IT Security News Roundup: 2026-10-29 Evening

IT Security News: Evening roundup, 2026-10-29

Summary

The evening was dominated by large-scale compromises and fast-moving exploitation. Binance and Polymarket both suffered crypto-related attacks, a WordPress core remote-code-execution flaw was being probed within hours of its patch, and a UEFI firmware bug and a Brotli decoder vulnerability put widely deployed infrastructure at risk. Data exposure ran through the news as well, from the Department of Homeland Security leak to the University of Copenhagen and Crime Stoppers breaches, while AI turned up both as a source of new liability and as a phishing and bug-report problem. For defenders, the common thread is shrinking time between disclosure and abuse, and growing difficulty in judging the true scope of an incident.

1. Dark Reading outlines how CISOs can limit personal and organizational exposure to AI liability: rigorous documentation, transparency about AI use, and careful contract negotiation with AI vendors.
2. Bank of America warned customers that they stay responsible for any activity carried out by AI agents given their banking credentials, a reminder that handing passwords to assistants shifts risk onto the user.
3. Sault Ste. Marie's police chief says it is still unclear how many anonymous Crime Stoppers tips were exposed in a large breach; local police services have paused their relationship with the chapter.
4. AWS published a bulletin on CVE-2026-111497, a flaw in the native Brotli decompression library that could allow code execution or memory reads. Lambda, Amplify, App Runner and other services are being fixed, and some require customer action.
5. Hacktivists from the "Department of Peace" group obtained data on more than 41,000 DHS employees, which was shared with journalist maia arson crimew and published online by DDoSecrets.
6. An explainer on usage-based billing separates ingestion, mediation, metering and rating, and asks whether these functions belong in the billing system or in a decoupled metering layer, which affects pricing flexibility.
7. The Pentagon is treating August freezer failures that spoiled food at US military bases as a suspected cyberattack, and is reportedly working with French investigators following a supermarket attack.
8. Dark Reading argues that SBOMs alone cannot show how far a supply chain attack reaches. Using a recent Shai-Hulud incident, it stresses the need for real-time visibility into production code and affected services.
9. Binance paused withdrawals during a cyberattack, with some estimates suggesting hackers stole billions in crypto from the world's largest exchange, which would make this one of the biggest crypto heists on record.
10. A Reporters' Notebook video recaps Cybersecurity Awareness Month themes, including using AI to improve training and preparing the next-generation workforce for modern risks and emerging threats.
11. Open-source maintainers are so swamped by AI-generated security reports that some have stopped accepting them. OpenAI's Daybreak lead says the answer is higher-quality findings and much more coordination.
12. Anthropic-themed phishing emails with numerous obvious red flags are still getting past some leading secure email gateways, showing the limits of current email filtering.
13. US authorities seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums and tied to ransomware and other illegal activity.
14. Ars Technica reports a critical flaw in the EDK2 UEFI firmware that lets attackers execute code early in the boot process, affecting most servers worldwide.
15. Cisco Talos details UAT-11473, a sophisticated APT that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to deploy its KeyDrift malware on affected systems.
16. Ukrainian national Artem Stryzhak was sentenced to 70 months in prison in Brooklyn for Hive and Nefilim ransomware extortion, while the FBI offers $11 million for an alleged co-conspirator.
17. WordPress 7.1.4 fixes 22 vulnerabilities, including an unauthenticated race condition in the core update process that allows remote code execution. Wordfence has already detected exploitation attempts, so sites should update immediately.
18. Anthropic's pre-IPO disclosures describe security risks including out-of-control AI, while acknowledging that profit considerations will also shape its decisions on those risks.
19. A wide-scale social engineering campaign, possibly tied to Black Basta, combines mail bombing with external Microsoft Teams chats to deliver malware within about 15 minutes.
20. Prediction market Polymarket halted trading after attackers compromised a third-party service to serve crypto-draining JavaScript; about $2.5 million has been traced to a suspected attacker wallet.
21. A cyberattack on the University of Copenhagen exposed data on 525,000 people, including access PINs for 20,000, raising identity theft and campus security concerns.
22. OffSec dissects two critical PHP remote-code-execution bugs, caused by out-of-memory corruption and stale worker state, and explains why the original exploit theory was wrong.
23. Europol, the European Labour Authority and 34 countries reported 27 arrests and 248 potential victims identified in an action week against human trafficking for labour exploitation in sectors like agriculture and hospitality.
24. CISA added a GitLab integer overflow vulnerability, CVE-2026-97229, to its Known Exploited Vulnerabilities catalog, requiring federal agencies to prioritize remediation under BOD 26-04.
25. A UK watchdog urged police forces and fire and rescue services to strengthen their cybersecurity, warning that rising cyber threats are outpacing current defenses.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. 3 Frameworks to Protect CISOs & Orgs Against AI Liability
2. Bank of America kindly asks that you don’t share your banking password with your AI assistant
3. Extent of Crime Stoppers data breach unknown: Sault Police chief
4. CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
5. Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
6. Usage Metering Explained: Ingestion vs. Mediation vs. Metering vs. Rating
7. US Probes Suspected Hack Behind Military Base Freezer Failures
8. SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
9. Binance pauses withdrawals as hackers suspected of stealing billions in crypto
10. Rethinking Cybersecurity Awareness in the AI Era
11. Before you file that AI bug report, OpenAI has some advice
12. Anthropic-Themed Phishing Emails Bypass Top Security Tools
13. Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
14. Code-execution flaw in UEFI firmware affects most servers on planet Earth
15. Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
16. Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail
17. WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
18. All the security risks Anthropic is worried about before its IPO
19. External Teams Chats Anchor 15-Minute Malware Delivery
20. Polymarket halts trading after crypto-draining script breach, $2.5M traced
21. University of Copenhagen Breach Hits 525,000, Exposes Access PINs for 20,000
22. php2shell: anatomy of two PHP lifecycle bugs
23. 27 arrests and 248 potential victims identified in action week against labour exploitation
24. CISA Adds One Known Exploited Vulnerability to Catalog
25. Watchdog Urges Police and Fire Service to Improve Cybersecurity