The Hack Sheet #006

Saturday, October 31, 2026 · 8 stories

  1. Crypto Binance's $6.3B hack had more breach points than one laptop; withdrawals aimed to restart Sunday

    Co-CEO Richard Teng says investigators found entry points beyond the compromised DevOps laptop. The attacker used an EIP-7702 delegation to take over the "Binance 14" hot wallet, draining about $2.5B in minutes, and hit wallets on roughly nine chains through the signing layer. Binance says it will cover all losses and hopes to reopen withdrawals Sunday. Reports tie it to Lazarus/TraderTraitor, with about $2.4-2.8B frozen. Technical breakdown: fireblocks.com.

    source: coindesk.com

  2. Security Chainalysis discloses a breach by attackers using "offensive agentic techniques"

    An outside actor using AI-agent techniques got into internal tools this month, exposing customer names, emails, user IDs and role labels. Chainalysis says no investigation data, credentials or session tokens were accessed, and the incident is unrelated to Binance. More: thehackernews.com.

    source: bleepingcomputer.com

  3. IT Max-severity GitLab flaw now exploited; CISA also adds two Ivanti Connect Secure bugs to KEV

    CVE-2026-97229 (CVSS 10) is an integer overflow in GitLab's CI/CD regex compiler that allows code execution via a crafted pipeline config. Fixed in GitLab CE/EE 19.4.2, 19.3.5 and 19.2.8; the federal deadline is Sun Nov 1. On Oct 30 CISA also added exploited Ivanti Connect Secure CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable identifiers) per cisa.gov.

    source: bleepingcomputer.com

  4. Security China-nexus campaign roots Palo Alto firewalls by chaining PHP2Shell with a Linux kernel bug

    An AI-assisted campaign chained PHP2Shell (CVE-2026-109618/109619) with the Fragnesia privilege escalation (CVE-2026-46300) to get root on 25 PAN-OS firewalls and management servers in the US, Japan, Taiwan and South Korea, including US-government-linked systems, then stole Active Directory credentials. Palo Alto says patch and restrict management access to trusted IPs. The CISA kernel deadline is today, Oct 31.

    source: cybersecuritydive.com

  5. IT CISA KEV week in review: 8 exploited flaws and three deadlines this weekend

    This week's additions cover PHP, Adobe Commerce, Google Brotli, the Linux kernel, VMware ESX, GitLab and Cisco ASA/FTD. The kernel fix is due Oct 31; GitLab and Cisco ASA/FTD (CVE-2026-76418) are due Nov 1. Brotli ships inside Node.js and PHP builds, so it needs an inventory sweep, not just a package update.

    source: datawater.com

  6. IT Drupal Commerce Core access bypass exploited in the wild

    CVE-2026-118539 is a missing-authorization flaw that lets unauthenticated attackers abuse the Commerce module, with possible financial losses. Upgrade to 3.3.13 or 8.x-2.41 and audit recent orders.

    source: bleepingcomputer.com

  7. Security Askul confirms its ransomware attack leaked customer and supplier data

    Names, phone numbers and emails of some customers and suppliers were leaked. RansomHouse claims 1.1 TB. The Oct 19 attack halted the Japanese retailer's orders and shipments.

    source: asahi.com

  8. Gaming Street Fighter V pulled offline over the PHP flaw; Dark Souls II/III servers down; Steam client bugs disclosed

    Capcom pulled SFV from sale and disabled online play during emergency maintenance tied to the PHP flaw. FromSoftware took DS2/DS3 servers offline over a "server issue" with no stated PHP link (invenglobal.com). Atredis Partners disclosed six Steam client bugs, including zero-click RCE between devices signed into the same account; Valve was notified and the published issues are fixed or past the disclosure window (gamespark.jp).

    source: gamingnews.info

// tool_of_the_day

osquery · Apache-2.0 OR GPL-2.0 license

osquery lets you query your laptops and servers with SQL, asking things like which processes are listening on the network, what browser extensions are installed, or which startup items changed, across Windows, macOS and Linux. It's for IT and security teams who want visibility into their endpoints, the exact kind of machine (a dev's laptop) that kicked off the Binance breach.

← back to the front page