Binance Crypto Heist, Cisco Firewall Exploit, Tailscale Patches Vulnerabilities

This week’s stories were dominated by a record cryptocurrency theft, actively exploited firewall flaws, a string of data breaches, and new AI-assisted attack methods.

Binance hit by record $6.3 billion crypto heist

Blockchain intelligence firm TRM Labs estimated that about $6.36 billion was moved out of Binance wallets, most of it within roughly 20 minutes, which would make it the largest crypto theft on record. TRM attributed the attack with high confidence to TraderTraitor, the North Korean group linked to the 2025 Bybit theft.

Binance said it worked with blockchain partners to freeze affected assets, roughly $3 billion of them, and that it would cover the losses. The Nextgov report notes the FBI had not publicly attributed the attack at that point, though a Help Net Security headline says the bureau later did. Sources: Nextgov and AP via Hawaii News Now. nextgovwdbo

Cisco firewall zero-day actively exploited to crash VPNs

The vulnerability, tracked as CVE-2026-76418, has a CVSS severity score of 8.6 and affects the Remote Access SSL VPN functionality in Cisco’s Adaptive Security Appliance and Threat Defense firewalls. Attackers are using it to remotely crash vulnerable devices, and Cisco has released patches. CISA added the flaw, along with a critical GitLab remote code execution bug, to its Known Exploited Vulnerabilities catalog on October 29, with a November 1 deadline for federal agencies. Source: BleepingComputer. techzinedailysecurityreview

Tailscale patches “Tailworm” SSH flaws after early disclosure

Tailscale rushed out a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released. Researchers’ findings covered privilege escalation and access-control issues, and Tailscale released version 1.104.4 on October 27 with fixes for the confirmed problems. Source: SecurityWeek and UnoSecur. securityweekgbhackers

Denver health plan members’ data at risk after leaked access key

A leaked SquareML access key could have been used to access a database containing personal and health information. The exposure could put the data of about 238,000 Denver Health Plan members at risk. Source: SecurityWeek. securityweek

Japan Airlines warns of third-party breach affecting 90,000 passengers

Japan Airlines warned on October 28 that a breach at a third-party IT provider affected approximately 90,000 passengers. The week’s reports suggest third-party systems and identity-rich datasets remain attractive targets. Source: Senthorus Cybersecurity Week in Review. senthorus

Warp discloses breach exposing AI agent logs

BleepingComputer reported on October 27 that Warp disclosed a breach exposing AI agent logs and telemetry. Developers using AI coding agents should review what data those tools log and store. Source: UnoSecur. unosecur

Attackers impersonate IT support over Microsoft Teams

Hackers are using Microsoft Teams messages and voice calls to impersonate IT support staff and persuade employees to approve remote access, then move deeper into networks. Staff should verify any IT request through a known internal channel and never approve remote access from an unexpected chat. Source: Cybersecurity News. cybersecuritynews

Organizations should strengthen email security by implementing DMARC, DKIM, and SPF to prevent phishing, email spoofing, and unauthorized access.

Free vulnerability database launched for ships and ports

SecurityWeek reported on October 27 that Cydome, ClassNK, Bureau Veritas, MTS-ISAC, and Rakuten Maritime launched Blue Initiative, a free public index of IT and OT vulnerabilities relevant to ships and ports. Source: Security Boulevard. securityboulevard

CISA releases free tools to find Microsoft 365 and Google Workspace misconfigurations

The U.S. Cybersecurity and Infrastructure Security Agency offers two free tools to detect security misconfigurations in Microsoft 365 and Google Workspace. These are useful for any organization checking its cloud email and collaboration settings. Source: Cybersecurity News. cybersecuritynews

Weekly recap: Linux DDoS botnet, device-code phishing and Android spyware

The Hacker News’s 2 November recap covers a range of threats, including a Linux DDoS botnet, device-code phishing, and Android spyware, alongside a long list of critical CVEs. Source: The Hacker News. dmarcreport

Chainalysis breached using agentic AI techniques

Blockchain analytics firm Chainalysis reported a breach that used what it described as “offensive agentic techniques.” This item is based on the headline only, so confirm details at the source. Source: Help Net Security.

Claude Code extension poisoned with SSH backdoor

Help Net Security reported on October 30 that a Claude Code extension was poisoned with a persistent SSH backdoor. This item is based on the headline only. Anyone who installed third-party extensions should check their system for unexpected SSH keys and review the extension’s source. Source: Help Net Security.

Critical Langflow flaws allow unauthenticated code execution

Two critical flaws in Langflow could let a remote attacker with no account bypass authentication or run arbitrary code, IBM said. Teams running Langflow should update immediately. Source: WIU Cybersecurity Center. wiu

Iran-aligned espionage campaign hits Israel and Iraqi Kurdistan

Researchers disclosed a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026, including a compromise of a government cloud environment. Source: WIU Cybersecurity Center. wiu

Second wave of refrigeration attacks hits European supermarkets

Help Net Security reported a second wave of cyberattacks targeting refrigeration systems at European supermarkets. This item is based on the headline only, so verify details at the source. Source: Help Net Security.

Former Assad-regime hacker sentenced to 42 months

Help Net Security reported that a hacker linked to the Assad regime, whose attack caused a $136 billion market drop, was sentenced to 42 months. This item is based on the headline only. Source: Help Net Security.