Cybersecurity Weekly Briefing, 6 November

Chrome 157 fixes 213 vulnerabilities, seven of which are critical

Google has released Chrome 157 on the stable channel (versions 157.0.8103.38/.39 for Windows and macOS, and 157.0.8103.38 for Linux) with patches for 213 vulnerabilities, seven of which are critical and 77 of which are high severity. Notable among the critical vulnerabilities are two buffer overflows in Dawn, the cross-platform implementation of the WebGPU standard (CVE-2026-121156 and CVE-2026-121247, both CVSSv3 9.6), and a memory corruption in the ANGLE graphics engine (CVE-2026-121229, CVSSv3 9.6), alongside four use-after-free vulnerabilities.

By type, the most common issues are incorrect or missing authorisation (51 flaws), use-after-free vulnerabilities (45) and interface spoofing (19). Google does not mention any active exploitation of these vulnerabilities.

Nevertheless, given Chrome’s market share, it is recommended that users apply the update as soon as possible and extend this to Chromium-based browsers as their manufacturers roll it out.

More info

Binance details the attack chain behind the $6,430 million theft

Binance has explained how the record theft of $6,430 million in assets took place, as a result of a multi-stage campaign. In June, a Wallet DevOps engineer downloaded a trojanised Homebrew installer from a search engine to install an AI tool, which exposed information about his computer. In September, another engineer was recruited via a legitimate job platform by a fake project manager.

Following two rounds of interviews, he ran a technical test repository containing malicious code on his corporate computer; this code replaced a component of a development tool and deleted forensic evidence. On 20 October, the attacker exploited an internal AI tool to gain access to the computers of two other engineers. On 29 October, using a stolen container deployment token, he launched a script that utilised the internal wallet signing service to issue transactions outside the withdrawal process. Binance has not formally attributed the attack. However, the pattern matches the techniques seen in the 57 cases linked to North Korea that the exchange claims to have thwarted this year.

For the financial sector, this case highlights the need to prevent the execution of third-party code on computers with access to critical infrastructure, to strictly control deployment tokens, and to limit the permissions of internal AI tools.

More info

Vapor Panda is using the ARTEX AI framework against more than 200 organisations, including the presidency of a European country

CrowdStrike has attributed the use of ARTEX – an AI-powered pentesting framework written in Go – against more than 200 organisations since 17 October to the Chinese state-sponsored actor Vapor Panda, which has links to the Earth Estries cluster. Targets include the foreign ministry, the presidency and the prime minister’s office of a European country, alongside its defence, justice, finance and intelligence agencies; a Middle Eastern interior ministry; foreign ministries in Latin America and Asia; and telecoms operators in the US, Belgium and the Philippines.

ARTEX coordinates planning and execution agents supported by DeepSeek and an unidentified commercial subscription-based LLM, under the supervision of a human operator; in a single intrusion, the agents consumed in the region of 1.4 billion input tokens. The recovered transcripts reveal strings such as an unsigned SAML assertion combined with an XXE to query the cloud instance’s metadata service, the exploitation of an unauthenticated orchestration service to gain root access in containers, the reading of LAPS passwords, and the use of keys that had not been rotated since 2022 to forge administrator tokens.

Post-exploitation has been confirmed in nine organisations, with the deployment of BLOODALCHEMY, a derivative of ShadowPad, and the actor has launched password spraying attacks against at least 12 others, including European government bodies.

More info

A 0-day vulnerability in Zyxel GS1900 switches allowed nearly 1,000 devices in 48 countries to be compromised

Binarly has revealed that the campaign which compromised 996 Zyxel GS1900 switches across 48 countries in August exploited a 0-day vulnerability allowing remote code execution without authentication, distinct from the one Zyxel patched in June, CVE-2026-7273 (CVSSv3 8.8 according to the manufacturer). The captured exploit targets /cgi-bin/dispatcher.cgi on MIPS models. The CGI parser copies the parameters to a global buffer before checking the g_count counter, meaning that an oversized value corrupts it and renders it negative.

This allows memory to be written outside the buffer and function pointers to be hijacked, ultimately leading to root-level execution. The June patch added the check after the insecure copy, meaning the ten .2 versions remained vulnerable. Zyxel released the fixed versions on 22 October and published the CVE-2026-107441 advisory on 3 November (CVSSv3 8.8 according to the manufacturer). Attackers stole configurations, root credential hashes and network information, and it is unclear how many devices were compromised by the new vulnerability.

It is recommended that all GS1900 devices be updated to version .3.

More info

Crédit Mutuel Arkéa suffers a cyberattack involving fraudulent transfers totalling over 133 million dollars

The French banking group Crédit Mutuel Arkéa has confirmed a cyberattack that led to fraudulent transactions and forced it to temporarily restrict transfers. According to the bank itself, the attackers gained access to an external service provider’s platform and used it to gain direct access to the bank. They used Arkéa’s own account to transfer funds to other financial institutions and then converted them into cryptocurrencies via specialised platforms.

Blockchain researcher ZachXBT estimates the losses at over $133 million. Arkéa acknowledges this order of magnitude, but not the exact figure, and states that some of the funds have been frozen and that neither customer accounts nor those of its subsidiary Fortuneo were used. The compromised provider, the vulnerability, the malware and the perpetrator have not been publicly identified, and no group has been attributed responsibility.

The French public prosecutor’s office has opened an investigation assigned to the National Cybercrime Office (OFAC).

More info

◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →