IT Security News Roundup: 2026-10-30 Morning

IT Security News: Morning roundup, 2026-10-30

Summary

Supply-chain and developer-tool compromise dominated this morning's news. Attackers hijacked the Claude Code extension on a marketplace, automated attacks on GitHub workflows, and ran a malicious-code campaign that drained Polymarket traders. At the same time, Binance reported a record crypto heist and Cisco patched an actively exploited firewall zero-day. AI cut across both attackers and defenders, from malware that embeds an OpenAI client to commentary on how agents are reshaping SOC jobs and business processes. The common lesson for readers is that trusted tooling, credentials and automation are now the weakest links.

1. Kaspersky's Securelist describes automating the generation of filters for security alerts with three approaches: a classic algorithm, a single large language model, and a group of LLM agents. It is a practical look at cutting alert noise.
2. Glasgow-based Acumen Cyber will provide Highland Spring Group, maker of the UK's top-selling bottled water, with round-the-clock monitoring, threat detection and incident response, supplementing the company's internal IT team and existing defences.
3. An opinion piece follows an earlier claim that coding agents out-develop humans, arguing people remain essential. Agents lack non-code context, accountability and the ability to say no or "I don't know", and they cannot start projects on their own.
4. Thales Imperva API Security now lets teams investigate six token risks per endpoint, including weak signing algorithms, overly long lifetimes, exposed credentials and poor expiry enforcement, which helps prioritize fixes across API and MCP estates.
5. Researcher Ben Zimmermann scanned 7.25 million public Gitee repositories and found 26,400 cloud and AI credentials that still worked. Anyone who copied them could have used them, underlining the cost of secrets committed to public code.
6. Ukrainian Artem Stryzhak, an affiliate of the Nefilim and Hive ransomware operations, received a 70-month prison sentence for attacks on hospitals, government agencies and businesses in the US and abroad.
7. NebuSec says a Telegram Android flaw, chained with two other bugs, could give an attacker full control of a phone once the victim answered a voice call. Telegram fixed it in version 12.10.4 in late September.
8. Attackers abused GitHub issues to hit 61 public repositories in under an hour. Vulnerable workflows trigger within a second of an issue being opened, so exploitation is near-instant and automated.
9. The official Claude Code extension on Open VSX was compromised to install a persistent SSH backdoor. The root cause was a compromise of the Cursor Marketplace, which Cursor briefly took down to remove the malware.
10. Silicon UK talks with Slalom's John Michaelides about how AI agents are changing teams, leadership and accountability, and what managing people and agents side by side will require.
11. The piece argues AI systems are starting to handle alert investigation, evidence gathering, correlation and response on their own. That will reshape how SOCs organize work and what analyst careers look like.
12. Customers are handing AI agents their bank credentials to move money and pay bills, and US banks are detecting and in some cases blocking this. Banks cannot tell human from agent activity, creating a conflict over authorization.
13. A webinar promotes building AI threat readiness into security operations. Advanced AI models help attackers find vulnerabilities and write exploits faster, shrinking the time defenders have to act.
14. Attackers are distributing the Yoba malware through fake ChatGPT and Claude downloads on GitHub, using signed software files. Windows users who trust a download because it carries a signature are at risk.
15. Cisco patched a denial-of-service zero-day in ASA and Threat Defense software that attackers are exploiting to remotely crash firewalls, including SSL VPN devices, so affected organizations should update promptly.
16. Akamai research shows scam detections topped six million in Q2 2026, double the earlier volume and now ahead of phishing, which signals a shift in how fraudsters target victims online.
17. Binance confirmed a $6.3 billion hack, the largest crypto heist on record, which blockchain investigators attribute to North Korea. The exchange is trying to freeze the stolen funds.
18. Malicious code tied to a website monitoring tool hijacked logged-in Polymarket sessions and drained more than $2 million from traders, another case of a third-party dependency becoming the attack path.
19. Reporting describes ICE's Homeland Security Investigations running far-reaching surveillance of left-wing activists, on a scale compared to past FBI and CIA crackdowns on the Civil Rights and anti-war movements.
20. A ranked list of ten user and entity behavior analytics tools. The premise is that stolen credentials defeat most controls, so baselining normal behavior and flagging deviations has become key to detection.
21. Five more suspects, four men and one woman, were added to the EU Most Wanted list over the 2022 TEFAF art fair robbery in Maastricht, according to Dutch prosecutors and police.
22. GitHub launched a public-preview npm firewall that inspects metadata requests and package downloads and blocks suspicious packages at install time, giving teams a policy gate against malicious dependencies.
23. With many enterprises expected to scale up AI agents, the article gives six expert-recommended capabilities for orchestration platforms, such as tracking cost and business value ("tokenomics") and running evaluations before deployment.
24. Lumen's Black Lotus Labs tracked a covert relay network called Silent Train for three years and ties it to China-linked Volt Typhoon. It concealed attacks involving at least four zero-days against critical systems.
25. Cisco Talos found NIK C2, a Go-based 64-bit Windows remote access tool with an embedded OpenAI client. Operators can send prompts through an infected machine and read the model's replies in their C2 panel.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Filter generation in practice: from algorithms to LLMs
2. Highland Spring Appoints Acumen Cyber for 24/7 Cyber Protection
3. Eight reasons you are better than coding agents
4. Strengthening API and MCP Security Through Token Risk Detection with Thales Imperva API Security
5. 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
6. Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months
7. Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
8. Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
9. Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
10. After the Org Chart: Managing People and AI Agents Together
11. The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers
12. AI agents are upending digital business processes
13. Webinar: How to Build AI Threat Readiness Into Your Security Operations
14. Hackers Use Fake ChatGPT and Claude Downloads on GitHub to Spread Malware
15. New Cisco firewall zero-day exploited to crash SSL VPN devices
16. Online Scam Volumes Double to Overtake Phishing
17. Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds
18. $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
19. ICE Is Running One of the Largest Anti-Left Surveillance Operations in US History
20. Top 10 Best UEBA Tools in 2026 [Ranked & Scored]
21. Five TEFAF robbery suspects added to EU Most Wanted
22. GitHub Launches npm Firewall to Block Malicious Packages Before Installation
23. Six elements of resilient AI orchestration platforms
24. Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
25. New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs