Cyber Roundup: Week of October 26

Here are the main stories you missed last week.

1. Binance: Most of $6.3 billion left the exchange in about 20 minutes, and the investigation starts at a DevOps engineer’s laptop

The headline: On October 29, attackers moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, according to TRM Labs. Binance confirmed the incident in a security update published early on October 30. Its initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which gave the attacker access to a service container and let them submit unauthorized withdrawal transactions. Binance found no evidence of a wallet private key leak, and a later update said the investigation had uncovered additional breaches beyond the laptop. TRM puts the theft at roughly four times the Bybit heist of February 2025 and attributes it with high confidence to TraderTraitor, the North Korean group the FBI named in the Bybit case. Chainalysis’s CEO called it likely the work of the same group. Binance has not confirmed the attribution. TRM counts about $2.7 billion frozen by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum’s Security Council, and Binance says close to $3 billion is frozen. TRM reports the attackers still hold more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Binance says it will cover every loss from its SAFU fund and company funds, and that user funds are safe.

What we’re actually watching: The dollar figure is not the detail that matters. The signing is. TRM reports that Binance wallets on different chains, using different key types and different signing schemes, all produced valid signatures for the attackers within about half an hour. Separate keys do not fall together unless something above them fell first. TRM’s reading is a compromise of Binance’s hot wallet signing infrastructure. Nobody stole a key. The attacker used the machinery that holds the keys.

Binance co-CEO Richard Teng said the attacker did not simply use one engineer’s permissions and that this was not a single one-click action. That narrows the lesson from “a laptop was compromised” to “a laptop was the first domino.” A DevOps endpoint with a path to production containers is a privileged asset, and most organizations inventory it as a laptop. Binance has not published a root cause or said how the laptop was reached, and its technical post-mortem is still to come. Session tokens, API keys, and service-account access are what the Telegram channels we track trade in, and our analysis of the channels attackers use most shows how quickly that access moves. Nothing public ties the Binance breach to those channels.

The CISO question: For every engineer laptop with a path to production signing, withdrawal, or deployment systems, do you enforce device isolation and just-in-time access, and could your team tell within minutes that a service container is submitting transactions its owners did not authorize?

2. Node.js and Brotli: CVE-2026-111497 turns a decompression library into a shell, and Wiz finds vulnerable resources in 91% of cloud environments

The headline: سايزا added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, with a federal remediation deadline of November 10. The flaw (CVSS 9.2, or 8.1 in Microsoft’s advisory) is a memory-corruption bug in Google’s Brotli decoder. A remote unauthenticated attacker who supplies a crafted Brotli stream can corrupt memory, leak memory contents, crash the process, or potentially run code. It also goes by Node2Shell, Broccoli2Shell, and HTTP2Shell. Node.js disclosed it on October 21 and fixed it in versions 22.23.4, 24.22.1, and 26.12.1, with no workaround. .NET, Python, Bun, Envoy Proxy, Istio, and PHP have shipped patches, and Broadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation is affected because it uses Node.js.

The evidence of exploitation is thin. CISA gave no details on the attacks. SecurityWeek reports that Previdian recorded one exploitation attempt on October 27 and that ELLIO caught a malicious request on October 26 targeting Node.js 24.22.0. ELLIO’s analysis found that the request’s delivery stages matched public proof-of-concept code, but the final stage the attacker wrote produced no shell in 50 tests. The Register reports that Microsoft’s advisory rates exploitation as more likely while saying nothing suggests criminals are succeeding with the working exploits researchers have built.

What we’re actually watching: This is not a product vulnerability. It is a component vulnerability, and your asset register does not list components. Wiz reports that 91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% have publicly exposed Node.js instances. Nobody bought Brotli. It arrived inside runtimes, proxies, and frameworks, and it decodes data from whoever sends a request. The Register also reports that the underlying bug was fixed in Brotli’s source in February but not recognized as a security flaw until October, so anyone tracking advisories had no signal for roughly eight months.

Sysdig’s analysis puts the practical risk in context. The bug bites in services that decode attacker-influenced Brotli data, Express 5 with default JSON parsing puts many instances in that group, and the demonstrated impact so far is crashes at scale and code execution only in a narrow configuration. Its advice is to order patching by reachability. That advice only works for organizations that can find where attacker-controlled compressed data meets a Brotli decoder. Cloudflare and Microsoft Azure have both published WAF coverage, which buys time but does not replace the upgrade.

The CISO question: Can you list every runtime, proxy, and container image in your estate that bundles a Brotli decoder, and for each one that decompresses attacker-influenced data, can you show it runs a patched Node.js release (22.23.4, 24.22.1, or 26.12.1) or an equivalent fix from its vendor?

3. PHP2Shell: A suspected China-nexus actor rooted 25 servers with two PHP flaws and a Linux kernel bug, and Palo Alto confirms attacks on exposed management interfaces

The headline: Dream published its findings on a suspected China-nexus campaign that rooted 25 servers across the United States, Japan, Taiwan, and South Korea: 24 perimeter firewalls and one internal management server. The attacker chained a custom, non-public build of the PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300). Dream says the full chain runs from an unauthenticated HTTPS request to a persistent root webshell in under 15 minutes. Three of the systems sat in a US government-affiliated environment, where Dream reports the actor decrypted an LDAP service account password and listed every user and group in the domain. Dream’s original report withheld the vendor, and its post as updated on October 29 describes Palo Alto Networks PAN-OS firewalls. Palo Alto confirmed in an updated advisory that it has observed active exploitation targeting its management interface when exposed to the internet, and says no special configuration is needed to be affected. Dream does not name a threat actor and says multiple indicators point to a Chinese-nexus operation. It found Claude Code installed alongside an attack platform configured with DeepSeek and Kimi, but says it has no direct evidence those tools wrote the exploit. CISA added Fragnesia to its KEV catalog on October 28 with an October 31 deadline, noting that it chains with the PHP2Shell flaws to implant PHP webshells and run commands as root. Researcher Kevin Beaumont says he knows of a ransomware group using PHP2Shell against Palo Alto firewalls for initial access.

What we’re actually watching: The chain is the story, not either bug. A PHP flaw delivers a webshell with limited rights. Fragnesia, disclosed in May, converts that foothold into root. Neither flaw alone hands over a firewall. Together they do, and one of them had been waiting five months for a partner. Teams that triage only by the newest critical flaw leave the older privilege escalation open, and chains exist to exploit exactly that gap.

Palo Alto says the risk is highest when the management interface is reachable from the internet. In a separate report, CrowdStrike said the China-nexus group Warp Panda used a VMware ESX zero-day (CVE-2026-41709) in early 2026 to reduce audit trail visibility. That flaw scores 2.7 on CVSS, a rating that sits at the bottom of most patch queues, and CISA added it to KEV on October 28 with a November 11 deadline. Different campaign, same instinct: go after the infrastructure that enforces policy and keeps the logs. Our own analysis of CVE-2026-41709 covers the ESX flaw in more detail.

The CISO question: Is the management interface of every firewall, VPN gateway, and hypervisor in your estate reachable from the internet, and if you cannot answer within an hour, how would you know that a May kernel flaw on one of those appliances is still unpatched?

4. Oracle: CVE-2026-101767 went from patch to probe in seven days and hands attackers the APPS database user on E-Business Suite

The headline: Oracle fixed CVE-2026-101767 in its October patch release on October 20. On October 27, Defused’s Oracle E-Business Suite decoys recorded exploratory exploits against it, with no earlier public report of attempts in the wild. The flaw (CVSS 9.8) is an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution. It affects the Application Object Library in EBS versions 12.2.3 through 12.2.15. Horizon3.ai found it and reported it to Oracle on July 24. An attacker who reaches the vulnerable servlet runs SQL as the APPS database user, which means reading or modifying application data and executing commands on the application host. Horizon3.ai says affected data can include financial, payroll, HR, and procurement records. Censys counted 2,246 web properties running EBS on October 28, though its data cannot show which run an affected release or have installed the update.

What we’re actually watching: Two numbers tell the story. Oracle shipped its fix 88 days after Horizon3.ai’s report, on its quarterly cycle. Attackers needed seven days after the fix to start probing. A patch is also a roadmap, because attackers can diff it. The probes on Defused’s decoys are attempts, not confirmed compromises, and no public confirmation of a successful compromise had been reported when Help Net Security published. Organizations should read the probes as the start of the window, not the end of it.

EBS has drawn attackers all year. Cl0p exploited CVE-2025-61882 as a zero-day in 2025 to steal data from organizations running the suite, and in June Defused spotted attempts against CVE-2026-46817 in the Oracle Payments module. We covered Oracle’s WebLogic CVSS 10.0 KEV listing in our August 24 roundup. Where patching waits on a change window, Horizon3.ai advises removing the /OA_HTML/AppsTCFServer servlet from the URL firewall allowlist and restricting the web tier to trusted networks.

The CISO question: For every Oracle E-Business Suite web tier you run, have you applied the October 20 patch, removed the /OA_HTML/AppsTCFServer servlet from the URL firewall allowlist where patching is pending, and checked the Horizon3.ai indicators of compromise against logs going back to October 20?

5. Adobe Commerce: CISA listed PolyShell 224 days after Sansec disclosed it, and a fully patched store was infected anyway

The headline: سايزا added CVE-2026-48356 to KEV on October 27, alongside the Brotli flaw, with a November 10 federal deadline. The flaw (CVSS 9.3), known as PolyShell, is an unrestricted file upload in Adobe Commerce and Magento that leads to arbitrary code execution. Sansec first published it on March 17, and Adobe shipped a fix on July 14. In the days before the KEV listing, Sansec reported that an unknown actor has infected 953 online stores, mostly Magento, with a JavaScript loader in a campaign running since at least July 2025. PolyShell delivered the loader to 471 of those stores in a March wave. The Hacker News reports that no next-stage malware has been recovered to date.

What we’re actually watching: The clock did not start on October 27. Sansec published PolyShell on March 17, Adobe fixed it on July 14, and CISA listed it 224 days after disclosure. Anyone who waited for a KEV entry to trigger patching waited seven and a half months. The campaign behind it is older still, and PolyShell is one of several ways in.

The loader lives in Magento’s cms_block database table, not in files, so a filesystem scan returns clean. Sansec says it has evolved to tell security scanners apart from real shoppers and has visitors’ browsers fetch instructions from the attackers. Patching does not clean a store: Sansec found a fully patched store infected anyway, where the attacker had created an admin account and planted a GSocket backdoor. Sansec’s advice is to check cms_block for injected loaders, remove rogue admin accounts and backdoors, and rotate database, admin, and integration credentials once the store is clean. Magento compromises have a long history of payment card skimming, but nobody has confirmed the objective here.

The CISO question: For every Adobe Commerce or Magento storefront you operate or depend on, have you applied the July update, checked the cms_block table for injected loaders, removed rogue admin accounts and backdoors, and rotated database, admin, and integration credentials since the store was last known clean?

The pattern across all five stories

Every incident this week got past the check most organizations would normally run.

Binance’s trail starts at a laptop few would classify as production infrastructure. The Brotli flaw ships inside other software, so product inventories miss it, and Wiz finds vulnerable resources in 91% of cloud environments. PHP2Shell attacks hit management interfaces that Palo Alto says carry the most risk when reachable from the internet. Oracle’s patch shipped on October 20 and the first probes landed on October 27, faster than a monthly patch cycle. PolyShell’s loader sits in a database table, where file scanners do not look, and CISA listed the flaw 224 days after disclosure.

You cannot patch what you have not found. CybelAngel maps your external attack surface, including the management interfaces, web tiers, and forgotten storefronts attackers scan for first, so you see them before the advisory does.