European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed: Cyberattacks
Binance has replaced 90% of the $6.3 billion stolen on October 29, 2026, in what’s believed to be crypto’s largest hack, ahead of the $1.5 billion Bybit theft in 2025. Using more than $6.34 billion in company funds, it has fully covered bitcoin, Ethereum, and Tether holdings. The last 10%, in less-liquid tokens, will take longer to buy.
The FBI has blamed North Korea, naming the state-backed group it tracks as TraderTraitor, part of the Lazarus Group. It says the hackers are converting the stolen assets into Ethereum ahead of further laundering. Binance has frozen about $3 billion of those assets with law enforcement and industry partners.
Binance’s early investigation pointed to a compromised engineer’s laptop, though it has since found “additional points of breach.” Co-CEO Richard Teng says more than one attacker took part, using a “self-destruct mechanism” to cover the intrusion. Withdrawals began resuming on several networks on November 1.
Source: BBC News
Binance has replaced 90% of the $6.3 billion stolen on October 29, 2026, in what’s believed to be crypto’s largest hack, ahead of the $1.5 billion Bybit theft in 2025. Using more than $6.34 billion in company funds, it has fully covered bitcoin, Ethereum, and Tether holdings. The last 10%, in less-liquid tokens, will take longer to buy.
The FBI has blamed North Korea, naming the state-backed group it tracks as TraderTraitor, part of the Lazarus Group. It says the hackers are converting the stolen assets into Ethereum ahead of further laundering. Binance has frozen about $3 billion of those assets with law enforcement and industry partners.
Binance’s early investigation pointed to a compromised engineer’s laptop, though it has since found “additional points of breach.” Co-CEO Richard Teng says more than one attacker took part, using a “self-destruct mechanism” to cover the intrusion. Withdrawals began resuming on several networks on November 1.
Source: BBC News
Attackers started targeting a no-login remote code execution flaw in WordPress’s core updater nine minutes after Wordfence deployed a firewall rule for it on October 28, 2026, the day WordPress 7.1.4 shipped the fix. By October 30, Wordfence was blocking more than 60,000 attempts in any 24 hours. It has reported no confirmed compromises.
The flaw, CVE-2026-119977 (CVSS 8.1, High), affects versions 4.7 through 7.1.3. Predictable temporary folder names let an attacker reach a staged installer during a full core update. The window usually lasts seconds, and wp-content/upgrade/ must be reachable from the web.
Admins should update to 7.1.4, or their branch’s patched release back to 4.7.39, and confirm it installed rather than trust automatic updates; 4.6 and earlier get no fix. Paid Wordfence customers have the rule, but free users wait until November 27. Meanwhile, block web access to wp-content/upgrade/; plugin firewalls only catch this when set to load before WordPress.
Source: Cybersecurity News
Attackers started targeting a no-login remote code execution flaw in WordPress’s core updater nine minutes after Wordfence deployed a firewall rule for it on October 28, 2026, the day WordPress 7.1.4 shipped the fix. By October 30, Wordfence was blocking more than 60,000 attempts in any 24 hours. It has reported no confirmed compromises.
The flaw, CVE-2026-119977 (CVSS 8.1, High), affects versions 4.7 through 7.1.3. Predictable temporary folder names let an attacker reach a staged installer during a full core update. The window usually lasts seconds, and wp-content/upgrade/ must be reachable from the web.
Admins should update to 7.1.4, or their branch’s patched release back to 4.7.39, and confirm it installed rather than trust automatic updates; 4.6 and earlier get no fix. Paid Wordfence customers have the rule, but free users wait until November 27. Meanwhile, block web access to wp-content/upgrade/; plugin firewalls only catch this when set to load before WordPress.
Source: Cybersecurity News
A hacktivist group calling itself the Department of Peace has leaked records on more than 41,000 DHS employees and contractors, including ICE and CBP personnel and federal cybersecurity staff. Transparency collective DDoSecrets published the database, dubbed Icepick, on October 28, 2026, alongside a searchable version. It holds names, roles, and work contact details, but no home addresses, DDoSecrets says.
The group says it took the data from an Okta single sign-on service DHS uses, but Okta says it has no evidence its systems were compromised. The hacktivists framed the leak as payback for DHS Secretary Markwayne Mullin’s July 17 pledge to step up immigration enforcement.
Icepick also lists more than 55,000 internal access groups, some referencing surveillance platform PenLink and AI tools such as ChatGPT and Gemini. DHS says it is aware of a potential breach and working to address it.
Source: CNET
A hacktivist group calling itself the Department of Peace has leaked records on more than 41,000 DHS employees and contractors, including ICE and CBP personnel and federal cybersecurity staff. Transparency collective DDoSecrets published the database, dubbed Icepick, on October 28, 2026, alongside a searchable version. It holds names, roles, and work contact details, but no home addresses, DDoSecrets says.
The group says it took the data from an Okta single sign-on service DHS uses, but Okta says it has no evidence its systems were compromised. The hacktivists framed the leak as payback for DHS Secretary Markwayne Mullin’s July 17 pledge to step up immigration enforcement.
Icepick also lists more than 55,000 internal access groups, some referencing surveillance platform PenLink and AI tools such as ChatGPT and Gemini. DHS says it is aware of a potential breach and working to address it.
Source: CNET
Polymarket’s international platform halted trading on October 29, 2026, after a supply chain attack drained user funds. The company hasn’t disclosed losses, but the wallet believed to belong to the attacker held about $2.65 million, according to Arkham data. Researchers trace the malicious JavaScript to DebugBear, a UK firm that monitors website performance, through its real user monitoring script.
The code targeted logged-in users, selling positions or transferring tokens directly to an attacker-controlled wallet. DebugBear confirmed it was dealing with a security incident and told customers to remove its script. Polymarket, which hasn’t named the vendor, referred the breach to law enforcement and pledged to make every affected trader whole. Trading restarted roughly an hour later.
Polymarket’s US exchange appears to have been untouched. This is the company’s second third-party breach in months — a similar attack in June 2026 cost traders a reported $3 million.
Source: SecurityWeek
Polymarket’s international platform halted trading on October 29, 2026, after a supply chain attack drained user funds. The company hasn’t disclosed losses, but the wallet believed to belong to the attacker held about $2.65 million, according to Arkham data. Researchers trace the malicious JavaScript to DebugBear, a UK firm that monitors website performance, through its real user monitoring script.
The code targeted logged-in users, selling positions or transferring tokens directly to an attacker-controlled wallet. DebugBear confirmed it was dealing with a security incident and told customers to remove its script. Polymarket, which hasn’t named the vendor, referred the breach to law enforcement and pledged to make every affected trader whole. Trading restarted roughly an hour later.
Polymarket’s US exchange appears to have been untouched. This is the company’s second third-party breach in months — a similar attack in June 2026 cost traders a reported $3 million.
Source: SecurityWeek
A surprisingly clumsy phishing campaign impersonating Anthropic has been bypassing Proofpoint’s Secure Email Gateway and Microsoft Defender for Office 365 since September 2026, Cofense researchers found. Attackers send fake “private preview” invites to an Anthropic AI tool from a legitimate GoTo Webinar address, then route victims through a fake Zoom page to steal Google or Microsoft logins.
The emails carry a misspelled sender name (“Austin from nthropic”), a grammatical error in the subject line, and zero Anthropic branding. The theft flow is half-broken, too: the Google path never asks for a password. Since October 28, the attackers have swapped the Zoom page for a fake Anthropic one.
Yet Cofense points to three simple tricks that may explain the bypass: a sender address open to every GoTo Webinar account holder, Zapier-shortened links, and two CAPTCHAs that keep scanners and VPNs from following the chain. Keeper Security chief information security officer Shane Barney argues email gateways will always have blind spots, so defenses should focus on identity, including phishing-resistant multifactor authentication.
Source: Dark Reading
A surprisingly clumsy phishing campaign impersonating Anthropic has been bypassing Proofpoint’s Secure Email Gateway and Microsoft Defender for Office 365 since September 2026, Cofense researchers found. Attackers send fake “private preview” invites to an Anthropic AI tool from a legitimate GoTo Webinar address, then route victims through a fake Zoom page to steal Google or Microsoft logins.
The emails carry a misspelled sender name (“Austin from nthropic”), a grammatical error in the subject line, and zero Anthropic branding. The theft flow is half-broken, too: the Google path never asks for a password. Since October 28, the attackers have swapped the Zoom page for a fake Anthropic one.
Yet Cofense points to three simple tricks that may explain the bypass: a sender address open to every GoTo Webinar account holder, Zapier-shortened links, and two CAPTCHAs that keep scanners and VPNs from following the chain. Keeper Security chief information security officer Shane Barney argues email gateways will always have blind spots, so defenses should focus on identity, including phishing-resistant multifactor authentication.
Source: Dark Reading
Hackers broke into Florida’s student financial aid website, compromising personal information including Social Security numbers, the Florida Department of Education (FLDOE) confirmed. The department says the breach may have affected about 4.9 million people and appears limited to FloridaStudentFinancialAidSG.org.
The FLDOE discovered the breach on October 19 and immediately moved to stop the unauthorized access, but hasn’t said how long the attackers were inside. It has notified Florida’s Attorney General, as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement, which has opened a criminal investigation.
One bit of relief: officials say financial aid is safe — disbursements, tuition payments, scholarships, grants, and student loan eligibility won’t be affected. The FLDOE is urging anyone affected to monitor their financial accounts and credit reports, and warns the aid website may see temporary disruptions during the response.
Source: CBS News Miami
Hackers broke into Florida’s student financial aid website, compromising personal information including Social Security numbers, the Florida Department of Education (FLDOE) confirmed. The department says the breach may have affected about 4.9 million people and appears limited to FloridaStudentFinancialAidSG.org.
The FLDOE discovered the breach on October 19 and immediately moved to stop the unauthorized access, but hasn’t said how long the attackers were inside. It has notified Florida’s Attorney General, as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement, which has opened a criminal investigation.
One bit of relief: officials say financial aid is safe — disbursements, tuition payments, scholarships, grants, and student loan eligibility won’t be affected. The FLDOE is urging anyone affected to monitor their financial accounts and credit reports, and warns the aid website may see temporary disruptions during the response.
Source: CBS News Miami
Sony Network Communications confirmed that hackers breached So-net, its Japanese internet service provider, stealing personal data from roughly 2.6 million current and former subscribers. The attackers accessed the member database on October 19, with the company detecting the intrusion four days later. How they got in hasn’t been disclosed.
Stolen data includes names, birthdates, gender, phone numbers, email addresses, user IDs, and internet connection IDs: 2.14 million records from So-net subscribers and 443,000 from Plala (S Course), a plan sold with NTT Docomo’s fiber service and run by So-net. About 293,000 belong to people who left in March 2026 or later.
Around 54,000 passwords for four add-on email services were also taken, which So-net says put attackers in a position to read and send mail. Sixteen bank account records were exposed, though no credit card or PIN data was stored. NURO and other services weren’t affected.
So-net has reset the affected email passwords and notified Japan’s Personal Information Protection Commission.
Source: SecurityWeek
Sony Network Communications confirmed that hackers breached So-net, its Japanese internet service provider, stealing personal data from roughly 2.6 million current and former subscribers. The attackers accessed the member database on October 19, with the company detecting the intrusion four days later. How they got in hasn’t been disclosed.
Stolen data includes names, birthdates, gender, phone numbers, email addresses, user IDs, and internet connection IDs: 2.14 million records from So-net subscribers and 443,000 from Plala (S Course), a plan sold with NTT Docomo’s fiber service and run by So-net. About 293,000 belong to people who left in March 2026 or later.
Around 54,000 passwords for four add-on email services were also taken, which So-net says put attackers in a position to read and send mail. Sixteen bank account records were exposed, though no credit card or PIN data was stored. NURO and other services weren’t affected.
So-net has reset the affected email passwords and notified Japan’s Personal Information Protection Commission.
Source: SecurityWeek
CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Both flaws score 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution. The listing followed successful code execution against honeypots on October 24, reported by Perplexity detection and response lead Adel Karimi.
Karimi noted the chain ran on a deliberately favorable single-worker Apache mod_php setup, so it doesn’t show how reliably the exploit works elsewhere. Censys estimates more than 32.5 million PHP services still run an affected version.
Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, and US federal agencies must apply them by October 29. PHP 8.1 and earlier no longer receive official fixes.
Source: The Hacker News
CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Both flaws score 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution. The listing followed successful code execution against honeypots on October 24, reported by Perplexity detection and response lead Adel Karimi.
Karimi noted the chain ran on a deliberately favorable single-worker Apache mod_php setup, so it doesn’t show how reliably the exploit works elsewhere. Censys estimates more than 32.5 million PHP services still run an affected version.
Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, and US federal agencies must apply them by October 29. PHP 8.1 and earlier no longer receive official fixes.
Source: The Hacker News
Dutch police arrested two men on October 6 over a bank helpdesk fraud scheme that stole more than €380,000 (~$425,600) from 170 victims in about three weeks. Victims received calls with AI-generated audio impersonating their bank, then a fake bank employee told them to download an app and scan their debit card against their phone.
That app extracted the card’s NFC chip data and relayed it to an accomplice waiting at an ATM, who then withdrew cash in real time. A 23-year-old from Vaassen allegedly built the infrastructure and directed the attacks, while a 25-year-old from Ede coordinated operations. Both remain in custody, and authorities seized their servers, phones, and laptops.
Source: SecurityWeek
Dutch police arrested two men on October 6 over a bank helpdesk fraud scheme that stole more than €380,000 (~$425,600) from 170 victims in about three weeks. Victims received calls with AI-generated audio impersonating their bank, then a fake bank employee told them to download an app and scan their debit card against their phone.
That app extracted the card’s NFC chip data and relayed it to an accomplice waiting at an ATM, who then withdrew cash in real time. A 23-year-old from Vaassen allegedly built the infrastructure and directed the attacks, while a 25-year-old from Ede coordinated operations. Both remain in custody, and authorities seized their servers, phones, and laptops.
Source: SecurityWeek
LiteLLM, a popular open source proxy for AI model routing, was compromised on October 21 when attackers hijacked its release pipeline and published a poisoned version 1.107.0. The packages were live for about three hours across PyPI and Docker Hub, long enough for an estimated 49 000 downloads. The GitHub source tag was clean — the artifacts came from a lookalike repository.
Attackers held GitHub CLI OAuth tokens for three developer accounts. LiteLLM says one set likely leaked through Claude Code, which in specific circumstances embeds tokens into a response body that may be logged — and the internal deployment holding those logs was exposed to the public internet. How the attackers reached that deployment, or moved laterally once inside, remains unclear. They used the tokens to disable branch protections, redirect the release pipeline, and publish signed packages.
The payload drops three files into the site-packages root and runs whenever a Python interpreter starts, with no import of litellm needed. It harvests browser credentials, AWS, GCP, and Azure secrets, SSH keys, and AI API keys from Anthropic, OpenAI, and GitHub Copilot, encrypting them to litellm[.]dev — a lookalike domain registered eight days earlier. A second component fetches fresh code hourly.
Wiz saw attackers querying Amazon Bedrock with stolen AWS credentials about 4.5 hours after exfiltration, which it reads as LLMjacking. Enterprise customers on LiteLLM’s private repository were unaffected. Anyone who installed 1.107.0, including through the Docker latest, main-latest, or main-stable tags, should remove it, rotate every credential on the machine, and scan for malware. The latest clean version is 1.106.2.
Source: SecurityWeek
LiteLLM, a popular open source proxy for AI model routing, was compromised on October 21 when attackers hijacked its release pipeline and published a poisoned version 1.107.0. The packages were live for about three hours across PyPI and Docker Hub, long enough for an estimated 49 000 downloads. The GitHub source tag was clean — the artifacts came from a lookalike repository.
Attackers held GitHub CLI OAuth tokens for three developer accounts. LiteLLM says one set likely leaked through Claude Code, which in specific circumstances embeds tokens into a response body that may be logged — and the internal deployment holding those logs was exposed to the public internet. How the attackers reached that deployment, or moved laterally once inside, remains unclear. They used the tokens to disable branch protections, redirect the release pipeline, and publish signed packages.
The payload drops three files into the site-packages root and runs whenever a Python interpreter starts, with no import of litellm needed. It harvests browser credentials, AWS, GCP, and Azure secrets, SSH keys, and AI API keys from Anthropic, OpenAI, and GitHub Copilot, encrypting them to litellm[.]dev — a lookalike domain registered eight days earlier. A second component fetches fresh code hourly.
Wiz saw attackers querying Amazon Bedrock with stolen AWS credentials about 4.5 hours after exfiltration, which it reads as LLMjacking. Enterprise customers on LiteLLM’s private repository were unaffected. Anyone who installed 1.107.0, including through the Docker latest, main-latest, or main-stable tags, should remove it, rotate every credential on the machine, and scan for malware. The latest clean version is 1.106.2.
Source: SecurityWeek
