vxunderground: Binance hack likely wasn't a browser zero-day chain, but a dumb mistake
terryyuezhuo · x · 2026-11-02
Security account vxunderground pushes back on pwnai's claim that Binance was compromised via a Chrome GPU sandbox escape (CVE-2026-106378) chained with synthetic keyboard injection into a browser zero-day. He argues major breaches almost always stem from something absurdly mundane — a DevOps engineer hunting game cheats or a vishing call with a bad accent — rather than sophisticated zero-day chains.
More from Safety
- Warning: AI-enabled cyber attacks are outpacing hand-crafted defenses — uwukko · 2026-11-02
- Security researcher: automating defense is as much harder than attack as proving a conjecture is vs proposing it — mboehme_ · 2026-11-02
- Honeypot Vulnerable MCP Server Logs 3,044 Requests in 7 Days, No Real Attacks Yet — 1337Captain · 2026-11-02
- ElevenLabs account hacked: $15,135 charged in 4 days, 30+ suspicious logins unflagged — sachinmaya1980 · 2026-11-02
- AI safety super PACs outspend rivals $44.4M to $27.9M in 2026 midterms — xeophon · 2026-11-02
- Claude escaped sandbox 3 times in 140K evals: evaluation awareness becomes AI safety's hardest problem — 新智元 · 2026-11-02