Today's briefing

Saturday 31 October 2026

Florida says up to 4.9 million student aid applicants had Social Security numbers stolen, attackers move on GitLab, Drupal Commerce and WordPress flaws, a tampered Claude Code extension hits Cursor users, Trezor warns of a spy board in a wallet, plus Revolve, Poryadok, GCHQ's missing USB sticks and a jailed Syrian Electronic Army hacker.

10 stories

Breach29 Oct 2026

Florida says hackers took Social Security numbers of up to 4.9 million student financial aid applicants

Florida's Department of Education says criminals broke into the Florida Student Financial Aid website, the state's main portal for college scholarships and grants such as Bright Futures, and that the breach may affect about 4.9 million people. It learned of the intrusion on 19 October and disclosed it on Thursday. Exposed details include names, home addresses, phone numbers, email addresses, gender, dates of birth and Social Security numbers, though not everyone had every item taken. The site has been taken offline and state police are investigating; the department has not said who was behind it or how they got in, but says aid payments, tuition and eligibility for grants and loans are not affected.

Why it matters: A name, date of birth and Social Security number together are everything a fraudster needs to open credit in someone's name, and many of the people affected are young and may not check their credit. Anyone who has applied for Florida student aid should watch their accounts, check their credit reports, consider a credit freeze or fraud alert, and be wary of 'breach support' emails and calls.

Sources

Vulnerability30 Oct 2026

GitLab update: the maximum-severity flaw is now being exploited, and CISA orders US agencies to patch by Sunday

CISA has added CVE-2026-97229, the 10-out-of-10 GitLab flaw covered here on 22 October, to its list of vulnerabilities known to be exploited. A specially crafted regular expression in a CI/CD pipeline file can trigger an integer overflow and let an attacker who is not logged in run code on a self-managed GitLab server. The Alpine Linux project says an unknown attacker repeatedly tried the flaw against its unpatched GitLab server on 20 and 21 October; it found no sign the attack succeeded but rebuilt the server from scratch to be safe, and says its packages and releases were not tampered with. US federal agencies must patch by 1 November.

Why it matters: A GitLab server holds an organisation's source code, build pipelines and often secret keys, so a takeover can lead straight into a software supply-chain attack. Anyone running their own GitLab should upgrade to a fixed release now and use GitLab's published detections to look for signs of earlier attempts. GitLab.com is already patched.

Sources

Supply chain30 Oct 2026

Fake update to the Claude Code extension in Cursor's marketplace tried to plant SSH backdoors on developers' computers

For about 11 hours on 29 October, Cursor's extension marketplace served a tampered version of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) to Windows and macOS users, reaching at most 5,000 people, Cursor says. Hidden code at the start of the extension ran as soon as it loaded: it sent details about the computer to the attackers, added their SSH key so they could log in, tried to switch on remote login and open a reverse tunnel, and set itself to restart automatically. Researchers say coding mistakes meant the remote login step failed on most machines, but the key, the persistence and the data theft still happened. Cursor removed the extension, briefly shut the whole marketplace to audit it and rotate its keys, and got the attackers' server taken offline; Microsoft and Anthropic say the official versions elsewhere were not affected.

Why it matters: Developer tools run with full access to source code and secret keys, which makes extension marketplaces a valuable target. Anyone who installed or updated the extension in Cursor during that window should run Cursor's check, look for an unknown 'svc-telemetry' SSH key, remove the persistence, and change any passwords or keys the machine could reach. Uninstalling the extension alone is not enough.

Sources

Vulnerability30 Oct 2026

Attackers exploit a Drupal Commerce flaw to place fraudulent orders on online shops

Drupal has warned that a 'highly critical' flaw in Commerce Core, a shopping-cart module used by more than 42,000 websites, is being exploited. Tracked as CVE-2026-118539, it lets attackers who are not logged in get around checks on certain pages and order fields, for example changing prices, discounts or payment status. Commerce's maintainers, Centarro, say two shop owners reported attempts to place fraudulent orders, and that they don't believe the attacks have spread more widely so far. The fix is in Commerce Core 3.3.13, or 8.x-2.41 for the older branch.

Why it matters: This bug lets criminals take goods without paying, or pay less than they should. Drupal shop owners should update now, then check recent orders for ones that were never paid, show odd prices, or have discounts nobody on staff added.

Sources

Vulnerability30 Oct 2026

Hackers race to exploit a new WordPress flaw that opens a few-second window during updates

WordPress 7.1.4, released on 28 October, fixes a high-severity flaw (rated 8.1) in WordPress Core versions 4.7 to 7.1.3. During a full update, WordPress unpacks the new files, including its installer, into a predictable folder under wp-content/upgrade that the web can often reach. An attacker who requests the installer at exactly the right moment can take control of the site's server. Security firm Wordfence says it blocked nearly 63,000 attempts in 24 hours, with some attackers repeatedly checking the same sites for about 14.5 hours, hoping to catch an update in progress.

Why it matters: The window is only seconds long, but attackers are clearly watching for it, and WordPress powers a huge share of the web. Site owners should update to 7.1.4 now, block web access to the wp-content/upgrade folder if they can, and look for unfamiliar admin accounts, plugins or PHP files.

Sources

Threat30 Oct 2026

Trezor tells some wallet buyers to move their crypto after a report of a hidden spy board in one device

Hardware wallet maker Trezor says a customer in Indonesia found an extra circuit board, with a mobile data module and an antenna, inside a Trezor Safe 5 bought in August from CryptoBilis, which was an official Trezor reseller in Southeast Asia until this month. According to the report, the board reads what the screen shows, including the recovery phrase, and sends it out over a mobile network whenever the wallet is plugged in. Trezor has not yet examined the device but says the report is credible and sophisticated enough to warn customers now. No buyer has reported losing funds.

Why it matters: A hardware wallet is only as trustworthy as the supply chain it came through. Anyone who bought a Trezor from CryptoBilis since March 2026 should move their funds to a new wallet with a new recovery phrase (reusing the old phrase does not help), not set up an unused device, and contact Trezor for a free replacement. Expect scammers to use the news: Trezor will never ask for your recovery phrase.

Sources

Breach30 Oct 2026

Fashion retailer Revolve says hackers took saved payment card numbers from customer accounts

US online fashion retailer Revolve told the Securities and Exchange Commission on Thursday that hackers got into several of its systems. Its early investigation found they used automated methods to collect names, contact details, card numbers and expiry dates of customers who had saved a payment card in their online account. Revolve has not said how many people are affected, but filings with US state regulators include about 127,200 people in Texas alone. The company says the activity has been stopped, law enforcement has been told and its business was not disrupted.

Why it matters: Card numbers with expiry dates and contact details can be used for fraud and for convincing phishing. Revolve customers with a saved card should watch their statements, report anything odd to their bank, and consider asking for a new card. Saving cards on shopping sites is convenient but means one breach can expose them.

Sources

The Record

Outage30 Oct 2026

Cyberattack shuts stores and online services of Russian home goods chain Poryadok for five days

Russian home goods retailer Poryadok, which runs 48 stores in 32 cities, says a cyberattack is behind problems that began on Sunday and took down its website, app and some shops. Customers have been unable to collect orders they had paid for, use loyalty points, arrange returns or reach customer support, and services were still down on Friday, according to outage reports. The company says it is gradually restoring operations but has not given a timeline, said how attackers got in, or said whether customer data was taken.

Why it matters: It is another example of a cyberattack stopping a retailer from trading in its physical shops as well as online. Businesses should have an offline plan for keeping stores running and keeping customers informed when their systems go down.

Sources

The Record

Policy30 Oct 2026

UK spy agency GCHQ cannot account for 'thousands' of USB sticks and other storage devices, watchdog says

The Investigatory Powers Commissioner's Office says in its 2025 annual report, published on Thursday, that GCHQ cannot account for USB sticks, external hard drives, CDs, memory cards and other removable storage, with the agency itself estimating the total 'in the thousands'. The watchdog says it is 'very concerned' about how long GCHQ has taken to investigate, and some devices may hold data gathered under surveillance powers. The report does not suggest any devices reached hostile states. GCHQ says its old tracking system was not robust enough, calls it mainly a record-keeping problem, and says it has acted on all of the watchdog's recommendations.

Why it matters: Removable storage is one of the easiest ways for sensitive data to go missing, even at a top security agency. Any organisation that uses USB drives should keep track of every device, encrypt them, and consider blocking them altogether where it can.

Sources

The Record

Law & order30 Oct 2026

Syrian Electronic Army hacker jailed for 42 months in the US over attacks on Western media

A member of the pro-Assad Syrian Electronic Army has been sentenced to 42 months in prison by a US federal court in Virginia, the Justice Department said. Prosecutors say he hacked about 47 Western news outlets, non-profits and other organisations, mainly by sending phishing emails to steal staff passwords and then defacing websites and hijacking social media accounts. The group's 2013 takeover of the Associated Press Twitter account, which falsely reported explosions at the White House, briefly wiped about $136 billion off US stock markets. He was first charged in 2014 and taken into US custody last year; a second member charged alongside him remains at large.

Why it matters: It shows that hackers can face justice years after their attacks. Many of the group's break-ins started with simple phishing, which is why multi-factor authentication on important accounts, especially social media accounts used by organisations, matters so much.

Sources