Daily digest,
Russian UAV Strikes Disrupt Kyiv's Water and Power Supply (+7 more)
Vulnerabilities
PHP2Shell Vulnerabilities Threaten 70% of Websites with Remote Code Execution
The PHP2Shell vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, pose a critical threat to approximately 70% of websites globally, allowing unauthenticated remote code execution. Discovered by the security firm Calif using AI, these flaws were leaked before a scheduled patch on October 21, 2026, leading to active exploitation attempts. The vulnerabilities affect major platforms like WordPress and Drupal, prompting emergency downtime for numerous organizations, including government sites. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026. The vulnerabilities are particularly dangerous because they can be triggered during initial HTTP(S) requests, before any authentication mechanisms are engaged. As of now, organizations are urged to apply patches immediately to mitigate risks.
Vulnerability · 6 sources · score 73 · CVE-2026-109618, CVE-2026-109619, CVE-2026-111497, CVE-2026-46300
Critical PHP2Shell Vulnerabilities Threaten 70% of Websites
Two critical vulnerabilities, collectively known as PHP2Shell, have been discovered in PHP, a programming language that powers approximately 70% of the world's websites. These flaws allow unauthenticated attackers to execute malicious code remotely on affected servers, posing a severe risk to sensitive information and online services. The vulnerabilities received a CVSS score of 9.2, indicating a critical security risk. PHP developers released security updates on October 21, 2026, urging website administrators to apply these patches immediately. Reports indicate that exploitation attempts have already been observed, including activity against honeypot systems prior to the public disclosure of the vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these vulnerabilities to its Known Exploited Vulnerabilities Catalog. The use of artificial intelligence played a significant role in identifying these flaws, raising concerns about AI's potential to both discover and exploit vulnerabilities.
Vulnerability · 2 sources · score 73 · Log4Shell
Breaches
Binance Suffers Record $6.3 Billion Hack, User Funds Impacted
On October 29, 2026, Binance reported a significant security incident where hackers exploited unauthorized access to the exchange's hot wallets, resulting in the theft of approximately $6.3 billion in cryptocurrency assets. The breach was facilitated through a compromised employee laptop, allowing unauthorized withdrawal transactions. Binance has frozen around $3 billion of the affected assets on blockchain networks and pledged to cover all user losses using its Secure Asset Fund for Users (SAFU) and company reserves. The company has set aside over $6.34 billion in total to address the incident and is actively working with law enforcement and blockchain partners to trace and recover the stolen funds. Withdrawals have been temporarily suspended while security measures are enhanced. The investigation into the breach is ongoing, with no evidence found so far indicating that wallet private keys were leaked. This incident marks one of the largest hacks in cryptocurrency history, raising concerns about the security of centralized exchanges.
Breach · 6 sources · score 69
Binance Hack: $6.3 Billion Stolen Amid Rapid Asset Conversion
On October 30, 2026, Binance suffered a large hack resulting in the theft of approximately $6.3 billion in cryptocurrency. The attackers, linked to North Korean hackers, executed the breach in under 20 minutes, quickly converting stablecoins into less traceable assets like Bitcoin and Ether. As a result, around $3 billion of the stolen funds were frozen by issuers such as Tether and Circle. The hack has raised concerns about the security of centralized exchanges, especially given Binance's previous legal troubles. Despite the freezing efforts, a significant portion of the stolen assets remains under the attackers' control. Binance has pledged to cover the losses using its emergency reserves, but experts warn that financial strength does not equate to operational security.
Breach · 2 sources · score 68
New Google Phishing Scam Exploits Google's Own Infrastructure
Jameson Lopp, co-founder of Casa, alerted users to a phishing scam utilizing Google's infrastructure to send fraudulent emails. The scam targets cryptocurrency holders, directing them to fake login pages that capture sensitive information. Attackers exploited Google Cloud's Application Integration tool to send over 9,000 emails, bypassing standard email security checks. Users reported that clicking the links led to a phishing page disguised as a legitimate login portal. Google stated that it blocked the campaigns, attributing the issue to misuse of its automation tools rather than a security breach. This type of phishing attack has previously been seen with other Google services. Crypto users are particularly vulnerable due to the nature of the scams. The incident highlights ongoing challenges in combating sophisticated phishing techniques.
Breach · 2 sources · score 62
Threat actors and malware
Teams Help Desk Impersonation Leads to AD CS Attacks
Microsoft reported two human-operated intrusions involving help desk impersonation via Microsoft Teams. Attackers socially engineered users into granting remote access through Quick Assist. In the first case, an attacker abused an ESC1 template to obtain authentication certificates for privileged accounts, leading to data theft. In the second case, an attacker used PetitPotam to relay NTLM authentication to AD CS Web Enrollment (ESC8), but further activity was halted after isolating the affected workstation. The incidents highlight vulnerabilities in Active Directory Certificate Services (AD CS) configurations. Microsoft Defender mitigated some follow-on activity, but a privileged identity was still exploited for data exfiltration. The incidents did not exploit vulnerabilities in Microsoft Teams but relied on social engineering tactics. Recommendations for mitigation and detection guidance were provided by Microsoft.
Phishing · 2 sources · score 57 · ESC1, ESC8
Also worth knowing
Russian UAV Strikes Disrupt Kyiv's Water and Power Supply
On October 30, 2026, Russian UAVs attacked critical infrastructure in Kyiv, resulting in significant disruptions to water and electricity services across multiple districts. Kyiv Mayor Vitali Klitschko reported that the strikes affected the Obolonskyi, Darnytskyi, Desnianskyi, and Podilskyi districts, leaving many residents without power and water. Emergency repair efforts are underway, with some areas experiencing reduced water pressure. The attacks have caused widespread concern about the resilience of Kyiv's infrastructure amidst ongoing hostilities. Energy workers are actively working to restore services, but the situation remains critical for affected residents.
Critical Infrastructure · 2 sources · score 74
Binance Suffers $6.3 Billion Hack, Users Urged to Secure Assets
On October 29, 2026, Binance reported a security incident resulting in the theft of $6.3 billion in customer assets, marking it as the largest crypto hack to date. The exchange temporarily suspended all withdrawals and deposits while assuring users that their assets are safe and that losses would be covered using its Secure Asset Fund for Users. Binance co-CEO Yi He stated that the stolen amount represents only about 2% of the company's total assets. The hack is suspected to involve state-tied North Korean hackers, and approximately $3 billion of the stolen crypto has reportedly been frozen. Users are advised to limit their exchange holdings, be wary of scams, and monitor their credentials due to the heightened risk of follow-up attacks. Withdrawals are expected to resume by October 31, 2026, pending security checks. The incident has caused a significant but contained market reaction, with crypto prices experiencing volatility.
Other Threats · 2 sources · score 72
New on leak sites
43 victims listed on ransomware leak sites by 17 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-46300, CVE-2023-2640, CVE-2023-32629
- APT groups: Lazarus Group, Lazarus, Andariel, APT38, Arid Viper
- Malware: TraderTraitor, BloodAlchemy
- Ransomware groups: Lockbit, Qilin, Akira, Aur0ra, BlackCat
- Vulnerabilities: XSS
- Campaigns: Baltic Trust, ClickFix Campaigns
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.