← All threat briefs

Daily Cybersecurity Brief — 2026-10-30

SECURITY // 2026-10-30

Daily Cybersecurity Brief — 2026-10-30

High-Signal Security Journalism

  • Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record — About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. (Source: Help Net Security)
  • What exactly is ISOC? And what does it mean for you? — Gartner recently released a new category of assessing security tools: the Integrated Security Operations Center (ISOC). Even though SIEM isn’t going anywhere, a rapidly evolving threat landscape is forcing a shift in industry logic that is reflected in the emergence of this new category. (Source: Help Net Security)
  • Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature — Interpol's annual Operation Serengeti, now in its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds. (Source: Dark Reading)

Threat Intelligence & Malware Analysis

  • As Russia's Cyberwar Evolves, Belarus Steps Forward — The "FrostyNeighbor" advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives. (Source: Dark Reading)
  • Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw — Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. (Source: The Hacker News)
  • Fake IT help desk callers got by on little more than names and email addresses — Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware. (Source: Help Net Security)
  • Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. (Source: The Hacker News)
  • Anthropic-Themed Phishing Emails Bypass Top Security Tools — Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products. (Source: Dark Reading)
  • ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories — Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. (Source: The Hacker News)
  • Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls — China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. (Source: Help Net Security)
  • Threat Modeling With 4 Simple Questions on a White Board — A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend. (Source: Dark Reading)
  • Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners — Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. (Source: The Hacker News)
  • Yoba malware hides in fake desktop versions of ChatGPT and Claude — Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months. (Source: Help Net Security)
  • Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network — Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. (Source: Help Net Security)
  • Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants — Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet takedowns. (Source: Cloudflare Blog (security))
  • Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls — Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. (Source: The Hacker News)
  • Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys — Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. (Source: The Hacker News)
  • China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility — The U.S. (Source: The Hacker News)
  • Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces — Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. (Source: The Hacker News)
  • GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub — The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit. (Source: Dark Reading)
  • Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns — The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. (Source: The Hacker News)
  • Unwrapping Retail Peak Season Cyber Threats — Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42. (Source: Unit 42)
  • Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. — Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. (Source: The Hacker News)
  • PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network — Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. (Source: The Hacker News)
  • Attacker Relentlessly Scans for Credentials by Impersonating AI Bots — The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data. (Source: Dark Reading)
  • Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch — Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. (Source: The Hacker News)
  • Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass — Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. (Source: The Hacker News)
  • American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed — Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind. (Source: The Hacker News)
  • External Teams Chats Anchor 15-Minute Malware Delivery — Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang. (Source: Dark Reading)
  • CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets — Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. (Source: The Hacker News)
  • 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants — The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint. (Source: Dark Reading)
  • Tricks from the Past deployed via signed ChatGPT and Claude binaries — Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. (Source: Check Point Research)
  • Introducing the Cloudflare PHP Capture the Flag challenge — We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. (Source: Cloudflare Blog (security))
  • AI-Generated Fake Login Pages Are Making Account Takeovers Easier — Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. (Source: The Hacker News)
  • Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption — The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. (Source: The Hacker News)

Vulnerabilities & Exploits

  • CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. (Source: The Hacker News)
  • Smart TVs can harbor unpatched security flaws and track what you watch — Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers between January and September. (Source: Help Net Security)
  • Rethinking Cybersecurity Awareness in the AI Era — This installment of the Reporters' Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for better training to educating next-generation workforces on modern risks and emerging threats. (Source: Dark Reading)
  • Claude Model Builds Exploits Across Major Browsers & OSes — An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says. (Source: Dark Reading)
  • Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) — CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42. (Source: Unit 42)
  • Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions — A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. (Source: The Hacker News)
  • Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities — Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. (Source: The Hacker News)
  • Webinar: How to Build AI Threat Readiness Into Your Security Operations — Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. (Source: The Hacker News)
  • Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open — An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. (Source: The Hacker News)
  • Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers — A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. (Source: The Hacker News)
  • Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits — An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. (Source: The Hacker News)
  • Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers — Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. (Source: The Hacker News)
  • ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws — The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. (Source: The Hacker News)
  • Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. (Source: The Hacker News)
  • Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads — Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. (Source: The Hacker News)
  • PHP2Shell: Exploitation Attempts and Remediation Trends — Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure. (Source: Wiz Blog)
  • Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens — Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. (Source: The Hacker News)

AI/ML Security

  • Open-weight AI model GLM-5.3 cheated its way to correct answers — Irregular evaluated Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench, the company’s framework for measuring an LLM’s ability to plan and execute multistage attacks under realistic constraints. (Source: Help Net Security)
  • The Rise of Agentic Attacks: What They Look Like, and Where They're Headed — AI agents are changing how attackers operate. Explore real-world cases of agentic attacks, learn how to identify their fingerprints, and discover what they mean for the future of cybersecurity. (Source: Wiz Blog)
  • Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop — Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. (Source: Help Net Security)
  • The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers — AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems can perform on their own. (Source: The Hacker News)
  • 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories — 26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. (Source: The Hacker News)
  • Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes — The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off. (Source: Dark Reading)
  • Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win — A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. (Source: The Hacker News)
  • AI Takes Root in Hospital Corridors, Raises Security Stakes — Artificial intelligence (AI) is everywhere in healthcare, from doctors’ intake forms to cancer screenings. But in some cases, life-and-death uses are outpacing cybersecurity. (Source: Dark Reading)
  • Wazuh and AI for Enhanced SOC Workflows — Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. (Source: The Hacker News)
  • 3 Frameworks to Protect CISOs & Orgs Against AI Liability — Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors. (Source: Dark Reading)
  • Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills — Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers. (Source: Dark Reading)

Supply Chain & Software Security

  • GitHub Launches npm Firewall to Block Malicious Packages Before Installation — GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. (Source: The Hacker News)
  • SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack — A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises. (Source: Dark Reading)

Cloud & Infrastructure Security

  • Cohere’s Qwen Story: Looks More Like Model Jaggedness — Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from Alibaba. The task was straightforward: write a detection rule for suspicious curl downloads followed by bash execution. (Source: Check Point Research)
  • Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach — Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. (Source: The Hacker News)
  • GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption — The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. (Source: The Hacker News)

Policy & Regulation

  • Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls — A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. (Source: The Hacker News)

Law Enforcement & Takedowns

  • Scammers rebuild fake shopping sites within hours of a takedown — One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026. (Source: Help Net Security)
  • FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering — The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. (Source: The Hacker News)

Reports & Analysis

  • Cyber Vulnerabilities Besiege Italy, Absent Clear Cause — Researchers can't quite explain why cyber threats look so different in Italy compared with everywhere else. (Source: Dark Reading)

IoT & OT Security

  • Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key — An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. (Source: The Hacker News)