Skip to content
Friday, October 30, 2026Oct 30, 2026
Previous issue

Vol. 1, No. 38Composed Oct 30 · 20:52 UTC

SitRep

Cybersecurity, in perspective.

1 elevated5 stories on the wire

Scale tight controls; keep access small and watched.
— Senecowitz Draper
ⓘAn invented Stoic/VC pen name, paired with this edition’s AI-written reflection.

You are reading a previous issue. Go to the latest edition →

The situation

Binance Breach Tied to DevOps Laptop

DevOps laptop compromise enabled withdrawals; ~$2.7B frozen, ~$2.4B at risk.

4 sources

BleepingComputer, Microsoft Secure, The Hacker News, SecurityWeek

Binance reports about $6.3B stolen across multiple chains after a compromised DevOps laptop enabled unauthorized withdrawals; roughly $2.7B in stablecoins were frozen on-chain, with around $2.4B still at risk. Binance suspended deposits and withdrawals, revoked authorizations, and coordinated with law enforcement during the trace.

Context

The incident highlights how a compromised DevOps environment can permit valid credentials and container access to authorize withdrawals, creating immediate financial impact. Related high-signal incidents include a max-severity GitLab flaw being exploited and credential/privilege abuse via help-desk impersonation and AD CS relay techniques, per cited sources.

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

No Patch, No Fix for Some Exposures

Certain exposed components lack a published fix; the brief notes ongoing remediation and monitoring requirements until patches are available.

SecurityWeek

The move

5 things to do today

  1. Revoke and rotate any DevOps credentials, API keys, service-account keys and withdraw-capable signing keys; isolate compromised hosts and preserve for forensic review.
  2. Patch GitLab instances immediately for CVE-2026-97229; monitor for crafted CI pipeline regex submissions and unusual pipeline-triggering commits.
  3. Apply PAN-OS patches and audit internet-facing appliances; verify persistence indicators and remove exposed PHP instances from internet-facing surfaces.
  4. Remove compromised Claude Code extension; install replacement version; rotate developer SSH keys; scan for unauthorized entries in ~/.ssh/authorized_keys and reverse SSH tunnels.
  5. Audit AD CS enrollment logs and certificate templates for ESC1/ESC8 misuse; restrict Quick Assist usage and enforce multi-party approval on certificate issuance.

On the wire

  • 0critical
  • 1elevated
  • 4moderate
  • 0low
P2Action

GitLab Flaw CVE-2026-97229 Exploited in the Wild, CISA Warns

GitLab Flaw CVE-2026-97229 Exploited in the Wild, CISA Warns — BleepingComputer

Previously in SitRep Oct 29: PAN-OS Management Interfaces Face Active PHP RCE · CVE-2026-109618, CVE-2026-109619

Timeline

  1. 1 earlier appearance
  2. Oct 13GitLab self‑hosted RCE CVE-2026-97229 in Ci/cd Regex Compiler
  3. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  4. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  5. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  6. Oct 29PAN-OS Management Interfaces Face Active PHP RCE
  7. This edition

Added to CISA KEV: CVE-2026-109618 on 26 Oct 2026; CVE-2026-109619 on 26 Oct 2026; CVE-2026-97229 on 29 Oct 2026 · CVE-2026-97229: CVSS 10.0, EPSS 0.27 (FIRST); CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST) and 1 more

BLEEPINGCOMPUTER · GitLab Flaw CVE-2026-97229 Exploited in the Wild, CISA Warns

Copy link to “GitLab Flaw CVE-2026-97229 Exploited in the Wild, CISA Warns”

P2Action

PHP2Shell Attacks Root Palo Alto Firewalls, WordPress Unaffected

PHP2Shell Attacks Root Palo Alto Firewalls, WordPress Unaffected — SecurityWeek

Previously in SitRep Oct 29: PAN-OS Management Interfaces Face Active PHP RCE · CVE-2026-109618, CVE-2026-109619

Timeline

  1. Oct 21Critical PHP RCEs CVE-2026-109618 and CVE-2026-109619 — 22.6M Exposed Instances
  2. Oct 22Patch and Hunt for PHP2SHELL RCE (CVE-2026-109618/CVE-2026-109619)
  3. Weekend, Oct 24AWS Publishes WAF Mitigations for PHP2SHELL
  4. Oct 29PAN-OS Management Interfaces Face Active PHP RCE
  5. This edition

Added to CISA KEV on 26 Oct 2026 (CVE-2026-109618, CVE-2026-109619) · CVE-2026-109618: CVSS 9.2, EPSS 1.00 (FIRST); CVE-2026-109619: CVSS 9.2, EPSS 1.00 (FIRST)

SECURITYWEEK · PHP2Shell Attacks Root Palo Alto Firewalls, WordPress Unaffected

Copy link to “PHP2Shell Attacks Root Palo Alto Firewalls, WordPress Unaffected”

Indicators named in this edition

KindValueNote
FILE PATH~/.ssh/authorized_keysPath targeted by trojanized Claude Code extension to add attacker SSH keys

Known exploited

Added 30 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-111357Ivanti Connect Secure30 Oct2 Nov
CVE-2026-118527Ivanti Connect Secure30 Oct13 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 1 story rated critical or elevated (P0 or P1); the 21 daily editions from 1 Oct to 29 Oct averaged 3.7. 8 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
30 Oct (this edition)0140
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200
9 Oct1310
8 Oct2300
7 Oct1310
6 Oct1310
5 Oct2210
2 Oct1220
1 Oct2201

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Drupal Commerce Core Flaw Exploited in the Wild

Drupal warns of a highly critical Commerce Core access bypass (CVE-2026-118539) exploited in the wild. The flaw affects 3.x before 3.3.13 and 8.x before 2.41, with unauthenticated attackers able to bypass access. The Commerce Core module runs on over 42,000 sites. Drupal assigns a 21/25 risk score; patches exist and admins should audit orders for inconsistencies.

3 reports

Trezor Flags Suspected Crypto-Theft Implant in Safe 5

Trezor warns of a suspected crypto-theft implant inside a Safe 5 hardware wallet sold by CryptoBilis in Southeast Asia. An Indonesian user found an extra circuit board with a cellular module that could read the screen and transmit data when plugged in. Ledger faced a similar implant incident earlier.

2 reports

TeamViewer Flaw Lets Remote Attackers Target Connected Users

A flaw in TeamViewer (CVE-2026-111585) lets a malicious or compromised host in a remote session crash the viewer and may run code on the viewer, depending on platform. Affects Full Client on Windows, Linux, macOS, Windows Portable, and Android Remote Control prior to 15.83. No password required; fixed in 15.83. No confirmed wild exploits reported.

2 reports

WordPress RCE Flaw Triggers Nearly 63,000 Attacks, Patch Issued

WordPress Core versions 4.7–7.1.3 are vulnerable to a remote code execution flaw with CVSS 8.1. Patches arrived October 28, 2026. Over 24 hours, 62,969 attacks were blocked as threat actors exploited a race window during full-package core upgrades. Update to 7.1.4 and monitor for requests to wp-content/upgrade, unfamiliar admin accounts, plugins, or PHP files.

2 reports

Syrian Hacker Sentenced Over AP Twitter Hack Causing Market Drop

Ahmad Umar Agha, a Syrian Electronic Army hacker known as Th3Pr0, received 42 months in prison for leading a hacking conspiracy against Western outlets. The group hijacked the Associated Press Twitter account on April 23, 2013, posting a false Obama injury report that triggered a $136 billion drop in the Dow Jones Industrial Average.

2 reports

CVE-2026-80093: Windows Cloud Files Mini Filter Driver Type Confusion

Talos warns of a type confusion in Windows Cloud Files Mini Filter Driver (cldflt.sys) enabling kernel crashes and potential write primitives. Affected: Windows Cloud Files Mini Filter Driver v10.0.26100.8457 and 10.0.26100.8655. Exploit via specially crafted Cloud Filter API sequences and CfAbortOperation can trigger race conditions across hydration requests.

2 reports

Hackers Publish Data on 41,000 Homeland Security Workers

Hackers calling themselves the Department of Peace stole and published personal details for about 41,000 Homeland Security workers, including names, work emails, phone numbers, addresses, titles, and internal group memberships. The dump, dubbed Icepick, covers ICE, CBP, and CISA staff. Data surfaced after an Okta SSO claim; it was released with DDoSecrets collaboration.

2 reports

Also reported

End of the Friday, October 30, 2026 edition.

Colophon

SitRep · Vol. 1, No. 38

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.