Starting around 4:20 PM ET on Oct 29, hot wallets were drained across 11 chains after a DevOps engineer's laptop was compromised. Elliptic counts $6.43B stolen and $2.84B frozen, mostly USDT/USDC. Elliptic and Chainalysis (chainalysis.com) link it to DPRK's TraderTraitor via on-chain ties to the Bitget theft. Binance paused deposits and withdrawals and says its SAFU fund covers all losses.
A Binance hot wallet signed an EIP-7702 authorization that let attacker-deployed contract code run as the wallet, which then emptied it. The lesson for wallet operators after Pectra: a single signed authorization can hand over full control.
Palo Alto confirmed active exploitation of CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, unauthenticated RCE in PHP) against exposed PAN-OS management interfaces. Patches are out for all affected PAN-OS branches as of Oct 30. Patch PHP and PAN-OS, and keep management interfaces off the internet. CISA guidance: cisa.gov.
CVE-2026-46300 is a Dirty Frag-class Linux kernel privilege escalation with a public PoC. Attackers chain it with PHP2Shell to plant webshells as root; Dream Security counts 25 rooted servers in the US, Japan, Taiwan and South Korea, including US government-affiliated hosts. The federal patch deadline is Oct 31.
CVE-2026-97229 allows unauthenticated code execution on GitLab via a crafted regex in CI/CD config, so patched instances still need forensic triage. CVE-2026-76418 lets a remote attacker crash Cisco ASA/FTD. Both are being exploited now.
On Oct 28 the attacker wrote their own Merkle root through an arbitrary trusted call, helped by an EIP-1153 transient-storage check that never reset, then withdrew against forged proofs. A copycat drained the Optimism, Base, Blast and Mantle deployments the next day. Per the post-mortem, Ethereum was still unpatched.
Mostly names and flight details, with no sign of financial data. Korean Air and JAL disclosed earlier, so the supply-chain fallout is growing. Expect travel-themed phishing.
Repos posing as AnyPS5 and Kyttyps5 deliver a multi-stage loader with sandbox evasion, Defender exclusions, an infostealer and self-wipe. Download only from official owners; if you ran one, disconnect, scan, and change passwords from another device. Related: Arc System Works disclosed a TeamArc newsletter breach (eventhubs.com) after Capcom's 11.7M-account CAPCOM ID incident.
Falco · Apache-2.0 license
Falco is a CNCF runtime security tool that watches Linux kernel events and alerts on suspicious behavior, like a web server spawning a shell, unexpected privilege escalation, or writes to sensitive paths. It's for sysadmins and cloud/Kubernetes teams who want early warning of exactly the webshell-as-root chains in today's PHP2Shell and Fragnesia stories.