News of the Cyber World

[kyonides]

DISCORD IN BRAZIL

A letter to the Discord community in Brazil

You may have already heard about an order from Brazil's National Data Protection Authority (ANPD) requiring us to suspend screensharing and video features in Brazil.

We’re complying with the order and working with the ANPD in good faith, which means that screensharing and video calls will be unavailable for Brazilian users starting now. We are working hard to restore access to these important features as quickly as possible.

This is a serious situation. The order follows a devastating case involving the death of a teenage girl after a coordinated sadistic harm campaign that was carried out across multiple platforms. We work every day to keep these actors off our platform and to make Discord safer for teens. We have been and continue to collaborate with law enforcement in this matter.

We know how much these impacted features matter to our community in Brazil. Gamers, developers, small businesses, and communities of all kinds across Brazil rely on Discord. Friends use video calls to spend time together and screenshare for all sorts of reasons, including just hanging out and sharing what they’re playing.

What continues to work
Discord remains available in Brazil. The order is focused on video functionality, but you’ll still have access to the following features:

• Direct messages and group DMs
  
• Small and large servers
  
• Voice channels and audio-only calls
  
• All other Discord features that don’t rely on video or screensharing
  

In short: Discord is still there for you, and we’re working hard to keep it that way. We’re committed to our community in Brazil, just as we know they’re committed to us.

WORDPRESS

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.

The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026.

"This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said. "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."

The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update."

The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-content/upgrade." This copy also includes the WordPress installer.

"Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution," Alex Thomas, who leads the Wordfence Threat Response Team, said.

A threat actor who is able to win the race condition can gain the ability to execute code on the server, assuming the following conditions are met -

A full-package update containing the installer files
Public web and PHP access to the staging tree
A predictable or discovered staging path, and
Adequate time to complete the attack before WordPress cleans up the temporary files
Although that window has been observed to last only seconds in normal lab environments, threat actors are polling vulnerable paths, such as "setup-config.php," repeatedly in an attempt to trigger the flaw. Over the past 24 hours, Wordfence said it has blocked 62,969 attacks targeting the vulnerability.

CHATGPT

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.

The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.

The trap was an ordinary ChatGPT conversation shared via its public link. It could be sent the same way as any real shared chat: by email, as a chat message, as a support ticket, or as a social post.

The victim did not have to install anything, join a workspace, or sign in through the attacker. In the most reliable version of the attack, they opened the link and clicked ChatGPT's Preview button once. In a later version, Parameter set the page to open Preview on its own, so opening the link was the only step.

What the Attacker Could Do

Once the link opened, the attacker's code ran inside the victim's signed-in session with the same access as the real ChatGPT site. It listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers.

Cybersecurity

The code called ChatGPT's own signed-in APIs directly, rather than copying what happened to be on the screen. Because it ran with the victim's full web access, its reach was not limited to those chats. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote.

The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users.

How the Link Broke Out of Its Sandbox

Here is how the chain worked, according to Parameter. ChatGPT can turn a block of HTML in a chat into a small web page through a feature called Preview. Because that page can hold any code, ChatGPT runs it in a locked-down frame on a separate web address, where it cannot read the main ChatGPT page around it.

That sandbox held. The way in came from a second feature in the same conversation.

The shared chat also contained an interactive graph, and drawing it loaded a math library called MathLive into the main ChatGPT page. Loading MathLive left a listener running there that accepted messages about its on-screen keyboard.

A message passed between browser frames is safe only if the receiver checks who sent it. Parameter found that this listener accepted a keyboard message from any sender, and that the message was allowed to carry raw HTML. The Preview could then reach across the boundary and hand attacker HTML to the trusted main page.

That HTML built a new frame that the browser treated as part of chatgpt.com. A script loaded from YouTube then supplied the code that ran inside it.

FBI VS NORTH KOREA

FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.

The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).

"It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages," the FBI said in a statement.

The agency has also provided a list of wallet addresses that the attackers are said to be using to launder the stolen assets.

The development comes as Binance said it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident.

"Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services," Binance said in a statement.

"We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident."

Cybersecurity

The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.

"This single incident almost doubles the total cryptoassets stolen by the regime," blockchain analysis firm Elliptic said. "Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen over $6.5 billion in cryptoassets in recent years."

Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.

TraderTraitor is the name assigned to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading malware-laced applications. The cluster is known to be active since at least 2020.

POLYMARKET

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company.

Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached the hackers' wallet in under an hour.

The replaced script came from DebugBear, whose real user monitoring (RUM) tool measures how fast web pages load for real visitors.

Researchers at Hudson Rock downloaded the malicious file on October 29 from the address Polymarket's site used to load the DebugBear script. They also found a change in Polymarket's site code that removed the DebugBear script.

DebugBear's DNS records were compromised through its domain registrar, the company said on X. Its early findings indicate the attack targeted one customer's website. It has seen no sign of a break-in to its own systems, though it is still looking.

Researchers at Ohey found a different server answering for DebugBear's web addresses at 18:13 UTC, when the malicious file was still online. Earlier that day, the normal script had been served from Google Cloud Storage. Each DebugBear customer loads its own copy of the script, and the file that was swapped was Polymarket's.

How the Script Took the Money

The code reuses the access a signed-in trader already has in an open Polymarket page, Hudson Rock found after reviewing the file without running it. It reads account details that Polymarket keeps in the browser, including a set of trading API keys.

Those API keys alone cannot place an order on Polymarket, because orders also need a wallet signature. Hudson Rock found no part of the code that sends the keys, a password, a seed phrase, or a private key to the server it reports to.

Cybersecurity

Instead, the code searches the page for the part of Polymarket's site that places orders, and for the signer that approves the account's transactions.

It then takes one of two paths. For accounts that sign in with their own crypto wallet, it moves the trader's positions straight to the hackers' wallet. For accounts that sign in via email, it sells positions at ever-worse prices and then moves the money out.

In both paths, the code asks the account's own signer to sign its requests and hands them to Polymarket's relayer, which submits them. Hudson Rock said a signing request alone does not prove a trader signed without seeing a prompt. The wallet provider may still ask the trader, refuse, or apply its own rules for the session.