Security bugs, breaches, and patches in plain English: am I affected, and what should I do now?
19 stories · Page 2 of 2
Attackers moved about $6.3 billion out of Binance wallets on 29 Oct 2026. Binance says user funds are safe and it will cover all losses; about $3 billion is frozen. Withdrawals are still paused; Binance is targeting a Sunday, Nov 1 restart.
CISA added the Brotli decoder bug CVE-2026-111497 (Node2Shell / Broccoli2Shell / HTTP2Shell) to its Known Exploited Vulnerabilities catalog on 27 Oct 2026, with a 10 Nov federal due date. Run node --version and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later.
Anthropic's Frontier Red Team says an internal Claude model found and chained critical bugs into five attacks, including one-click Chrome code execution and zero-click Linux root. Google's Chrome 156 (27 Oct 2026) ships 52 security fixes, several credited to Anthropic and Claude.
On 26 Oct 2026 CISA added CVE-2026-109618 and CVE-2026-109619 (php2shell) to the Known Exploited Vulnerabilities Catalog with a 29 Oct due date for FCEB agencies. Honeypot evidence from 24 Oct showed working shells on unpatched PHP 8.4.26 under Apache mod_php.
Attackers breached GMO Internet's Onamae Desktop Cloud, a Windows VPS service used by FX and stock traders. Up to 26,739 servers are affected, logins saved in trading tools were taken, and the attacker demanded about ¥8 billion. On 27 Oct 2026 GMO confirmed a leak, refused to pay and announced a $1 million bounty.
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 4.0 9.2 from the CNA) can be triggered by crafted compressed data. Fixed Brotli, Node.js, Bun, Envoy, Istio and Python releases shipped 21–23 Oct 2026.
Unauthenticated RCE fixed in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. CISA urges immediate patching; Cloudflare WAF is mitigation only. Monday checklist for IT/ops.
