Blockchain intelligence firm Chainalysis has disclosed a security incident after attackers used what it describes as "offensive agentic techniques" to gain unauthorized access to its internal systems and tools. The company says some customer information was accessed, including names, email addresses, user IDs, and organizational role labels, but claims there is no evidence that sensitive investigation data or authentication credentials were exposed. Chainalysis provides blockchain analytics tools used by law enforcement, government agencies, cryptocurrency exchanges, and financial institutions to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. On Friday, roughly 5:14 PM ET, Chainalysis published a security incident disclosure along with the full text of the email sent to affected customers.
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks. “This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs. The module doesn’t sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.” reads the advisory. This vulnerability is being actively exploited in the wild.” The module allows websites to sell products and services through shopping carts, checkout forms, and APIs. “Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.” reads the advisory. Researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) reported the vulnerability. The maintainers at the open-source project confirmed that the vulnerability is being actively exploited in the wild. Drupal recommends that users update their installations to the latest available release. Those running the 3.x branch should upgrade to version 3.3.13, while users on earlier releases should move to Commerce Core 8.x-2.41. In May, Drupal warned that attackers were exploiting an SQL injection flaw, tracked as CVE-2026-9082, in its database abstraction API. The vulnerability could allow attackers to gain higher privileges, access sensitive information, and execute malicious code remotely. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-118539)
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 (CVSS score of 10.0) GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability CVE-2026-76418 (CVSS score of 8.6) Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability CVE-2026-97229 is a critical security flaw that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory. The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program. Alpine Linux recently reported that an unknown attacker tried to exploit the vulnerability against Alpine Linux on October 20 and 21, 2026, but the attempts failed. CVE-2026-76418 is a NULL pointer dereference vulnerability affecting Cisco Secure Firewall ASA and FTD Software. It could allow an unauthenticated remote attacker to force a device to reload, causing a denial-of-service (DoS) condition. Cisco said it became aware of active exploitation earlier this month. The company has not disclosed who is behind the attacks, how many organizations have been targeted, or what attackers may have done after gaining access. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the two vulnerabilities by November 1st, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to a DevOps engineer’s compromised laptop. Billions had moved out of wallets linked to the exchange. According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet. “Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.” Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion. Those figures came from blockchain tracking and differing estimates, so they didn’t necessarily show the amount stolen. Binance pointed out that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered. The company said its user funds were “completely safe.” “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact. “Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Binance Co-CEO Richard Teng explained. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.” I want to speak to you directly about what happened. Bottom line – your money is safe, and we're covering every loss. Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a… — Richard Teng (@_RichardTeng) October 30, 2026 Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys. Binance also said it had found “additional points of breach” and was still investigating. Co-CEO Richard Teng said the investigation had not identified anyone responsible. After the attack, Binance suspended deposits and withdrawals to carry out security checks, cancelled the permissions linked to the affected address, and began working with blockchain analysis firms and law enforcement to track the stolen funds. Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe. The company also plans to publish an updated Proof of Reserves once it has completed the recovery work. This commitment does not replace a detailed technical explanation or independent confirmation of the full impact of the attack. Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It attributes the attack to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis says it’s highly confident in that finding. Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. https://t.co/xj9dQYcbKr — Chainalysis (@chainalysis) October 30, 2026 TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. “On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.” Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach. The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t. Hot wallets help explain how this type of theft can happen. They store cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals quickly. But this also makes strong security controls essential. Investigators still need to determine who initiated the transfers, whether they were authorized, whether attackers gained control of the wallets, and whose funds were stolen. Binance co-founder Changpeng Zhao, who no longer runs the company, said the activity looked like a hack and expected customers to be fully compensated. Large transfers alone do not prove a cyberattack, but the findings that emerged later provided strong evidence of a breach. Customers also need to be careful. Attackers often exploit the confusion after a major incident by spreading fake announcements, pretending to be support staff, and directing users to fraudulent websites. Use only Binance’s official channels, avoid unexpected links, and never share passwords, authentication codes, or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to pressure employees into verifying their accounts. The lesson goes beyond Binance. A public blockchain records every transaction, but it cannot show who authorized it or how attackers gained access. Blockchain transparency does not guarantee operational security. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Binance)
Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates. The Always On VPN remote access solution runs in the background and establishes secure tunnels back to the user's corporate network when their devices connect to the Internet. It has replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices running Windows 10, Windows 11, and Windows Server. Microsoft has previously mistakenly flagged this known issue as fixed in the October 2026 Windows 11 cumulative updates. The company first acknowledged it in a service alert sent to IT administrators in late September, saying the Always On VPN failures were triggered on Windows 11 systems by the September 2026 security updates when using automatic protocol selection with IKEv2 and SSTP.
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise
Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity. Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while Tether and Circle moved to freeze stablecoins linked to the suspicious activity. The full scope of the incident remains unclear, and the reported outflows shouldn’t automatically be treated as confirmed losses. According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet. “Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.” The Block reports. “Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.” Coinbase executive Conor Grogan estimated that the total value of the movements could reach $5.8 billion. I think the number is potentially up to $5.8B. Tether has blacklisted a large portion of this. https://t.co/ANz2DiXc8S pic.twitter.com/BfscU7ENSo — Conor (@jconorgrogan) October 29, 2026 These figures come from blockchain tracking and different estimates, so they don’t necessarily represent the amount stolen. BREAKING: The Binance hack has grown to about $5.6B drained across Ethereum, Bitcoin and Tron, on-chain trackers say. If confirmed, it would be the biggest crypto heist on record. Tether and Circle have frozen about $1.8B in stablecoins, and Circle says it acted "in… https://t.co/UzgOxw9jLE pic.twitter.com/9fBEaaZrWj — International Cyber Digest (@IntCyberDigest) October 29, 2026 Binance acknowledged the reports and said its security team was investigating. The company had not publicly confirmed a breach in the initial reports, making it important to distinguish between suspicious transactions and a verified compromise. “We are aware of reports of a potential security issue and we are actively investigating.” He wrote in a post on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” We are aware of reports of a potential security issue and we are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should… — Yi He (@heyibinance) October 29, 2026 This statement, reported by The Block, reflects the company’s position at the time. Binance also urged users to be cautious of unofficial messages and links, a relevant warning whenever a major security incident attracts public attention. Blockchain records showed large transfers from Binance-linked hot wallets to a wallet that wasn’t previously identified as belonging to the exchange. Hot wallets hold cryptocurrency in systems connected to the internet, allowing exchanges to process withdrawals and other transactions quickly. Their online availability also makes their security controls particularly important. The transfers involved Ethereum, stablecoins and other cryptocurrencies. Some funds were later moved to additional wallets, making it harder to track all the transactions. Investigators must determine who initiated the transfers, whether they were authorized and whether an attacker gained control of the wallets. They also need to establish whether the funds belonged to customers or Binance itself. Large transfers alone don’t prove a hack. However, unusual movements involving large amounts of cryptocurrency require immediate investigation. One of the most significant developments was the response from the companies behind two major stablecoins, USDT and USDC. According to The Block and Forbes, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. The figures subsequently changed as the investigation developed. Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT linked to a potential Binance exchange hack. These amounts reflect reported actions at different points in time and shouldn’t be combined without checking whether they refer to distinct assets and addresses. Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone. — Paolo Ardoino (@paoloardoino) October 29, 2026 The freezes demonstrate an important feature of centralized stablecoins: their issuers can restrict transfers from addresses they control through their token contracts. This can help contain suspected theft, but it doesn’t provide the same control over assets such as Ether or Bitcoin. Nor does freezing a balance guarantee that every transferred asset can be recovered. The incident also highlights a practical tension in crypto security. Stablecoins offer the convenience of blockchain transfers, but their centralized issuers retain powers that can make a difference during an investigation. Binance maintained that customer funds were safe, while co-founder Changpeng Zhao, widely known as CZ, said the activity appeared to be a hack. Zhao no longer manages Binance’s platform, but said he expected customers’ funds to be fully covered. The company said its user funds were “completely safe.” “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” the company states. “Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” That assurance is important, but it doesn’t replace a technical explanation of how the transfers occurred or independent confirmation of the final impact. A security investigation must establish more than whether an exchange can cover a potential loss. It should determine how the activity was authorized, whether credentials or signing mechanisms were compromised, which systems were involved and whether the attacker retained any access. For customers, the immediate priority is to avoid becoming a secondary victim. Attackers often exploit uncertainty around a major incident to distribute fake announcements, impersonate support staff and direct users to fraudulent websites. Users should rely on official Binance communication channels, avoid unexpected links and never disclose passwords, authentication codes or wallet recovery phrases in response to unsolicited messages. Security teams should also watch for phishing emails that use the incident to demand urgent account verification. Attackers may exploit the situation to launch a separate scam. The key lesson is that blockchain transparency does not guarantee operational security. Public ledgers show transactions, but they don’t reveal who authorized them, how attackers may have gained access or whether an exchange’s internal security controls failed. As the investigation continues, it’s important to distinguish between reported transfers, confirmed theft and funds that can be recovered. The figures may change as analysts trace more wallets and stablecoin issuers take further action. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Binance)
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in. According to its announcement, Amadeus notified the airline on October 23, 2026, that unauthorized access to its systems occurred between August 10, 2023, and September 23, 2026. As a result of this lengthy breach, the threat actor accessed reservation codes (PNRs), names, flight dates, routes, and travel classes for approximately 90,000 customers. An additional 2,000 customers had the above data types exposed, plus their email addresses, phone numbers, passport numbers, nationalities, frequent flyer numbers, and flight, ticket, and seat numbers.
Confirm this action.
Leaving now will discard your changes.