Daily digest,
Binance Hit by $6.3 Billion Cyberattack Linked to North Korea (+6 more)
Vulnerabilities
PHP2Shell Vulnerability Exposes 96% of Internal PHP Devices
Genians reported that 96% of devices running PHP on corporate internal networks are vulnerable to the PHP2Shell remote code execution flaw. This vulnerability affects devices such as NAS, routers, and CCTV systems, with 78% of vulnerable devices running unsupported PHP versions. The analysis revealed that 89% of these devices are located on private IP ranges, making them invisible to external scanners. Genians emphasized the need for organizations to inspect internal networks thoroughly, as traditional scanning methods focus mainly on external web servers. The PHP2Shell vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on October 26, indicating. Organizations are urged to isolate vulnerable devices and implement proactive controls until they can be replaced or patched.
Vulnerability · 2 sources · score 73
High-Risk Buffer Overflow Vulnerability in libheif Disclosed
A heap-based buffer overflow vulnerability, CVE-2026-120208, has been identified in libheif versions 1.18.0 to 1.23.3. This flaw allows attackers to exploit unequal bit depths in chroma components of HEIF files, potentially leading to code execution in image-processing pipelines. Systems that process untrusted HEIF files, such as public upload services and media platforms, are particularly at risk. The vulnerability was published on October 31, 2026, with a CVSS score of 7.7, indicating high severity. Current exploitation status is unknown, and no proof-of-concept code has been reported. Users are advised to upgrade to the patched version and restrict untrusted HEIF file processing until then.
Vulnerability · 2 sources · score 63 · CVE-2026-120208
Breaches
Binance Hit by $6.3 Billion Cyberattack Linked to North Korea
On October 29, 2026, Binance suffered a significant cyberattack resulting in the theft of approximately $6.3 billion in various cryptocurrencies, including $296 million in XRP. The FBI attributed the attack to North Korea's TraderTraitor unit, marking it as potentially the largest financial theft in history. The breach involved unauthorized withdrawals from Binance-controlled wallets across multiple blockchains, with the first theft occurring on the XRP Ledger. Binance has since resumed withdrawals for several cryptocurrencies and reported that it covered 95% of the stolen assets using company funds. The exchange is working with law enforcement to recover the remaining stolen tokens and has frozen some affected assets. Analysts noted that the attack bore similarities to previous North Korean cyber operations. The incident has raised concerns about the security of cryptocurrency exchanges and the ongoing threat of state-sponsored cybercrime.
Breach · 2 sources · score 78
Binance Security Incident Estimated at $6.3 Billion with $3 Billion Frozen
Binance has reported a significant security incident with an estimated impact of $6.3 billion, of which $3 billion in assets have been frozen. The breach is believed to have originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. Binance has stated that it will cover losses through its Secure Asset Fund for Users (SAFU) and company funds. The exchange is collaborating with law enforcement and blockchain intelligence firms to trace and recover the stolen assets. While deposits have resumed, withdrawals remain paused as Binance revamps its withdrawal service. The incident marks the largest publicly reported crypto theft, surpassing previous breaches. A detailed root-cause analysis is expected to follow.
Breach · 3 sources · score 64
Flock Cameras Exposed to Hacking and Privacy Risks
Recent investigations reveal significant vulnerabilities in Flock camera systems, with hackers demonstrating the ease of accessing live and archived footage. A hacking group, stegan0gram, successfully reverse-engineered a Flock camera, exposing unencrypted data and an encryption key that could unlock sensitive information about over 50,000 vehicles. This incident highlights the broader risks associated with automatic license plate readers (ALPRs), which are marketed as benign but collect extensive data beyond just license plates. Cybersecurity expert Noah Williams warns that police departments using these systems effectively rent access to data they do not control, raising privacy concerns. Flock cameras have faced public backlash, with protests and calls for their removal in various communities. The vulnerabilities found could lead to unauthorized surveillance and misuse of personal data.
Other Threats · 2 sources · score 58
Fake PS5 Repositories Distributing Password-Stealing Malware
Recent reports indicate that fake repositories named AnyPS5 and KytyPS5 on GitHub are spreading password-stealing malware. These malicious repositories are designed to deceive users into downloading harmful software that compromises their credentials. The malware targets users looking for PlayStation 5-related tools and applications. Security experts have warned that this could lead to significant data breaches if users fall victim to these scams. The exact number of affected users is currently unknown, but the potential impact is substantial given the popularity of the PS5. Users are advised to avoid these repositories and ensure their systems are secure. Ongoing monitoring of GitHub for similar threats is recommended.
Breach · 4 sources · score 54
Threat actors and malware
Mercenary Spyware Targets German MPs and Officials' iPhones
German lawmakers and government officials have been warned of a potential spyware attack targeting their iPhones. Digital Minister Karsten Wildberger confirmed that Apple issued threat notifications starting on October 29, 2026, indicating that certain devices may have been compromised by mercenary spyware. The Federal Office for Information Security (BSI) quickly informed those affected, advising them to assume their devices could be compromised. The exact nature of the attack and the identity of the perpetrators remain unclear, although the BSI noted that such spyware could access messages, calls, contacts, and even activate the microphone and camera. The situation is still developing, with no confirmation of successful breaches reported yet.
Malware · 4 sources · score 56 · Mercenary, Mercenary Spyware
New on leak sites
15 victims listed on ransomware leak sites by 7 groups in the 24 hours before this issue. The most active:
Also moving
- CVEs: CVE-2026-109618, CVE-2026-109619, CVE-2026-112816, CVE-2026-46300, CVE-2026-100202
- Malware: Mercenary, TraderTraitor, Mercenary Spyware
- Campaigns: Operation Sindoor, Community Rewards Campaign, Operation Battery, Operation Grim Beeper, Patchmageddon
- APT groups: APT38, Jade Sleet, Lazarus Group
- Vulnerabilities: Checkm8, Container Escape Via Unvalidated Sandbox File Paths, EchoLeak, Fragnesia, Linux Kernel Missing Initialization Of A Variable
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.