IT Security News Roundup: 2026-10-30 Overnight

IT Security News: Overnight roundup, 2026-10-30

Summary

Binance dominated the overnight window. Reports put the suspected theft at $5.7 to $6.3 billion, with billions frozen and one account blaming a compromised engineer's laptop, though the exchange has not confirmed a total. Around that, the PHP2Shell and Brotli bugs kept turning up in real attacks, and AI tooling appeared on both sides: poisoned Hugging Face models, repositories targeting AI coding assistants, unpatched flaws in AI developer tools, and AI-assisted crime and espionage. Leaks and third-party breaches, from DHS staff records to Japan Airlines passenger data, show that exposure often comes through someone else's systems.

1. The Register notes the irony that crypto exchange security is still weak. Binance froze assets after a compromised engineer's laptop reportedly led to $6.3 billion of bad trades.
2. The SANS Internet Storm Center published its daily Stormcast podcast for October 30. The post has no text preview, so details are only in the episode.
3. Binance suspended deposits and withdrawals while investigating a suspected breach. Reports say about $5.7 billion left linked wallets, but Binance has not confirmed the total or that every flagged transfer is its own.
4. Risky Bulletin covers the Binance theft, PHP2Shell bugs being used against Palo Alto Networks firewalls, and Brotli exploitation. It also reports a wiper attack by Belarusian state hackers and a leak of 41,000 DHS employees' data.
5. Binance is investigating a suspected $5.8 billion theft, with about $3 billion frozen. The exchange says user funds are safe while investigators trace where the money went.
6. Researchers found attackers chaining the PHP2Shell vulnerability to gain root on 25 servers, including some tied to US government organizations. It shows how quickly a fresh flaw becomes a real intrusion.
7. Moldova took more than 80 public services offline after a cyberattack. The bulletin also covers a new White House cybersecurity pilot, a South Korean arrest of an AI-assisted cybercrime ring, and an Electrum wallet fix for a crypto-stealing bug.
8. The SANS Internet Storm Center Stormcast for October 29 is a daily podcast episode. The post carries no text preview.
9. Risky Business hosts discuss research suggesting Chinese open-weight AI models can be retrained to drop pro-CCP bias. They also cover the near-misses from the PHP and Brotli bugs and note that CISA's 2030 strategy barely mentions AI.
10. Bluesky blocked links to a leaked archive covering 41,000 ICE, CBP and other DHS workers. It told WIRED the archive contains contact details shared without the people's authorization.
11. The SANS Internet Storm Center Stormcast for October 28 is a daily podcast episode. The post carries no text preview.
12. JFrog found 42 GitHub repositories compromised with payloads up to 13.7MB, big enough to evade GitHub search and API detection. The repositories held hooks for AI coding assistants and IDEs, and the campaign links to malicious npm packages.
13. Japan Airlines said a breach at Amadeus's Passenger Service System exposed data on about 92,000 customers. Another reminder that a vendor's weakness becomes the airline's incident.
14. This Smashing Security episode covers claims in a new book that Jared Kushner's iPhone was hacked twice, and security keys protected by absurdly small numbers. It also touches on the PHP flaw fallout and how online data endangers executives.
15. OpenAI said it will not cut usage limits for its $100, $200 and $500 ChatGPT Pro plans or Business Premium after backlash. Headlines say it is doubling Pro limits, and it also promised to keep Dots usage independent.
16. Officials seized the domain of Virtualine, a Russian-speaking bulletproof hosting provider. Researchers say it received almost one-fifth of illicit-attributed inflow tracked this year, making it a significant disruption.
17. BleepingComputer reports Binance is investigating a possible breach involving up to $5.8 billion in digital assets. If confirmed, it could become the largest cryptocurrency hack in history.
18. A practical guide to transferring unused IPv4 addresses in the Asia Pacific region. It covers APNIC rules, buyer requirements, fees, approval steps and checks on address blocks before a deal.
19. A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors. One model was downloaded over 28,000 times. A fake Solana starter kit on GitHub also aims to trick AI coding agents into installing a NetSupport RAT.
20. Researchers found bugs in five AI developer tools, with flaws in OpenAI and Microsoft products still unpatched. Embedded browsers are at the heart of the problem.
21. Cloud security startup Upwind raised $400 million in a Series C at a $3.8 billion valuation. It turned down a Datadog acquisition offer at the same price.
22. An explainer comparing WireGuard, OpenVPN and Shadowsocks on speed, privacy, enterprise access and censorship resistance. It also clarifies how VPN tunnels differ from encrypted proxies.
23. Binance is probing suspicious transfers worth up to $5.8 billion from exchange-linked wallets on October 29. Tether and Circle froze $1.79 billion in stablecoins tied to the activity, limiting the attackers' ability to cash out.
24. A report says the VAPOR PANDA group uses an AI-driven tool called ARTEX to scale a global espionage campaign. The post has no text preview, so further details are not available.

Summaries written with AI (Claude by Anthropic) from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security
2. ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, (Fri, Oct 30th)
3. World’s Largest Crypto Exchange Binance Hacked, Over $5.7 Billion Reportedly Stolen
4. Billions stolen in Binance hack
5. Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen
6. Hackers Exploit PHP2Shell to Root 25 Servers – Including US Government Affiliates
7. Risky Bulletin: Moldovan public services crippled by cyberattack
8. ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156, (Thu, Oct 29th)
9. Srsly Risky Biz: Chinese AI can learn to love the West
10. Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
11. ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th)
12. Attackers compromised 42 GitHub repositories by using files too large to be searched
13. Japan Airlines suffers third-party data breach exposing passenger info
14. Smashing Security podcast #490: How Jared Kushner’s iPhone was allegedly hacked twice
15. OpenAI doubles ChatGPT Pro usage limits after backlash over planned 50% cut
16. Officials seize domain of top bulletproof hosting provider Virtualine
17. Binance probes potential $5.8 billion crypto-theft hack
18. Transferring Unused IPv4 Addresses in Asia Pacific: The Complete APNIC Playbook
19. Hugging Face malware campaign returns to hijack GPUs for crypto mining
20. Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched
21. Upwind raises $400M after walking away from Datadog acquisition offer
22. Next-gen privacy protocols: WireGuard vs OpenVPN vs Shadowsocks
23. Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion
24. VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign