This cybersecurity weekly report covers October 26 to November 1, 2026, and two storylines dominated it. PHP2Shell stopped being a disclosure scare and became a confirmed attack path when CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 26.
Dream then reported that a suspected China-nexus actor had chained them with a Linux kernel bug to root firewalls. On October 29, Binance disclosed a security incident that tracing firms valued between roughly $5.9 billion and $6.4 billion, the largest crypto theft on record, with analysts pointing to North Korea.
The rest of the week was no quieter, and the cybersecurity news this week reflected it. An attack on a New Mexico health system forced ambulance diversions. A trojanized Claude Code extension reached up to 5,000 Cursor users. CISA also listed Brotli, GitLab, Cisco and Ivanti flaws as exploited.
The cybersecurity incidents this week share one trait: attackers worked through trusted paths such as an engineer’s laptop, a marketplace update and a management interface, not through exotic exploits. Readers who rely on weekly cybersecurity news to set priorities should treat the patching items below as the most urgent part of this cybersecurity weekly report.
Major Incidents
1. Binance: Record Crypto Theft Linked to a Compromised Engineering Environment
In this cybersecurity weekly report, the largest loss comes first. Binance said on Thursday, October 29, that a security incident had affected about $6.3 billion in assets. TRM Labs dates the theft to the evening of October 29 (UTC) and says most funds left Binance wallets on ten blockchains within about 20 minutes.
Binance’s early assessment is that the intrusion may have started with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container used to submit unauthorized withdrawals. The company later said its investigation had “uncovered additional points of breach” beyond that laptop.
Binance reported no evidence that wallet private keys leaked. It suspended withdrawals and said it would cover losses from its SAFU fund and company funds. It also reported roughly $3 billion frozen on-chain. The company expected withdrawals to resume within about two days, but the sources reviewed at publication time did not confirm that they had.
Estimates of the theft differ. Chainalysis put it near $5.9 billion at the time of theft, TRM at $6.36 billion and Elliptic at $6.43 billion. Attribution is also not uniform. TRM and Chainalysis assessed with high confidence that North Korea’s TraderTraitor cluster was responsible, citing small Tornado Cash withdrawals that funded the operator wallet, pre-signed transactions executed in a single burst, and commingling with funds from the Bitget exploit.
Elliptic also assessed North Korea-linked involvement but cautioned that the laundering speed and method differ from earlier North Korean patterns and that Binance has not published a root cause. Binance itself has not attributed responsibility to anyone.
For defenders, the mechanism matters more than the headline. Among the cybersecurity incidents this week, this is the one with the clearest design lesson. Elliptic noted that the attacker appears to have made Binance’s own systems sign transactions rather than stealing keys. That is the same shape as the 2025 Bybit theft, where the weak point was the infrastructure and people around the wallets, not the cryptography. [Read more]
2. University of New Mexico Health System: Hospital Diversion and an Unverified Extortion Claim
The University of New Mexico Health Sciences Center reported a “cybersecurity event” on Monday, October 26. IT teams contained the event, the system told patients not to come to its Albuquerque hospital, appointments at more than 30 clinics were cancelled, and ambulances were diverted.
The hospital runs the state’s only Level 1 trauma center. UNM limited new patient acceptance from 12:30 to 2:30 p.m., began phased restoration, and said clinics resumed on October 27. It notified state and federal law enforcement, activated an emergency operations center, and has not described the incident as ransomware. The FBI said it was assisting.
A newly emerged group calling itself BYOD claimed the attack. It asserted 36,000 compromised machines, both Active Directory forests, two Oracle databases and personal data on students and employees, including Social Security numbers. These are attacker claims, and neither UNM nor outside parties have verified them.
On October 27 the group said it had not realized hospital machines supported real-time patient care, offered free decryption keys for hospital-sector devices, said it would keep the stolen data, and floated payments of up to $2,500 per affected patient. Free keys do nothing for data that may already be copied.
It was the most disruptive of the cybersecurity incidents this week for patient care. Among the cybersecurity threats this week, this one carried real patient-safety risk. Why this matters: a hospital can be back to normal within a day and still not know what left the network. [Read more]
3. Keystone: Stolen Device-Verification Key Forces Destruction of 18,835 Wallets
Keystone said on October 26 that the attacker behind an October 20 breach of its website also took the key its hardware wallets use to prove they are genuine. According to Keystone, the attacker exploited a flaw in a third-party monitoring tool to escalate privileges.
Because the key is written at manufacture and cannot be rotated, a counterfeit built with it could pass Keystone’s verification check. The company will destroy 18,835 unsold devices carrying the key, paused website shipments, and reported up to 25,964 affected buyer records.
Keystone says the key plays no role in seed generation, private-key derivation or transaction signing, and that wallets delivered before October 20 that pass verification remain trustworthy. It has not confirmed any counterfeit in circulation.
In weekly cybersecurity news, hardware supply chain stories rarely arrive in pairs, and this week brought two. Separately, on October 30 Trezor warned that a Safe 5 bought from the reseller CryptoBilis appeared to contain an extra board that transmits the recovery phrase over a mobile network. Trezor had not yet examined the device and advised buyers from that reseller since March to move funds to a new wallet. [Read more]
4. Cursor Marketplace: Trojanized Claude Code Extension
Between about 2:27 a.m. and 1:35 p.m. PT on October 29, a tampered build of the Claude Code extension was served through Cursor’s marketplace as version 2.1.313 under Anthropic’s legitimate extension ID.
Cursor said at most 5,000 users installed it. OpenSourceMalware and Microsoft describe an injected loader that adds an attacker SSH key to ~/.ssh/authorized_keys, attempts a reverse SSH tunnel, installs persistence through a scheduled task, crontab or LaunchAgent, and sends host details, including the names of up to 40 environment variables containing strings such as KEY, TOKEN or SECRET.
This supply chain case is the cybersecurity news this week that developers should read first. Enabling the local SSH service needs admin rights, so tunnel access fails on most macOS and Windows hosts. The key and persistence are still written, though. Anthropic said its own systems and the VS Code and Open VSX releases were not affected, and Microsoft and Socket found no evidence the build reached other registries.
How the attacker published under Anthropic’s name on Cursor’s marketplace remains unexplained. For developer teams, this is the cybersecurity incident this week most likely to have touched their own laptops. Cursor rotated its keys and rebuilt the marketplace. Hosts that installed or auto-updated to 2.1.313 should be isolated. Removing the extension does not remove the SSH key or persistence entries, so those and the credentials need separate handling. [Read more]
[IOC] IP:port | 134.209.82[.]225:8099 | Beacon endpoint and reverse-tunnel host in the trojanized 2.1.313 build, per Cursor and OpenSourceMalware; treat as time-sensitive
[IOC] SSH key label | svc-telemetry | Comment on the attacker key added to authorized_keys
Also reported on October 30: Chainalysis said it detected an external actor using “offensive agentic techniques” against its systems. The company said only non-sensitive customer data was accessed (user IDs, names, email addresses and organization role labels) and that investigation content, credentials and session tokens were not.
ANALYST INSIGHT: The common thread is trust that nobody re-verified. Binance’s attackers reached a hot-wallet signing path. Keystone’s attacker reached a factory secret through a monitoring tool on its website. The Cursor build rode a legitimate publisher identity.
In each case the cryptography or the product code held, and the surrounding pipeline did not. The practical step is to review who and what can sign, publish or approve on your behalf, especially developer laptops and marketplace accounts.
Vulnerabilities & Patches
Cybersecurity threats this week centered on edge devices and shared runtimes, which is why this section of the cybersecurity weekly report runs long. CISA updated KEV on four days (October 26, 27, 29 and 30), and exploitation evidence, not CVSS, drove the order below.
[CVE] CVE-2026-109618, CVE-2026-109619 | PHP | PHP core (web SAPIs) | CVSS: 9.2 (v4.0, vendor) | Exploited: Yes (CISA KEV, October 26)
PHP2Shell is a pair of unauthenticated remote code execution flaws, one from out-of-memory corruption and one from stale global state. CISA says the flaws affect PHP installations serving web requests, including Apache mod_php (which PHP rates highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. PHP shipped fixes on October 21.
Of all the cybersecurity news this week, PHP2Shell has the widest reach. A week earlier, CISA had warned of the danger without observing successful exploitation. This week, honeypot operators recorded working shells, including 35 shells from two IP addresses on October 24, and Delft University’s Threat Intelligence Lab tracked more than 50,000 exploitation requests from over 600 IP addresses in 70 countries.
CISA has not named victims. Some early reports were premature: Palo Alto Networks’ Unit 42 withdrew its assessment that attackers used PHP2Shell against a European government agency.
Embedded PHP widens the exposure beyond web servers. Palo Alto Networks lists all PAN-OS and Panorama versions as affected and rates its product exposure 8.7, with management-interface exposure as the main risk. The company says it knows of no malicious exploitation against its products.
It began releasing hotfixes on October 25 and planned to finish by October 30. Siemens, Schneider Electric and ABB have confirmed some products are affected. A third PHP bug, CVE-2026-115560 in session upload progress handling, needs an unusual configuration and will be fixed in the next regular release.
[PATCH] Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers or the web server. For appliances, install vendor firmware and keep management interfaces off the internet.
[CVE] CVE-2026-111497 | Google | Brotli decoder (Node.js, .NET, PowerShell, Bun, Envoy, Istio, Python) | CVSS: 9.2 | Exploited: Yes (CISA KEV, October 27)
Known as Node2Shell or Broccoli2Shell, this out-of-bounds write lets crafted Brotli data crash an application, leak memory and potentially run code. Imperva demonstrated code execution on an official Node.js image. Previdian logged one exploitation attempt on October 27, and a second honeypot operator saw an attempt that used a broken exploit.
Broadcom says VMware Cloud Foundation’s SDDC Manager is affected through Node.js. The federal deadline is November 10. Brotli is one of the cybersecurity threats this week that hides in dependencies, so check software inventories, not just servers.
[PATCH] Move to Brotli 1.0.10, 1.1.1 or 1.2.1, or vendor builds that include them. If you cannot update, block Brotli-compressed content from untrusted sources at the proxy.
[CVE] CVE-2026-97229 | GitLab | Community and Enterprise Edition | CVSS: 10.0 | Exploited: Yes (CISA KEV, October 29)
An unauthenticated attacker can execute code through a crafted regular expression in CI/CD configuration. Alpine Linux disclosed that someone tried this against its unpatched GitLab instance on October 20 and 21, crashing worker processes eight times, with four attempts failing at the next stage.
Later attempts on October 25 and 26 were blocked. Alpine found no evidence of success but rebuilt the instance, and says its repository and October 21 releases were not tampered with. The federal deadline was November 1. Alpine’s near miss is one of the cybersecurity incidents this week that should prompt any team with an internet-facing GitLab to review exposure.
[PATCH] Apply GitLab’s fixed release for your branch and review CI configuration changes from unfamiliar accounts.
[CVE] CVE-2026-111357, CVE-2026-118527 | Ivanti | Connect Secure | CVSS: 8.8 and 4.3 | Exploited: Yes (CISA KEV, October 30)
These two flaws complete an exploit chain Volexity documented in October, used by a previously undocumented actor tracked as UTA0576 alongside an authentication bypass (CVE-2026-104935, KEV since October 13). The chain yields unauthenticated root.
Volexity reported credential theft, limited Active Directory metadata collection and searches for administrator passwords and BitLocker recovery keys rather than web shells. Ivanti says its latest release fixes every flaw in the chain. Federal deadlines are November 2 and November 13. VPN gateways again produced one of the most serious cybersecurity threats this week for enterprise teams.
[PATCH] Upgrade to Connect Secure 25.1.1.3 or 22.8R2.6, then rotate credentials stored on or reachable from affected appliances.
Other exploited or urgent items from this week’s cybersecurity threats:
- WordPress Core (no CVE assigned, CVSS 8.1): Versions 4.7 through 7.1.3 are exposed to code execution during the brief window when a full-package core update unpacks into a predictable directory. Wordfence blocked 62,969 attempts in 24 hours after the October 28 fix. [PATCH] Update to 7.1.4.
- [CVE] CVE-2026-48356 | Adobe | Commerce and Magento | CVSS: 9.3 | Exploited: Yes (KEV, October 27): An unrestricted file upload bug dubbed PolyShell. Sansec reported at least 953 stores infected.
- [CVE] CVE-2026-76418 | Cisco | ASA and FTD | CVSS: 8.6 | Exploited: Yes (KEV, October 29): A remote denial-of-service reload condition. Cisco said earlier this month it knew of exploitation.
- Apple: iOS and macOS 27.2 shipped October 26 with fixes for 286 vulnerabilities across the newest releases, and iOS 18.7.11 backported the fix for CVE-2026-86950, a CoreGraphics zero-day Apple described as used in an “extremely sophisticated attack.”
- Linux kernel TCP (CVE-2026-98432): Anthropic said on October 27 that its AI model wrote an exploit for this use-after-free. Severity ratings conflict: the kernel team scores it 9.8, while Red Hat, Amazon, Oracle and SUSE score it 5.9 to 8.1. As of October 29 Ubuntu and Red Hat Enterprise Linux had not shipped fixed kernels, according to The Hacker News.
PRIORITY ACTION: For this week’s cybersecurity threats, patch PHP and anything that embeds it first, starting with internet-facing mod_php hosts and appliance management planes. Next, and for anyone using weekly cybersecurity news to set patch order, move Ivanti Connect Secure to the fixed builds, since the chain gives unauthenticated root and the first federal deadline is November 2. Internet-exposed GitLab comes third.
Ransomware Activity
BYOD: A New Group and the Gap Between Claim and Confirmation
BYOD emerged in September and lists only a handful of victims. Its first named victim was Trump Mobile, and The Register reported that those claims appeared to hold up. That gives its UNM claims some weight. It does not give them proof.
In this week’s cybersecurity news, few stories separated claim from fact as cleanly as this one: UNM confirmed a cybersecurity event and recovery steps, BYOD claimed encryption and theft, and no independent party has confirmed scope or data exposure. For hospital readers of this cybersecurity weekly report, the lesson is simple. Healthcare teams should plan for the case where operations recover quickly but the data question stays open for weeks.
n0n: AI Coding Agents on Top of Stolen Credentials
SOCRadar analyzed an exposed workspace belonging to an n0n operator who tried to break into 23 organizations across 14 countries. n0n has claimed 108 victims since it emerged last month. Access relied on weak or stolen credentials in every documented case, including RDP scanning, FortiGate SSL-VPN credential stuffing and exposed cloud keys. SOCRadar found no evidence of vulnerability exploitation in the cases examined.
The AI angle is real, but modest. The operator ran OpenCode configured with 154 model entries across seven providers, spent more than $7,216 on AI services by October 22, and used it to write and debug hundreds of scripts. SOCRadar found no evidence of a fully autonomous attack system.
In some intrusions the group also deleted data and backups, which means a decryption key alone cannot restore the victim. Its locker used hardcoded keys that appear reused across victims. On October 12 the group listed 38 maritime and logistics organizations with ransom demands from $400,000 to $28 million; none were marked settled after the October 19 deadline.
ANALYST INSIGHT: Among the cybersecurity threats this week, ransomware followed recent patterns and used the same entry points: stolen credentials and unpatched edge systems. The ransomware cybersecurity incidents this week were easy to read once the entry points were known. AI made n0n faster at scripting, but it did not change how n0n got in. Credential hygiene, VPN multi-factor enforcement and offline, tested backups address this actor directly.
Threat Intelligence
Suspected China-Nexus Actor: PHP2Shell Chained With Fragnesia to Root Firewalls
This was the most operationally useful item among this week’s cybersecurity news for network teams, and a clear example of cybersecurity threats this week that begin at the perimeter.
Dream reported that an attacker used the Chinese search engine FOFA to find about 19,000 internet-facing firewalls from one vendor, then ran a combined PHP2Shell and Fragnesia (CVE-2026-46300, CVSS 7.8, a Linux kernel flaw in the XFRM ESP-in-TCP subsystem) chain against 25 of them. Reports place the activity between October 23 and 25. The attacker dropped a PHP root web shell on 24 devices.
On 22 of them Dream saw no follow-on activity. On systems in a U.S. government-affiliated environment, the attacker decrypted an LDAP service account password and enumerated domain users and groups. Reports differ on whether two or three government systems were involved, and Dream could not determine whether later steps such as creating a backdoor account succeeded.
Dream has not named the firewall vendor, and it attributes the activity to a suspected China-nexus actor. Attribution remains unconfirmed. Do not tie this campaign to any specific vendor’s products. Some trade coverage has, and no source supports it.
[TTP] Exploit Public-Facing Application (ATT&CK ID: T1190): PHP2Shell used against internet-facing management services
[TTP] Exploitation for Privilege Escalation (ATT&CK ID: T1068): Fragnesia used to move from web-server context to root
[TTP] Web Shell (ATT&CK ID: T1505.003): PHP root shell left on 24 devices for persistence
[IOC] IP | 204.76.203[.]7 | Mass-exploitation source Defused Cyber saw probing PHP2Shell against GlobalProtect honeypots on October 25; probes only, not tied to the Dream campaign
Vapor Panda: ARTEX Agents Used Against More Than 200 Organizations
CrowdStrike says the China-based adversary it tracks as Vapor Panda (previously VexatiousTemper, overlapping with Trend Micro’s Earth Estries) has used the Go-based AI pentesting framework ARTEX since October 17 against more than 200 organizations. Targets include foreign ministries across Latin America, Europe, Asia and the Middle East, 19 U.S. organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the U.S., Belgium and the Philippines.
Post-exploitation activity is confirmed at nine organizations, where the attacker deployed BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying and reconnaissance. The tooling combined DeepSeek with an unidentified commercial model in a planner-and-worker agent setup under a human operator. In one intrusion the planning agents consumed about 1.4 billion input tokens.
Among the weekly cybersecurity news from threat researchers, this report stood out for its scale. CrowdStrike’s reading is that agentic tooling widens target volume per operator, not that the actor’s goals changed. ARTEX’s developer has reportedly taken it closed source. [Read more]
Industry & Regulatory News
Weekly cybersecurity news beyond the incident queue came mostly from governments and certificate authorities, and it matters for any cybersecurity weekly report that tracks policy as well as attacks.
Australia’s ASD Cuts an Amadey Operator Off From 180,000 Infected Computers
The Australian Signals Directorate said in an interview published October 27 that it accessed the backend of one criminal’s Amadey operation and disconnected the controller from about 180,000 infected computers.
Among the weekly cybersecurity news from law enforcement, ESET has identified 53 separate Amadey botnets that share no infrastructure, so this removes one operator, not the malware. Disconnection also does not undo earlier credential theft. ASD separately said it destroyed 5 terabytes of stolen business data that was being offered for sale, including an estimated 4.8 million files taken from Australians. [Read more]
eMudhra: India’s Weak CA Keys Reach Browser Root Stores
Indian certificate authority eMudhra revoked eight intermediate certificates after a researcher showed their private keys could be recovered almost instantly. CERT-In issued advisory CIAD-2026-0050 on October 21, and MeitY formed a special team to investigate. eMudhra attributes the weakness to a script error in an April 2025 key ceremony.
This week’s milestone: Chrome’s removal of the emSign ECC Root CA – G3 from its root store began reaching devices on October 27, after Mozilla’s earlier removal. Go’s 1.27.3 and 1.26.10 releases (CVE-2026-111943) reject chains using the eight keys, so teams that build with Go must rebuild. Indian organizations using eMudhra TLS or code-signing certificates should check certificate chains and servers that keep their own trust stores. [Read more]
Cloudflare Q3 DDoS Report
The cybersecurity news this week also included volume data. Cloudflare reported 18.2 million network-layer DDoS attacks in the third quarter, up 38% from the second, and 14.4 trillion HTTP DDoS requests. Short bursts under 10 minutes and 1 Gbps rose 208%, while attacks above 1 Tbps fell 69%. For readers of this cybersecurity weekly report who run public services, that favors always-on mitigation over manual response. [Read more]
Looking Ahead
Three items from this cybersecurity weekly report are still open, and they will shape the weekly cybersecurity news next week. First, Binance. Withdrawal resumption, the published root cause and the “additional points of breach” Binance mentioned are the next disclosures to track. Tracing firms report that the attacker still controls billions in assets that issuers cannot freeze, so laundering activity will keep generating updates.
Second, remediation deadlines, which turn the cybersecurity threats this week into concrete tasks. Federal civilian agencies must fix Ivanti CVE-2026-111357 by November 2, Brotli CVE-2026-111497 by November 10 and Ivanti CVE-2026-118527 by November 13. Private organizations can use the same dates as a benchmark. Microsoft’s monthly security update arrives Tuesday, November 10.
Third, PHP, where the cybersecurity incidents this week may not be finished. The project plans to fix CVE-2026-115560 in its next regular release, and PHP 8.2 reaches end of life on December 31 according to Socket, so teams patching 8.2.35 now have limited runway.
UPCOMING EVENTS: November 2 (Ivanti KEV deadline), November 10 (Microsoft security updates, Brotli KEV deadline), November 13 (second Ivanti deadline), December 31 (PHP 8.2 end of life).
[WATCH]: The long tail of PHP2Shell in appliances and embedded products is the unresolved issue most likely to produce new victims next week. Known so far: exploitation is confirmed, PHP fixes shipped October 21, and vendors including Palo Alto Networks were still releasing hotfixes through October 30.
Unknown: how many embedded and end-of-life PHP deployments remain unpatched, which firewall vendor Dream’s 25 compromised devices belonged to, and whether the government-environment intrusion went past reconnaissance.
For readers of this cybersecurity weekly report, the action is to inventory every product that embeds PHP, confirm vendor patch status for each and keep management interfaces off the internet until it is verified. Binance’s root cause will draw the headlines, but this is the issue that touches the most organizations. Treat it as the main takeaway of this cybersecurity weekly report and a likely feature of the cybersecurity news this week and next.
