attacker with no credentials run commands as root on affected Linux servers. Patch as soon as your distribution ships a fixed kernel. Source

Analysts attribute the roughly $6.3 billion Binance hack to North Korea’s TraderTraitor

TRM Labs calculated about $6.36 billion siphoned from Binance wallets across ten blockchains on October 29, with most of the money gone within roughly 20 minutes, dwarfing the previous record $1.5 billion Bybit theft. Binance’s initial investigation suggests the intrusion may have started with a compromised DevOps engineer’s laptop that let an attacker access a service container and submit unauthorized withdrawals; no evidence of a wallet private key leak has been found. TRM attributes the attack to North Korea’s TraderTraitor unit with high confidence. Chainalysis also believes TraderTraitor is the likely perpetrator, and blockchain investigator ZachXBT named the Lazarus Group as the probable attacker. TRM tallied around $2.7 billion in frozen assets by early October 30, with Binance estimating the frozen total at roughly $3 billion. Attackers still hold over 420,000 ETH and 18,270 BTC — about $2.4 billion that no issuer can freeze. Source

ThreatsDay rounds up critical firewall flaws, banking trojans and token theft

The Hacker News’ weekly roundup covers critical firewall vulnerabilities, rented banking trojans, a weaponized PDF campaign and token theft, plus 26 more stories. It notes exposed passwords, old bugs still being exploited, and attackers borrowing trust from familiar apps, websites and AI tools. Source

Self-hosted

PicPeak: event-focused self-hosted photo galleries with guest uploads

PicPeak is an open-source (MIT), self-hosted photo and video gallery platform that treats each gallery as an event. Galleries can be password-protected, set to expire and shared by link, and visitors can download images or the whole collection as a ZIP without an account. Guests can contribute photos directly, and a live slideshow mode displays incoming photos during an event. Deploy with an all-in-one Docker image using SQLite, or a Docker Compose stack with PostgreSQL and Redis. Storage supports local disks and S3-compatible backends, and existing media directories can be referenced without copying. Source

Releases

n8n 1.123.90 requires a signed token for invitations

The 1.123.90 release (October 29) fixes the core so that accepting an invitation requires a signed token, and improves the Google Drive Trigger node to read the watched item instead of listing changes. Source

n8n 2.46.2 pre-release tightens execution permissions and queue handling

The 2.46.2 pre-release (October 29) requires the execution:read permission when workflow-scoped routes read execution data, and fixes queue-mode behavior so each new job goes to one idle worker in turn and waiting jobs are included in the claiming list. It also re-syncs the migration finding table after an upgrade and adds version-based selection of managed OAuth apps. Source

Bottom line

• Apply kernel updates for CVE-2026-98432 (CVSS 9.8, unauthenticated remote root) as soon as your distribution releases them.
• Review policies around engineer laptops and service-container access. Binance’s early findings suggest the intrusion may have started with a compromised DevOps laptop.
• If you run n8n, update to 1.123.90 for the signed-token invitation fix.