Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity. Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while Tether and Circle moved to freeze stablecoins linked to the suspicious activity. The full scope of the incident remains unclear, and the reported outflows shouldn’t automatically be treated as confirmed losses. According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet. “Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.” Coinbase executive Conor Grogan estimated that the total value of the movements could reach $5.8 billion. I think the number is potentially up to $5.8B. Tether has blacklisted a large portion of this. https://t.co/ANz2DiXc8S pic.twitter.com/BfscU7ENSo — Conor (@jconorgrogan) October 29, 2026 These figures come from blockchain tracking and different estimates, so they don’t necessarily represent the amount stolen. BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say. If confirmed, it would be the biggest crypto heist on record. Tether and Circle have frozen about $1.8B in stablecoins, and Circle says it acted "in… https://t.co/UzgOxw9jLE pic.twitter.com/9fBEaaZrWj — International Cyber Digest (@IntCyberDigest) October 29, 2026 Binance acknowledged the reports and said its security team was investigating. The company had not publicly confirmed a breach in the initial reports, making it important to distinguish between suspicious transactions and a verified compromise. “We are aware of reports of a potential security issue and we are actively investigating.” He wrote in a post on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” We are aware of reports of a potential security issue and we are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should… — Yi He (@heyibinance) October 29, 2026 This statement, reported by The Block, reflects the company’s position at the time. Binance also urged users to be cautious of unofficial messages and links, a relevant warning whenever a major security incident attracts public attention. Blockchain records showed large transfers from Binance-linked hot wallets to a wallet that wasn’t previously identified as belonging to the exchange. Hot wallets hold cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals and other transactions quickly. Their online availability also makes their security controls particularly important. The transfers involved Ethereum, stablecoins and other cryptocurrencies. Some funds were later moved to additional wallets, making it harder to track all the transactions. Investigators must determine who initiated the transfers, whether they were authorized and whether an attacker gained control of the wallets. They also need to establish whether the funds belonged to customers or Binance itself. Large transfers alone don’t prove a hack. However, unusual movements involving large amounts of cryptocurrency require immediate investigation. One of the most significant developments was the response from the companies behind two major stablecoins, USDT and USDC. According to The Block and Forbes, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. The figures subsequently changed as the investigation developed. Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT linked to a potential Binance exchange hack. These amounts reflect reported actions at different points in time and shouldn’t be combined without checking whether they refer to distinct assets and addresses. Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone. — Paolo Ardoino (@paoloardoino) October 29, 2026 The freezes demonstrate an important feature of centralized stablecoins: their issuers can restrict transfers from addresses they control through their token contracts. This can help contain suspected theft, but it doesn’t provide the same control over assets such as Ether or Bitcoin. Nor does freezing a balance guarantee that every transferred asset can be recovered. The incident also highlights a practical tension in crypto security. Stablecoins offer the convenience of blockchain transfers, but their centralized issuers retain powers that can make a difference during an investigation. Binance maintained that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered. The company said its user funds were “completely safe.” “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact. A security investigation must establish more than whether an exchange can cover a potential loss. It should determine how the activity was authorized, whether credentials or signing mechanisms were compromised, which systems were involved and whether the attacker retained any access. For customers, the immediate priority is to avoid becoming a secondary victim. Attackers often exploit uncertainty around a major incident to distribute fake announcements, impersonate support staff and direct users to fraudulent websites. Users should rely on official Binance communication channels, avoid unexpected links and never disclose passwords, authentication codes or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to demand urgent account verification. Attackers may exploit the situation to launch a separate scam. The key lesson is that blockchain transparency does not guarantee operational security. Public ledgers show transactions, but they don’t reveal who authorized them, how attackers may have gained access or whether an exchange’s internal security controls failed. As the investigation continues, it’s important to distinguish between reported transfers, confirmed theft and funds that can be recovered. The figures may change as analysts trace more wallets and stablecoin issuers take further action. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Binance)
ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected. French multinational energy company ENGIE warned customers in France that attackers accessed personal information through a sales tool used by some business partners. The exposed data includes contact details and energy contract information that could help fraudsters impersonate the supplier. The company says its internal IT systems weren’t compromised and banking information wasn’t affected. It has blocked the attackers’ access, notified the relevant authorities and contacted affected customers, according to a spokesperson who spoke to BleepingComputer. According to notification emails sent to affected customers, the incident involved a tool used by partners to sell the company’s electricity and natural gas offers. The notification confirms that attackers gained unauthorized access to personal information stored in the sales tool. “We are informing you that an act of cyber-malice recently affected a tool used by some of our partners to market energy offers. As part of this incident, unauthorized access to your personal data was identified.” reads the notification. The compromised information includes customers’ names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers. The company hasn’t disclosed the partner or platform involved. It also hasn’t revealed how many customers were affected, when the intrusion began, or when it was discovered. For electricity customers, these include the delivery point identifier (PDL). For gas customers, they include the metering and estimation point (PCE). ENGIE says financial information wasn’t affected and that its investigation indicates the exposure was limited to contact details and certain contract information. That reduces one category of risk but doesn’t eliminate financial fraud. Attackers can use accurate customer information to persuade victims to disclose additional data or make payments. Anyway, the exposed data could support impersonation scams. The company warned customers to watch for attempts to obtain further information or induce payments. A contract number, however, doesn’t prove that a caller is legitimate. It may simply show that the person has access to an exposed record. Customers should verify unexpected requests through trusted channels, even when the sender knows their personal details. ENGIE hasn’t attributed the attack to a specific group, and at this time no ransomware group has claimed responsibility for the attack. Experts recommend visiting ENGIE’s official website or app directly instead of signing in through links received by email. Customers should also be cautious with unexpected calls and messages. If someone requests a payment, password or additional personal information, they should end the exchange and verify the request using independently obtained official contact details. Customers should never share SMS verification codes, passwords or banking details with someone who contacts them unexpectedly. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
The FBI seized Virtualine, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder money from illegal activities The FBI seized the website of Virtualine, a hosting service that sold its services to criminals. The seized domain is virtualine.net, and the government says the site was used to commit and facilitate prolific criminal activity. That includes the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images of adults and minors, and international money laundering. A court authorized the seizure. “Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced today the seizure of the website virtualine.net after it was used to commit and facilitate prolific criminal activity, including the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct.” The Justice Department has the details in a press release. Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, offers “bulletproof” hosting. It sells hosting, servers and domain names to customers who want a provider that ignores abuse complaints. It promotes its services on cybercrime forums. Court records include examples of those ads. In September 2024, Virtualine told an Exploit.in user that it allowed illegal activities such as phishing, payment card fraud, email spam and port scanning, but banned child sexual abuse material and terrorism-related content. In June 2025, it boasted on HackForums that it ignored more abuse than three therapists combined. In March 2026, Virtualine promoted an “additional protection plan” for customers, offered after the company received an official request from law enforcement. Under the plan, it would move the customer’s criminal infrastructure to another shell company unaffiliated with Virtualine, and then reactivate the server. It was a game of musical shell companies. “In March 2026, Virtualine advertised its “additional protection plan,” which it offered to its customers after “receiv[ing] an official request from law enforcement agencies.” Under this plan, Virtualine would move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”” continues the press release.”As Virtualine advertised to users on the platform HackForums in June 2025, “Virtualine ignored more abuse than your last three therapists.”” Despite saying it bans child content, the government says Virtualine knowingly hosted a website that carried it. Court records call that site Vendor 1. It’s a criminal online forum where users post and sell access to nude, sexually suggestive or sexually explicit images and videos of minors and adults, and it also promotes a hack-for-hire service in which people pay hackers to get into victims’ online accounts without consent and take explicit images and videos. In January 2026, about a month after assigning Vendor 1 an IP address, Virtualine began receiving reports of child sexual abuse images and videos on the server. The reports came from police in Germany, Canada and Australia, the US National Center for Missing and Exploited Children (NCMEC), and a victim’s lawyer. According to the government, Virtualine continued hosting Vendor 1 despite those warnings. The government also says Virtualine helped Vendor 1 build a new website. It allowed users to upload illegal material and download it after paying. The site accepted several payment methods, including an option called “BTC [NO-AML].” It used bitcoin addresses outside a hosted payment service, allowing customers to pay directly and avoid that service’s checks for illegal funds. Authorities say some payments came directly from criminal groups. They accuse Virtualine of accepting the money and moving it through further transactions to hide its source. The FBI’s Washington Field Office led the investigation, with significant help from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, and private partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs also assisted. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz represent the government. A domain seizure doesn’t end the problem, and the government says so in plain terms. The new website Virtualine built with Vendor 1 has already drawn at least one abuse complaint about sexually explicit images of children, and the release adds: Virtualine hosts this new website to this day. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Virtualine)
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities. The U.S. Department of Justice (DOJ) confirmed that Virtualine marketed services that permitted “illegal/black hat activities” ranging from phishing, spamming, and carding to port scanning. The FBI seized the primary domain of the service, virtualine[.net], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and Lumen.
Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for the Eastern District of New York announced it in a press release, and it also says an $11 million reward remains for a co-conspirator who’s still at large. “Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.” reads the DoJ’s press release. “The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers. “ In December, Artem Aleksandrovych Stryzhak pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in April 2025. He pleaded guilty to conspiracy to commit computer fraud, extortion, and related activity Nefilim ransomware was used to encrypt networks worldwide, including in the Eastern District of New York, causing millions in losses from ransom payments and system damage. Attackers employed a customized ransomware executable in each attack, generating unique decryption keys and tailored ransom notes for victims. In June 2021, Nefilim administrators granted Artem Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds, which he deployed via his account on the administrators’ online platform. Stryzhak and co-conspirators researched victims using online databases to collect information on their net worth, size, and contacts. After gaining network access, they stole data to pressure companies into ransom payments. Nefilim notes warned that stolen data would be posted on publicly accessible “Corporate Leaks” sites maintained by the administrators if victims did not comply. Volodymyr Tymoshchuk, Stryzhak’s co-defendant and Nefilim admin, is a serial ransomware cybercriminal who is still at large. According to court documents, his first role was with Nefilim. Starting around June 2021, he joined the ongoing Nefilim conspiracy as an affiliate and got access to the ransomware. In exchange, he agreed with one of the group’s administrators, Volodymyr Tymoshchuk, to pay the administrators 20 percent of the ransom proceeds. Even crime has licensing fees. One of those attacks came in June 2021, when Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that went into a ransom note sent to the victim. He kept deploying Nefilim ransomware through at least October 2021. Separately, he also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive’s conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. The attacks caused major disruption to daily operations around the world and affected responses to the COVID-19 pandemic. One hospital had to give up digital technology to treat its patients and couldn’t take in new ones right after the attack. As a Hive affiliate, Stryzhak and his co-conspirators hit seven victims, including law firms, a dentist’s office and a healthcare provider, during the pandemic. Those victims couldn’t get to their encrypted data. The FBI, as part of a months-long effort to disrupt Hive, gave a decryption key to one of Stryzhak’s victims, so that victim recovered its data without paying a ransom. U.S. Attorney Joseph Nocella, Jr. thanked the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and its Computer Crime and Intellectual Property Section, and Spanish law enforcement for helping to capture him. “Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.” The State Department’s Transnational Organized Crime Rewards Program is offering up to $11 million for information that leads to the arrest, conviction or location of Tymoshchuk. Anyone with information can call the FBI at +1-917-242-1407 or email TymoTips@fbi.gov, contact a local field office if in the United States, or reach the nearest U.S. Embassy if overseas. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. The framework has been dubbed Silent Train because the threat actor uses it against select targets, cleans it up after each operation, and refreshes it continuously. Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure. Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts. Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods. "Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.
Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter, speaking to Reuters. Raphael Satter reported it on October 27 in a Reuters story, and the claims rest on sources, not on a published attribution. “Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.” Reuters states. TrendAI concluded that the company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink. They believe the ads were likely used to geolocate users or otherwise surveil them. “TrendAI Research observed large-scale use of advertising infrastructure for geolocation tracking, advertising technology surveillance, and intelligence gathering. Data from these activities is valuable for precise targeting of key individuals in sensitive locations, including active conflict zones.” reads the report published TrendAI. “SHADOW-EARTH-79 is also the number one bidder in 105 individual countries in Starlink traffic that we observed. It accounts for approximately 13% of all winning bid events in Starlink traffic, five times higher than average (approximately 3%) bids for other bidders, and the highest of any high-volume buyer. Starlink is widely used in conflict zones where terrestrial networks are degraded.” SpaceX didn’t respond to requests for comment, and Discover-Tech and its chief executive didn’t respond over the past two weeks. Starlink users make attractive targets. Governments around the world are trying to get a grip on satellite internet terminals, which route data through SpaceX satellites and not through nationally regulated telecom firms. That lets them sidestep local internet restrictions, work in hostile areas or coordinate action across battlefields. Ukraine’s military relies on Starlink for frontline communications and for directing drone strikes. The findings come from advertising data collected by TrendAI. The data shows that Discover-Tech became one of the biggest bidders for ads shown to Starlink users worldwide. It was the top bidder in more than 100 countries, including several where Starlink is banned or restricted. Advertisers bid in online auctions to buy space for ads in browsers and apps. “In Starlink IP space traffic that we observed, SHADOW-EARTH-79 is the second-largest winning bidder by raw volume. However, examining the statistics and saturation of the group’s ad impression buying strategy reveals an obvious skew towards buying ad impressions on Starlink addresses, compared with its overall footprint.” continues the report. TrendAI published its report on October 15 but didn’t name Discover-Tech. Instead, it identified “an ad tech entity” called Shadow-Earth-79. Six sources say that’s TrendAI’s codename for Discover-Tech. TrendAI didn’t directly explain why it left out the company’s name. It said its naming policy helps prevent mistakes and avoids labels that could confuse security teams, lead them to focus on the wrong risks or prompt the wrong response. Starlink users are valuable targets for surveillance. Governments want more control over satellite internet services, which send data through SpaceX satellites rather than local telecom networks. Starlink lets users get around local internet restrictions, stay connected in dangerous areas and communicate on the battlefield. Ukraine’s military uses Starlink for frontline communications and to help direct drone strikes. Finding ways to track Starlink users has turned into a cottage industry. In May, the Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track them. Haaretz said exploiting ad data appeared to play a key role. On the same day as TrendAI’s report, the Canadian cyber watchdog Citizen Lab and the New York ad tech firm Confiant named Discover-Tech. Both said it abused the ad bidding process, which can leak data about internet users back to the bidder. Over time, a bidder can collect that data, collate it and merge it with other information to de-anonymize users and follow them around the web. In some cases it can also set them up for targeting with surveillance software. Citizen Lab and Confiant said the ads appeared inside dozens of sensitive networks belonging to media organizations, governments and tech firms. Google, Comcast and other companies said they removed Discover-Tech from their ad platforms. At least one big US tech company and one international organization recently started internal inquiries into whether Discover-Tech’s ads targeted their employees, according to one of the six people and a seventh person familiar with the matter. TrendAI’s report pointed to suspicious bidding patterns that suggested “targeting and tracking infrastructure” and not a commercial advertising operation. “Overall, the design of this “customer-facing” front-end makes us believe that the system is more likely designed as a “surveillance” and “intelligence gathering” platform, rather than simply a platform for advertisement management.” the report concludes. “The collected evidence indicates with moderate-to-high confidence that SHADOW-EARTH-79’s advertising presence functions as targeting and tracking infrastructure rather than a commercial advertising operation. The anomalous bidding behavior, heavy dominance in sanctioned and conflict states, and pronounced over-bidding for Starlink address space establish intent to reach specific audiences in sensitive geographies.” It noted an obvious skew toward Starlink-aimed ads. It also found that Shadow-Earth-79 was the top ad buyer in Syria, Libya, Yemen and South Sudan, and the second biggest in Afghanistan. Few Western brands are chasing shoppers in Libya at the moment, and the report says demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero. The entity also won an implausibly dominant share of bids in several other countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela. The researchers were convinced Discover-Tech was behind it and discussed naming it in the report, according to the six sources. They dropped the idea after TrendAI executives raised legal concerns, five of those sources said. It wouldn’t be the first time. Earlier this year, Reuters reported that Palo Alto stripped explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident Beijing was behind the hacking. Reuters said the report was watered down over fears that naming China would cause problems for Palo Alto’s operations there, which were already under scrutiny after a Beijing directive told domestic companies not to use its products. Palo Alto said the lack of attribution had nothing to do with China’s procurement rules and called any suggestion otherwise speculative and false. Executives fear that exposing surveillance operations could draw retribution, and industry experts tell Reuters the sector has a habit of staying quiet. “Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.” Reuters concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Starlink)
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach.
Confirm this action.
Leaving now will discard your changes.