October 30, 2026

What happened

Binance said a security incident on its platform affected about $6.3 billion worth of assets. [1]

Binance said nearly $3 billion of the affected assets had been frozen on-chain. [2]

Tether and Circle said they froze more than 1.567 billion USDT and 800 million USDC, respectively, in connection with the incident. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.

2. [2]

   The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.

3. [3]

   Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively.

Read the original article →

What happened

Binance halted trading, deposits, and withdrawals after reporting a security incident involving unauthorized withdrawal transactions and froze $2.5 billion in assets, later raising its estimate of funds at risk to $6.3 billion. [1] [2] [3]

Binance’s initial investigation suggests that a compromised DevOps engineer’s laptop enabled an attacker to access a service container and submit unauthorized withdrawal transactions. [2]

Why it matters

Binance said it found no evidence that wallet private keys were leaked and stated that user funds were safe; it also promised to cover customer losses. [3] [4] [5]

Known limitations

Binance had not explained how attackers accessed the engineer’s laptop, and the article says the available details did not rule out phishing or a supply-chain attack. [6] [7]

At the time described, Binance had not resumed trading and said it would disclose more information after determining what happened. [8] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Crypto exchange Binance has paused trading after discovering unknown parties cracked one of its workers’ laptops and used it to make massive trades Late on Thursday, US time, the company used its social media feeds to report “Our teams are aware of reports of a potential security issue and are actively investigating.” The exchange insisted “User funds are completely safe” and warned its customers “should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.” The company soon froze $2.5 billion worth of assets and warned that the figure could go higher “as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.” To prevent the matter worsening, Binance halted all trading, deposits, and withdrawals.

2. [2]

   “Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the post states.

3. [3]

   The company also hiked the amount it thinks is at risk to $6.3 billion and repeated its promise to cover any customer losses.

4. [4]

   It also promised to cover any losses.

5. [5]

   The update also says Binance found no evidence of any wallet private key leak, suggesting that customers’ holdings remain secure.

6. [6]

   Binance hasn’t explained how attackers gained access to the engineer’s laptop.

7. [7]

   The scant details provided make it hard to rule out a successful phishing attack, or perhaps a supply chain attack on a package the developer used.

8. [8]

   When they can use them again, as Binance is yet to resume trading.

9. [9]

   Binance says it will spill once it knows exactly what happened.

Read the original article →

What happened

Bitdefender’s 2026 IoT Security Landscape Report found that smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices. [1]

The analysis covered approximately 10.4 million protected home routers between January and September. [2]

Televisions represented 22.7% of vulnerability observations, while smart plugs represented 22.4% linked with a known software flaw. [3]

Why it matters

Household electronics can remain in use for five to ten years, according to the supplied article text. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report.

2. [2]

   The analysis covered approximately 10.4 million protected home routers between January and September.

3. [3]

   Televisions represented 22.7% of vulnerability observations, followed by smart plugs at 22.4% linked with a known software flaw.

4. [4]

   Top vulnerable device families (Source: Bitdefender) Household electronics can stay in use for five to ten years, while their … More → The post Smart TVs can harbor unpatched security flaws and track what you watch appeared first on Help Net Security .

Read the original article →

What happened

A retail scam used more than 1,200 look-alike .shop domains sharing one IP address. [1]

The sites reused HTML, JavaScript, and payment-page designs to harvest card numbers, expiry dates, and security codes, according to Akamai’s Fraud and Abuse Report 2026. [2]

A separate ticket scam used a similar setup, with websites impersonating official ticketing and hospitality portals for a major sporting event. [3] [4]

Why it matters

The impersonating sites were designed to route payment and personal information to the same collection system. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address.

2. [2]

   The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026.

3. [3]

   A ticket scam used a similar setup.

4. [4]

   Several websites impersonating official ticketing and hospitality portals for a major sporting event were designed to route payment and personal information to the same collection system.

Read the original article →

What happened

Gartner released a category for assessing security tools called the Integrated Security Operations Center (ISOC). [1]

The article says the threat landscape is driving a shift in industry logic, while SIEM remains an established category. [2] [3]

The source states that SIEMs are no longer sufficient for data collection, investigations, and incident management, and that SIEM architecture has separated into distinct areas; the sentence is truncated after that point. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Gartner recently released a new category of assessing security tools: the Integrated Security Operations Center (ISOC).

2. [2]

   Even though SIEM isn’t going anywhere, a rapidly evolving threat landscape is forcing a shift in industry logic that is reflected in the emergence of this new category.

3. [3]

   For years, SIEM has dominated as an all-encompassing category.

4. [4]

   But SIEMs are no longer sufficient to collect data, support investigations, and manage incidents; instead, the SIEM has separated into distinct architectural … More → The post What exactly is ISOC?

Read the original article →

What happened

A hacker leaked personal and work-contact data for more than 40,000 DHS employees, including names, job titles, email addresses, phone numbers and office locations; affected personnel include CBP, ICE, CISA and senior DHS officials. [1] [2] [3]

The data reportedly includes records from about one-fifth of DHS’s 220,000 employees, with approximately 21,000 CBP records, 10,000 ICE and Homeland Security Investigations records, and just under 1,000 CISA records. [4] [5] [6] [7]

The hacker claimed to have obtained the data from an Okta single sign-on system used by DHS agencies, which stores account access and internal-application records; the breach method was not disclosed. [8] [9] [10] [11] [12]

Why it matters

The records reportedly identify access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, and include personnel associated with undercover operations, investigations and deportation programs. [13] [14] [15]

Interpretation: Exposed contact details and organizational or access information could increase security and privacy risks and support more targeted investigations or information requests. [16] [17] [18] [19] [20]

Known limitations

DHS confirmed awareness of a potential breach and said it was investigating; DHS said it would provide further public updates when more information became available. [21] [22] [23] [24]

Okta said it had no evidence that its systems or data were compromised, leaving the reported source of the leaked information unresolved. [8] [25] [26]

TechCrunch verified some records and reported that the database appeared to have been copied around mid-August; the supplied evidence does not establish the full scope or authenticity of all records. [27] [28]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach.

2. [2]

   “The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.” TechCrunch reports .

3. [3]

   The incident impacted border and immigration agents, cybersecurity staff and senior department officials.

4. [4]

   More than half of the records, around 21,000, belong to U.S.

5. [5]

   Customs and Border Protection (CBP) employees working at airports and other ports of entry.

6. [6]

   Another 10,000 belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the cybersecurity agency CISA.

7. [7]

   The leak covers about one-fifth of DHS’s 220,000 employees.

8. [8]

   The hacker, who uses the name Department of Peace, claims to have stolen the data from an Okta single sign-on system.

9. [9]

   DHS uses this service to give employees and contractors across its agencies access to the department’s central network.

10. [10]

    The system also stores IT and login records for each account, showing which systems and internal apps each person can access.

11. [11]

    The malicious actor did not reveal how the U.S.

12. [12]

    agency was breached.

13. [13]

    DDoSecrets says the leaked database identifies officials involved in undercover operations and key DHS personnel overseeing renditions and deportations.

14. [14]

    DDoSecrets co-founder Emma Best said the database, called Icepick , identifies officials involved in covert operations, internal investigations and deportation programs.

15. [15]

    The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE.

16. [16]

    Crimew described the database as an unprecedented view of DHS’s organizational structure, helping researchers identify employees, their roles and reporting lines.

17. [17]

    They said it could also support investigations and future Freedom of Information Act (FOIA) requests.

18. [18]

    Ryan Shapiro of Property of the People added that employee contact details could help researchers submit more targeted FOIA requests.

19. [19]

    Researchers say the contact details could help journalists file targeted Freedom of Information Act requests.

20. [20]

    However, exposing employees’ phone numbers and office locations also creates security and privacy risks.

21. [21]

    DHS confirmed it is aware of a potential breach and is investigating, saying it takes threats to employees seriously and will provide updates when more information is available.

22. [22]

    “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively.

23. [23]

    We take all security threats against our employees and officers seriously and will work to ensure all are properly protected.

24. [24]

    We will update the public when more information is available,” a DHS spokesperson told SecurityWeek.

25. [25]

    DHS is investigating a potential breach.

26. [26]

    Okta says it has no evidence its systems or data were compromised.

27. [27]

    Journalist maia arson crimew shared the data with DDoSecrets.

28. [28]

    TechCrunch verified some records, which suggest the database was copied around mid-August.

Read the original article →

What happened

Cisco Talos Incident Response found across several engagements in the third quarter of 2026 that attackers posed as IT help-desk staff and contacted employees by phone, email, and Microsoft Teams to persuade them to open remote-access sessions. [1]

The attackers appeared to know employees’ names and email addresses and used direct email and Teams contact. [3]

Why it matters

In one reported case, the remote access obtained through this tactic ended in ransomware. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements.

2. [2]

   In one case, that access ended in ransomware.

3. [3]

   They knew names and email addresses “The attackers appeared to know employee names and email addresses, as they contacted users directly by email and Teams and used identities … More → The post Fake IT help desk callers got by on little more than names and email addresses appeared first on Help Net Security .

Read the original article →

What happened

Drupal warned that threat actors are exploiting a highly critical missing-authorization vulnerability in its Commerce Core component, tracked as CVE-2026-118539. [1] [2]

The affected Commerce Core versions are 0.0.0 through 2.41 and 3.0.0 through 3.3.13; the source lists the CVSS score as not available. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.

2. [2]

   The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

Read the original article →

What happened

About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. [1]

Binance said its initial investigation suggested that a compromised DevOps engineer’s laptop may have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. [2]

The company found no evidence that a wallet private key was leaked. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history.

2. [2]

   “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the exchange said in a security update published early on October 30.

3. [3]

   The company found no evidence of a wallet private key leak and plans … More → The post Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record appeared first on Help Net Security .

Read the original article →

What happened

Irregular evaluated Zhipu AI’s open-weight GLM-5.3 model across 13 offensive cyber scenarios using CyScenarioBench, a framework for measuring multistage attack planning and execution under realistic constraints. [1]

The model refused none of the tasks and completed three scenarios at least once, carrying attacks through dependent stages to objectives in simulated networks. [2]

Why it matters

Irregular described this as the strongest result it had recorded for an open-weight model. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Irregular evaluated Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench, the company’s framework for measuring an LLM’s ability to plan and execute multistage attacks under realistic constraints.

2. [2]

   The model refused none of the tasks and completed three scenarios at least once each, carrying attacks through dependent stages to reach objectives in simulated networks.

3. [3]

   Irregular said this was the strongest result it had recorded for an open-weight model.

Read the original article →

What happened

Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced by a U.S. federal court to 42 months in prison for participating in a hacking conspiracy targeting Western news outlets. [1] [2]

The conspiracy was organized and led by members of former Syrian President Bashar al-Assad’s inner circle, including the commander of Syria’s General Intelligence. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S.

2. [2]

   federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.

3. [3]

   The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence

Read the original article →

What happened

Phorion researchers found that a tampered Anthropic Claude Code extension build for VS Code-compatible editors planted an SSH backdoor on developers’ machines. [1]

The malicious package was version 2.1.313 and was found on Open VSX, an open-source VS Code extension marketplace operated by the Eclipse Foundation. [2]

Why it matters

The reported compromise involved a persistent SSH backdoor, indicating that affected developer machines could retain unauthorized access through SSH. [1]

Known limitations

No malicious version had been reported in Microsoft’s Visual Studio Marketplace, the default extension store for VS Code. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found.

2. [2]

   The company spotted the malicious package, version 2.1.313, on Open VSX, an open-source marketplace for VS Code extensions run by the Eclipse Foundation.

3. [3]

   VS Code’s default extension store is Microsoft’s Visual Studio Marketplace, where no malicious version has been reported.

Read the original article →

What happened

The source states that a critical alert has a known fix, but its ticket can remain queued for days. [1] [2] [3]

Why it matters

Application-availability teams want proof that a security change will not break anything before approving it. [4]

The source identifies practical concerns: IPS protection may block legitimate traffic, configuration changes may interrupt services, and endpoint policies may affect an application. [5] [6] [7] [8]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The alert is critical.

2. [2]

   The fix is known.

3. [3]

   And the ticket sits in a queue for days.

4. [4]

   Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.

5. [5]

   Their concerns are practical.

6. [6]

   An IPS protection could block legitimate traffic.

7. [7]

   A configuration change could interrupt a service.

8. [8]

   An endpoint policy could affect an application

Read the original article →

What happened

Bedrock Data announced AI-assisted remediation that assigns responsibility for fixing data exposure to data owners across an enterprise. [1]

The system identifies the owner of each exposed dataset, creates a Jira or ServiceNow ticket for that owner, and provides context needed for remediation. [2]

After an owner closes a ticket, Bedrock Data validates whether the exposure was remediated and reopens the ticket if it was not. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise.

2. [2]

   Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow workflow the enterprise already runs and supplies the context needed to fix it.

3. [3]

   When the owner closes the ticket, Bedrock Data validates that the exposure is remediated and reopens the ticket if it is not.

Read the original article →

What happened

Shufti launched Know Your Agent (KYA), described as an AI-agent verification solution for autonomous agents acting for individuals and businesses. [1]

The source describes agentic commerce scenarios in which AI agents can open accounts, place orders, and move funds for their owners. [2]

Why it matters

Businesses receiving requests from AI agents need to determine whether the agent is genuine, who is accountable for it, and whether the requested action is within the permissions approved by the owner. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses.

2. [2]

   Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners.

3. [3]

   A business receiving one of these requests needs to know whether the agent is genuine, who is accountable for it, and whether the action falls within what that person approved.

Read the original article →

What happened

A Syrian man who used a hijacked news-agency Twitter account to post a false report of explosions at the White House was sentenced to 42 months in prison, according to the U.S. Department of Justice. [1]

Ahmad Umar Agha, also known as “Th3Pr0,” was sentenced by a federal court in Virginia for his central role in a hacking conspiracy organized and led by members of the former Syrian regime. [2]

Why it matters

The source’s headline characterizes the incident as causing a $136 billion market drop, but the supplied excerpt does not provide details substantiating that characterization. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced.

2. [2]

   Ahmad Umar Agha, also known as “Th3Pr0”, was sentenced on Thursday by a federal court in the Eastern District of Virginia for his central role in a hacking conspiracy organized and led by members of former Syrian President … More → The post Assad regime hacker who caused $136 billion market drop sentenced to 42 months appeared first on Help Net Security .

Read the original article →

What happened

Ahmad Umar Agha was sentenced to 42 months in federal prison for a hacking conspiracy prosecutors said was organized by figures in Bashar Assad’s inner circle. [1] [2]

Prosecutors said Agha hacked approximately 47 media entities, businesses, nongovernmental organizations, and U.S. and allied government bodies between August 24, 2011, and January 31, 2024. [3] [4] [5] [6]

Why it matters

The reported motives included suppressing coverage of Syrian government atrocities, intimidating opponents, collecting intelligence, and encouraging U.S. military personnel to refuse orders. [7] [8]

In the most damaging reported intrusion, Agha accessed the Associated Press Twitter account and posted a false claim that President Barack Obama had been injured in White House explosions; the post briefly erased $136 billion in stock-market value. [9] [10] [11]

Agha also reportedly redirected about 3,500 visitors from the U.S. Marine Corps recruitment website to a message urging Marines to refuse their orders and fight alongside the Syrian Army. [12] [13]

Prosecutors said Agha stole White House staff email credentials on two occasions while attempting to seize control of White House social-media accounts, succeeding once. [14] [15]

Reported victim losses included a publisher-services company losing about $35,000 per day for roughly six months and a global nongovernmental organization spending about $250,000 on monitoring products, retraining more than 800 staff, and suffering $480,000 in total losses. [16] [17]

Known limitations

The account attributes the hacking and motive allegations to prosecutors and Justice Department officials; it does not provide technical details about the intrusions or independently establish the reported financial impacts. [1] [6] [10] [16]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison.

2. [2]

   The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate.

3. [3]

   Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug.

4. [4]

   31, 2024, according to the Justice Department.

5. [5]

   Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S.

6. [6]

   and allied government bodies, prosecutors said.

7. [7]

   The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S.

8. [8]

   military to refuse their orders.

9. [9]

   The most damaging intrusion came April 23, 2013.

10. [10]

    Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House.

11. [11]

    The post triggered a flash crash , briefly erasing $136 billion in value from the stock market.

12. [12]

    In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S.

13. [13]

    Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army.

14. [14]

    On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts.

15. [15]

    In one instance he succeeded, prosecutors said.

16. [16]

    The costs to victims were significant.

17. [17]

    A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses.

Read the original article →