Weekly digest,
This week: Binance Suffers $6.3 Billion Cyberattack Linked to North… (+8 more)
Vulnerabilities
PHP2Shell Vulnerability Exposes 96% of Internal PHP Devices
Genians reported that 96% of devices running PHP on corporate internal networks are vulnerable to the PHP2Shell remote code execution flaw. This vulnerability affects devices such as NAS, routers, and CCTV systems, with 78% of vulnerable devices running unsupported PHP versions. The analysis revealed that 89% of these devices are located on private IP ranges, making them invisible to external scanners. Genians emphasized the need for organizations to inspect internal networks thoroughly, as traditional scanning methods focus mainly on external web servers. The PHP2Shell vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on October 26, indicating. Organizations are urged to isolate vulnerable devices and implement proactive controls until they can be replaced or patched.
Vulnerability · 2 sources · score 73
Critical CVE-2026-112816 Flaw in Canonical's LXD and MicroCloud Allows Client Impersonation
A critical vulnerability in Canonical's LXD and MicroCloud, tracked as CVE-2026-112816 with a CVSS score of 10.0, allows attackers to impersonate trusted clients without needing their private keys. The flaw arises from improper certificate validation during mutual TLS authentication, where the server incorrectly checks all certificates in a chain instead of just the leaf certificate. An attacker with network access to the HTTPS API and a trusted client's public certificate can exploit this vulnerability to gain access to clusters and potentially root access on the host machine. Canonical has released patches for affected versions, urging users to update immediately. The vulnerability was reported by the Incus project and has existed since the initial release of the code. No evidence suggests that the flaw has been as of now.
Vulnerability · 7 sources · score 72 · CVE-2026-112816
High-Risk Buffer Overflow Vulnerability in libheif Disclosed
A heap-based buffer overflow vulnerability, CVE-2026-120208, has been identified in libheif versions 1.18.0 to 1.23.3. This flaw allows attackers to exploit unequal bit depths in chroma components of HEIF files, potentially leading to code execution in image-processing pipelines. Systems that process untrusted HEIF files, such as public upload services and media platforms, are particularly at risk. The vulnerability was published on October 31, 2026, with a CVSS score of 7.7, indicating high severity. Current exploitation status is unknown, and no proof-of-concept code has been reported. Users are advised to upgrade to the patched version and restrict untrusted HEIF file processing until then.
Vulnerability · 2 sources · score 63 · CVE-2026-120208
Breaches
Binance Suffers $6.3 Billion Cyberattack Linked to North Korean Hackers
Binance, the largest cryptocurrency exchange, experienced a cyberattack resulting in the theft of approximately $6.3 billion in digital assets, marking it as the largest crypto theft on record. The attack, attributed to the North Korean hacking group TraderTraitor, exploited vulnerabilities in Binance's hot wallet signing system, allowing hackers to siphon funds across multiple blockchains. Following the breach, Binance reported that it has replenished 95% of the stolen funds and resumed withdrawals, although some assets remain unavailable. The FBI has advised crypto firms to block transactions with wallets associated with the North Korean group. The exact methods of the attack and the full scope of the stolen assets are still under investigation, with blockchain analysis indicating that funds were quickly moved out of Binance's wallets. The remaining 5% of stolen tokens are described as less liquid, complicating their recovery. Binance has not provided detailed information on the breach's timing or specific vulnerabilities exploited.
Malware · 2 sources · score 78 · TraderTraitor
Binance Hit by $6.3 Billion Cyberattack Linked to North Korea
On October 29, 2026, Binance suffered a significant cyberattack resulting in the theft of approximately $6.3 billion in various cryptocurrencies, including $296 million in XRP. The FBI attributed the attack to North Korea's TraderTraitor unit, marking it as potentially the largest financial theft in history. The breach involved unauthorized withdrawals from Binance-controlled wallets across multiple blockchains, with the first theft occurring on the XRP Ledger. Binance has since resumed withdrawals for several cryptocurrencies and reported that it covered 95% of the stolen assets using company funds. The exchange is working with law enforcement to recover the remaining stolen tokens and has frozen some affected assets. Analysts noted that the attack bore similarities to previous North Korean cyber operations. The incident has raised concerns about the security of cryptocurrency exchanges and the ongoing threat of state-sponsored cybercrime.
Breach · 2 sources · score 78
Binance Security Incident Estimated at $6.3 Billion with $3 Billion Frozen
Binance has reported a significant security incident with an estimated impact of $6.3 billion, of which $3 billion in assets have been frozen. The breach is believed to have originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. Binance has stated that it will cover losses through its Secure Asset Fund for Users (SAFU) and company funds. The exchange is collaborating with law enforcement and blockchain intelligence firms to trace and recover the stolen assets. While deposits have resumed, withdrawals remain paused as Binance revamps its withdrawal service. The incident marks the largest publicly reported crypto theft, surpassing previous breaches. A detailed root-cause analysis is expected to follow.
Breach · 3 sources · score 64
Flock Cameras Exposed to Hacking and Privacy Risks
Recent investigations reveal significant vulnerabilities in Flock camera systems, with hackers demonstrating the ease of accessing live and archived footage. A hacking group, stegan0gram, successfully reverse-engineered a Flock camera, exposing unencrypted data and an encryption key that could unlock sensitive information about over 50,000 vehicles. This incident highlights the broader risks associated with automatic license plate readers (ALPRs), which are marketed as benign but collect extensive data beyond just license plates. Cybersecurity expert Noah Williams warns that police departments using these systems effectively rent access to data they do not control, raising privacy concerns. Flock cameras have faced public backlash, with protests and calls for their removal in various communities. The vulnerabilities found could lead to unauthorized surveillance and misuse of personal data.
Other Threats · 2 sources · score 58
Fake PS5 Repositories Distributing Password-Stealing Malware
Recent reports indicate that fake repositories named AnyPS5 and KytyPS5 on GitHub are spreading password-stealing malware. These malicious repositories are designed to deceive users into downloading harmful software that compromises their credentials. The malware targets users looking for PlayStation 5-related tools and applications. Security experts have warned that this could lead to significant data breaches if users fall victim to these scams. The exact number of affected users is currently unknown, but the potential impact is substantial given the popularity of the PS5. Users are advised to avoid these repositories and ensure their systems are secure. Ongoing monitoring of GitHub for similar threats is recommended.
Breach · 4 sources · score 54
Threat actors and malware
Mercenary Spyware Targets German MPs and Officials' iPhones
German lawmakers and government officials have been warned of a potential spyware attack targeting their iPhones. Digital Minister Karsten Wildberger confirmed that Apple issued threat notifications starting on October 29, 2026, indicating that certain devices may have been compromised by mercenary spyware. The Federal Office for Information Security (BSI) quickly informed those affected, advising them to assume their devices could be compromised. The exact nature of the attack and the identity of the perpetrators remain unclear, although the BSI noted that such spyware could access messages, calls, contacts, and even activate the microphone and camera. The situation is still developing, with no confirmation of successful breaches reported yet.
Malware · 4 sources · score 56 · Mercenary, Mercenary Spyware
New on leak sites
295 victims listed on ransomware leak sites by 42 groups in the 7 days before this issue. The most active:
Get the next one by email
The digest is free and arrives once a week. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.