You are reading a previous issue. Go to the latest edition →

The situation

Binance Links Theft to Compromised DevOps Laptop

Binance faces $6.3B theft, suspends activity, and coordinates with law enforcement.

5 sources

BleepingComputer, The Hacker News, Cisco PSIRT Security Advisories, SecurityWeek, Cisco Talos Vulnerability Reports

Binance attributes approximately $6.3 billion in stolen assets to a compromised DevOps laptop that allowed valid credentials to submit unauthorized withdrawals; roughly $2.7 billion in stablecoins were frozen and about $2.4 billion remains on-chain under attacker control. Binance suspended deposits and withdrawals, revoked authorizations, and says law enforcement and blockchain firms are tracing funds.

Context

High-signal reporting from today shows a pattern of supply-chain and trust-infrastructure failures: a trojanized developer extension attempted to install an SSH backdoor (affecting up to 5,000 users), and a vendor advisory details emergency distrust of compromised certificate authority intermediate keys. These failures create direct paths to credential misuse, unauthorized code execution, and large financial thefts when combined with exploited infrastructure.

“The strongest signals are active exploitation and observed high-value theft.”

From the analysis

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Most Teams Treat Crypto Thefts as Finance‑Only Issues

Most security teams will treat Binance and Polymarket incidents as finance or trading problems. That is the wrong read because high‑signal reporting links trojanized developer tooling, compromised CA intermediate keys, and actively exploited CI/CD flaws to the same supply‑chain and trust failures that enable large thefts and operational outages.

BleepingComputer · The Hacker News · Cisco PSIRT Security Advisories

The move

6 things to do today

Revoke and rotate any service account credentials and keys used on the compromised DevOps host; assume all tokens and SSH keys present are exposed (source: ).
Patch GitLab immediately for CVE-2026-97229 or apply vendor mitigations; monitor CI/CD pipelines for unexpected regex/configuration changes and alert on new runner registrations (source: ).
Inventory certificates that chain to eMudhra intermediates, isolate systems relying on those chains, and prepare certificate replacement and re‑issuance plans following Cisco's emergency distrust advisory (source: ).
Apply vendor PAN-OS patches that address the PHP2Shell chaining vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and verify firewall integrity and boot‑time configs for unauthorized changes (source: ).
Remove or block the compromised Claude Code extension version 2.1.313, enforce extension signing/pinning in developer environments, and scan developer endpoints for added SSH keys or reverse‑SSH tunnels (source: ).
Prioritize investigating local‑privilege escalation risks by reviewing systems for indicators of CVE-2026-58613 exploitation and apply vendor updates where available; instrument endpoint telemetry to detect abnormal Cloud Filter API sequences (source: ).

Also drawn on Use-After-Free Privilege Escalation in Windows Cloud Files Driver (Cisco Talos Vulnerability Reports)

On the wire

1critical
4elevated
0moderate
0low

P0Breach

Binance Links Theft to Compromised DevOps Laptop

Binance reports an attacker used access to a DevOps laptop and valid credentials to submit unauthorized withdrawal transactions, resulting in roughly $6.3B affected; deposits and withdrawals are suspended and authorizations revoked while blockchain firms and law enforcement trace funds.

BLEEPINGCOMPUTER · Binance links $6.3B theft to compromised DevOps laptop

Copy link to “Binance Links Theft to Compromised DevOps Laptop”

P1Trust

eMudhra CA Keys Suffer Critical Compromise

Cisco issued an emergency distrust advisory after intermediate private keys from eMudhra were broken during a key generation ceremony error, allowing brute‑force recovery of keys within seconds; Cisco lists products under investigation and plans forthcoming fixes or updates.

CISCO PSIRT SECURITY ADVISORIES · Cisco Advisory: Emergency Distrust of eMudhra CA Keys

Copy link to “eMudhra CA Keys Suffer Critical Compromise”

P1Exploit

GitLab Flaw Is Exploited in the Wild

CISA warns CVE-2026-97229 (an integer overflow in GitLab's CI/CD regex compiler) is being exploited for remote code execution; GitLab released patches and Shadowserver observed roughly 2,800 affected instances referenced in scans.

Previously in SitRep Oct 13: GitLab self‑hosted RCE CVE-2026-97229 in Ci/cd Regex Compiler

Timeline

Oct 12GitLab Regex Compiler CVE-2026-97229 Max‑Severity RCE in Ci/cd
Oct 13GitLab self‑hosted RCE CVE-2026-97229 in Ci/cd Regex Compiler
This edition

Added to CISA KEV on 29 Oct 2026 (CVE-2026-97229) · CVE-2026-97229: CVSS 10.0, EPSS 0.27 (FIRST)

BLEEPINGCOMPUTER · GitLab Flaw CVE-2026-97229 Exploited in the Wild, CISA Warns

Copy link to “GitLab Flaw Is Exploited in the Wild”

P1Exploit

PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls

Threat actors chained two PHP2Shell vulnerabilities with Fragnesia to gain root on multiple PAN-OS devices; Palo Alto has issued patches and reported a small subset of internet-facing appliances were impacted.

Updated Since Oct 29: PAN-OS Management Interfaces Face Active PHP RCE · CVE-2026-109618, CVE-2026-109619 · New: sec.cloudapps.cisco.com, tenable.com, recordedfuture.com

Timeline

Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
Oct 29PAN-OS Management Interfaces Face Active PHP RCE
This edition

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST)

SECURITYWEEK · PHP2Shell Attacks Root Palo Alto Firewalls, WordPress Unaffected

Copy link to “PHP2SHELL Attacks Achieve Root on Palo Alto Firewalls”

P1Supply-chain

Claude Code Extension Installs SSH Backdoor

A malicious update to the Claude Code extension (v2.1.313) distributed via the Cursor marketplace attempted to add an attacker SSH key to ~/.ssh/authorized_keys, create a reverse SSH tunnel, and persist via scheduled tasks—Anthropic issued v2.1.314 and the marketplace paused the package.

THE HACKER NEWS · Official Claude Code Extension Trojanized on Cursor Marketplace to Install SSH Backdoor

Copy link to “Claude Code Extension Installs SSH Backdoor”

Known exploited

Added 30 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2026-111357	Ivanti Connect Secure	30 Oct	2 Nov
CVE-2026-118527	Ivanti Connect Secure	30 Oct	13 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 5 stories rated critical or elevated (P0 or P1); the 21 daily editions from 1 Oct to 29 Oct averaged 3.7. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table

Edition	P0	P1	P2	P3
30 Oct (this edition)	1	4	0	0
29 Oct	1	1	1	0
28 Oct	1	2	1	1
27 Oct	1	3	1	0
26 Oct	1	1	1	1
23 Oct	0	3	2	0
22 Oct	1	4	0	0
21 Oct	2	2	0	0
20 Oct	2	2	1	0
19 Oct	2	3	0	0
16 Oct	1	2	1	0
15 Oct	1	3	1	0
14 Oct	2	1	1	1
13 Oct	1	3	0	0
12 Oct	2	2	0	0
9 Oct	1	3	1	0
8 Oct	2	3	0	0
7 Oct	1	3	1	0
6 Oct	1	3	1	0
5 Oct	2	2	1	0
2 Oct	1	2	2	0
1 Oct	2	2	0	1

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Drupal Commerce Core Flaw Exploited in the Wild

Drupal warns of a highly critical Commerce Core access bypass (CVE-2026-118539) exploited in the wild. The flaw affects 3.x before 3.3.13 and 8.x before 2.41, with unauthenticated attackers able to bypass access. The Commerce Core module runs on over 42,000 sites. Drupal assigns a 21/25 risk score; patches exist and admins should audit orders for inconsistencies.

3 reports

SECURITYWEEKDrupal Commerce Core Flaw Exploited in the Wild
BLEEPINGCOMPUTERDrupal warns of critical Commerce Core flaw exploited in attacks
THE HACKER NEWSAttackers Exploit Critical Drupal Commerce Core Authorization Flaw

Trezor Flags Suspected Crypto-Theft Implant in Safe 5

Trezor warns of a suspected crypto-theft implant inside a Safe 5 hardware wallet sold by CryptoBilis in Southeast Asia. An Indonesian user found an extra circuit board with a cellular module that could read the screen and transmit data when plugged in. Ledger faced a similar implant incident earlier.

2 reports

BLEEPINGCOMPUTERTrezor Flags Suspected Crypto-Theft Implant in Safe 5
THE HACKER NEWSTrezor Warns of Suspected Hardware Implant in Wallet Sold by CryptoBilis

TeamViewer Flaw Lets Remote Attackers Target Connected Users

A flaw in TeamViewer (CVE-2026-111585) lets a malicious or compromised host in a remote session crash the viewer and may run code on the viewer, depending on platform. Affects Full Client on Windows, Linux, macOS, Windows Portable, and Android Remote Control prior to 15.83. No password required; fixed in 15.83. No confirmed wild exploits reported.

2 reports

THE HACKER NEWSTeamViewer Flaw Lets Remote Attackers Target Connected Users
SECURITYWEEKTeamViewer Flaw Allows Malicious Hosts to Take Over Machines

WordPress RCE Flaw Triggers Nearly 63,000 Attacks, Patch Issued

WordPress Core versions 4.7–7.1.3 are vulnerable to a remote code execution flaw with CVSS 8.1. Patches arrived October 28, 2026. Over 24 hours, 62,969 attacks were blocked as threat actors exploited a race window during full-package core upgrades. Update to 7.1.4 and monitor for requests to wp-content/upgrade, unfamiliar admin accounts, plugins, or PHP files.

2 reports

THE HACKER NEWSWordPress RCE Flaw Triggers Nearly 63,000 Attacks, Patch Issued
SECURITYWEEKWordPress Race Condition Enables Remote Code Execution, Patch 7.1.4

Syrian Hacker Sentenced Over AP Twitter Hack Causing Market Drop

Ahmad Umar Agha, a Syrian Electronic Army hacker known as Th3Pr0, received 42 months in prison for leading a hacking conspiracy against Western outlets. The group hijacked the Associated Press Twitter account on April 23, 2013, posting a false Obama injury report that triggered a $136 billion drop in the Dow Jones Industrial Average.

2 reports

THE HACKER NEWSSyrian Hacker Sentenced Over AP Twitter Hack Causing Market Drop
HELP NET SECURITYSyrian Regime Hacker Ahmad Agha Sentenced for Dow Drop

Hackers Publish Data on 41,000 Homeland Security Workers

Hackers calling themselves the Department of Peace stole and published personal details for about 41,000 Homeland Security workers, including names, work emails, phone numbers, addresses, titles, and internal group memberships. The dump, dubbed Icepick, covers ICE, CBP, and CISA staff. Data surfaced after an Okta SSO claim; it was released with DDoSecrets collaboration.

2 reports

MALWAREBYTES LABSHackers Publish Data on 41,000 Homeland Security Workers
NEWSAPI CYBER INSIGHTSData Leak Exposes Over 40,000 Homeland Security Employees

Also reported

BLEEPINGCOMPUTERCritical Linux Kernel Flaw Allows Remote Root on MPTCP Servers
CISCO PSIRT SECURITY ADVISORIESVulnerabilities in Node.js Affect Cisco Products (October 2026)
THE HACKER NEWSChinese Hackers Use AI-Powered ARTEX to Target 200+ Organizations
MICROSOFT SECUREHelp Desk Impersonation and AD CS Abuse: ESC1 and ESC8
SECURITYWEEKAnthropic Breach Dispute, UEFI Flaw, Cloudflare AI Data Leak
BLEEPINGCOMPUTERSS7 and Diameter Signaling Attacks Expose Phone Privacy
MANDIANT THREAT INTELLIGENCEARTEX and Agentic Offensive Frameworks Enable Autonomous Intrusions
SECURITYWEEKPasskeys Are Better Than Passwords, But Not Enough
MICROSOFT SECURITY UPDATE GUIDECVE-2026-118147 Visual Studio Spoofing Vulnerability
SECURITYWEEKFBI Seizes Virtualine Bulletproof Hosting Domain Used for Crimes

End of the Friday, October 30, 2026 edition.

Get a free cybersecurity brief by email on weekdays. Get the brief →

Colophon

SitRep · Vol. 1, No. 38

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure: SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards: Read our editorial standards.
Corrections: brief@sitrepit.com or the contact page.