1. Binance freezes withdrawals as suspected crypto theft reaches billions
Withdrawals on multiple networks were temporarily suspended after Binance confirmed a security incident and reports of funds leaving its wallets. The exchange said customer funds were safe while it investigated. External estimates placed the potential loss between at least $2 billion and $5.7 billion, but Binance had not confirmed that the transfers were unauthorized. Tether and Circle froze more than $2.3 billion in assets associated with the incident.
What this means: Customers and counterparties face uncertainty while the exchange establishes whether the transfers were unauthorized. For leaders: the immediate risks include liquidity constraints, interrupted transactions, fraud attempts and lost confidence. For defenders: reconcile blockchain observations with internal wallet, access and authorization records before declaring a loss. Watch for changes to withdrawal status in official service notices and for unexplained wallet movement in internal transaction records. Also monitor customer-support queues for impersonation reports and recovery scams. The larger lesson is that uncertainty alone can create material operational and trust shocks.
Recommendation: Verify exposure through official channels, pause nonessential transfers and increase monitoring for impersonation scams.
2. Exposed PHP systems fall to attacks that can end in root access
Internet-facing PHP systems are being compromised through two critical weaknesses. Successful exploitation can give an unauthenticated attacker command execution on the server. Attackers have combined that foothold with a Linux weakness to gain root access and install webshells. Public management interfaces, including some PAN-OS deployments, were confirmed targets. Fixed releases are available and interrupt the observed chain.
What this means: Broad use of PHP makes incomplete inventories a major source of exposure. For leaders: ownership must span web, application, hosting, infrastructure and network teams. For defenders: patch affected PHP, Linux and appliance software, then investigate exposed systems for persistence. Watch for unfamiliar webshell files in web roots and unexpected privileged processes in server or endpoint logs. Repeated exploit requests in web logs are another signal, but failed attempts do not prove compromise. The larger lesson is that attackers combine separate weaknesses to turn a narrow foothold into durable control.
Recommendation: Patch affected systems immediately, remove management interfaces from the public internet and investigate previously exposed servers.
3. Hospital cyberattack diverts ambulances and cancels patient care
Patient care was interrupted after a cyberattack affected the University of New Mexico Health Sciences Center. Ambulances were diverted, appointments and outpatient surgeries were canceled, and medical classes were suspended. Critical systems and normal ambulance traffic were restored as services returned in phases. Containment limited the confirmed impact to some end-user devices and kept the intruder from core systems and servers. A ransomware group’s data-theft claims remained unverified.
What this means: The outage affected New Mexico’s only Level 1 trauma center and created an immediate regional care issue. For leaders: downtime plans must cover patient diversion, canceled care, public communication and support from neighboring providers. For defenders: preserve evidence during staged recovery and do not reconnect systems until they are trusted. Watch for unusual login activity in identity logs and unexpected outbound transfers in network monitoring. Also monitor help desks for phishing aimed at patients, staff or students. The larger lesson is that healthcare resilience is measured in safe continuity, not only data protection.
Recommendation: Rehearse clinical downtime, patient-diversion, communication and phased-restoration plans before the next outage.
4. Network controllers targeted for keys and long-term strategic access
Network controllers became a route to privileged access, persistence and key theft. Attackers exploited Cisco SD-WAN controllers and deployed malware inside legitimate control-plane processes. The KeyDrift framework intercepted decrypted traffic and collected material believed to protect data-plane communications. The campaign targeted space, satellite, defense, aerospace and policy organizations. Its infrastructure overlapped with a covert network used by Volt Typhoon, but the operators were not confirmed to be the same group.
What this means: A controller compromise can affect traffic and configuration across an entire environment. For leaders: control-plane systems are strategic assets that require the same scrutiny as identity infrastructure. For defenders: apply the vendor’s patches and hardening guidance, then investigate for established persistence. Watch for rogue peers and altered startup scripts in controller configurations and system records. Unexplained access to key material or injected controller processes should also appear in process and security telemetry. The larger lesson is that management platforms offer attackers broad and quiet control.
Recommendation: Patch and harden affected controllers, then investigate them for rogue peers, altered scripts and unexplained key access.
5. Shared Brotli library puts cloud and enterprise apps at risk
A critical weakness in the Brotli compression library reaches cloud runtimes, development stacks and enterprise products. Crafted compressed input can corrupt memory, expose process data, crash services or allow code execution without authentication. The affected component appears in technologies including Node.js, .NET, PowerShell, Envoy Proxy, Istio and Python packages. Public exploit code exists, and malicious traffic has been observed. Product-specific fixes and actions were still rolling out during the week.
What this means: Embedded library copies mean a simple server inventory may miss affected applications and containers. For leaders: dependency ownership and redeployment capacity will determine how quickly the risk can be reduced. For defenders: identify applications that decode attacker-controlled Brotli data, update affected components and redeploy self-contained workloads. Watch for unusual decoder crashes in application logs and unexpected process behavior in runtime or endpoint telemetry. Repeated compressed requests at exposed services may offer another signal in proxy and web logs. The larger lesson is that one shared library can create the same risk across many operating models.
Recommendation: Map Brotli exposure, apply available fixes and rebuild, redeploy and restart affected applications and containers.
6. DHS personnel leak exposes identities and internal access clues
More than 40,000 Department of Homeland Security personnel records were published online. The dataset exposed names, roles, work contacts, office locations and details tied to internal access. It included large numbers of border, immigration, cybersecurity and senior personnel. A hacker claimed the records came from an Okta single sign-on environment, but Okta found no evidence that its systems were compromised.
What this means: Work information can support targeted phishing, impersonation, harassment and intelligence gathering when combined with roles and group memberships. For leaders: identity data should be treated as sensitive operational information rather than a basic directory. For defenders: review access logs, privileged accounts and group memberships while the entry path remains unclear. Watch for unusual authentication attempts in identity logs and targeted messages reported by exposed personnel. Changes to high-risk group memberships should also be visible in directory audit records. The larger lesson is that identity platforms concentrate both access and organizational intelligence.
Recommendation: Prioritize monitoring and protective outreach for exposed personnel with privileged, investigative or public-facing roles.
7. Cloud desktop breach puts trading accounts and customer data at risk
Customers of GMO Internet’s cloud desktop service faced possible data theft and unauthorized trading activity. The company shut down the service after discovering unauthorized access. Information linked to customers and the business later appeared online. GMO warned that 26,739 virtual desktop servers may have been affected. The attacker demanded about 8 billion yen, or roughly $50 million.
What this means: The hosted Windows desktops were used for foreign exchange trading, giving the incident direct financial consequences. For leaders: hosted desktops concentrate identity, endpoint and transaction risk in one service. For defenders: contain credentials, sessions, devices and trading accounts separately rather than relying on a password reset alone. Watch for unrecognized trades in account histories and active sessions in authentication records. Unexpected logins from new devices or locations may also appear in identity and service logs. The larger lesson is that delayed security improvements can turn technical debt into customer losses.
Recommendation: Reset trading credentials from clean devices, terminate active sessions and review affected accounts for unauthorized transactions.
8. Exposed key turns LiteLLM release into a software supply-chain attack
A poisoned LiteLLM release exposed users to credential theft and remote access. The attack began with a master key accidentally published in a public repository in May. The key was removed but not revoked, allowing it to remain useful. An attacker later used it to obtain a privileged GitHub token and compromise additional identities and systems. Version 1.107.0 received about 49,000 downloads before it was quarantined.
What this means: The malicious package could steal browser data, cloud credentials and keys for several AI providers. For leaders: deleting an exposed secret does not remove the access it provides. For defenders: systems that installed and ran the affected release should be treated as potentially compromised, with reachable credentials rotated. Watch for installation of version 1.107.0 in package and build records and for unusual repository activity in GitHub audit logs. Unexpected cloud or AI-service access may also appear in provider authentication records. The larger lesson is that secret rotation is a required containment step, not optional cleanup.
Recommendation: Investigate every system that ran version 1.107.0 and rotate all credentials the package could access.
9. Oracle business systems face attacks after critical fix arrives
Oracle E-Business Suite systems faced exploitation attempts shortly after an October security fix became available. The affected component can let an unauthenticated attacker run database queries and execute commands on the application host. Exposed records may include financial, payroll, human resources and procurement data. Internet scans identified 2,246 E-Business Suite web properties. Those scans could not determine which systems were vulnerable or patched.
What this means: Successful exploitation could expose or alter core business records and provide control of the application server. For leaders: this is a material finance, workforce and procurement risk rather than routine technical maintenance. For defenders: prioritize internet-facing systems, apply the update and investigate previously exposed servers. Watch for unusual database queries in application or database logs and unexpected commands in host telemetry. New files, processes or outbound connections may also indicate post-exploitation activity. The larger lesson is that enterprise applications attract attacks quickly once a viable path becomes known.
Recommendation: Patch affected Oracle E-Business Suite systems and investigate every instance that was internet-facing while unpatched.
10. Fake IT chats turn Microsoft Teams into a rapid malware path
Employees were flooded with email and then contacted through external Microsoft Teams chats by attackers posing as internal support staff. More than 400 incidents followed this recurring pattern. Targets were contacted in short windows, and malware sometimes ran in less than 15 minutes. The impostors commonly requested remote access through legitimate support tools. Roughly 15 percent of observed cases progressed beyond the initial stage.
What this means: The campaign abuses trusted collaboration features rather than a software defect. For leaders: open external chat and unclear support processes can create a direct route into the workforce. For defenders: allowlist trusted organizations, restrict remote-support tools and teach employees how legitimate assistance begins. Watch for unexpected external conversations in Teams ChatCreated events and unauthorized support software in endpoint telemetry. Email floods followed by new chats are another useful pattern across mail and collaboration logs. The larger lesson is that familiar business tools become dangerous when trust settings and support procedures are unclear.
Recommendation: Restrict external chats and remote-support tools, then require independent verification of unexpected support requests.
11. Volt Typhoon rebuilds covert attack paths in under two minutes
Critical infrastructure defenders faced a covert access network that could be rebuilt faster than traditional blocklists could respond. Volt Typhoon used rotating chains of compromised routers, connected devices and enterprise systems to hide its operations. Some relay chains were assembled in less than two minutes. Sessions averaged roughly four hours before the infrastructure was cleaned up. Hundreds of victims were notified across government, telecom, defense, education, technology and infrastructure sectors.
What this means: Constantly changing relay infrastructure makes blocking individual addresses an incomplete defense. For leaders: internet-facing management platforms deserve critical-asset governance rather than routine appliance treatment. For defenders: restrict administrative interfaces, patch quickly and retain centralized logs long enough to connect short-lived activity. Watch for brief administrative sessions in identity and management logs and unusual connections through edge devices in network telemetry. Repeated access from changing addresses may reveal the pattern even when no single address persists. The larger lesson is that durable defense must focus on access behavior and privileged control points.
Recommendation: Reduce management-system exposure and retain enough telemetry to detect short-lived administrative sessions across changing infrastructure.
12. Stolen GitHub tokens drain secrets from private repositories
An active campaign used stolen GitHub tokens to extract secrets from private repositories. More than 13,500 malicious branches were recovered across over 850 compromised accounts. The attacker planted workflows that encoded secrets and wrote them into run logs. Those logs were downloaded through GitHub’s application programming interface and quickly deleted. Private repositories and self-hosted runners were exposed.
What this means: The activity could reach production credentials and cloud roles without using an external collection server. For leaders: private code storage is not a security boundary when valid developer tokens are stolen. For defenders: hunt for the ci-sync branch and gheist user agent, then revoke tokens and rotate reachable secrets. Watch for deleted workflow runs in audit records and unfamiliar branches in repository histories. Unexpected access to cloud services may also appear in provider authentication logs after repository exposure. The larger lesson is that developer identities are privileged paths into cloud infrastructure.
Recommendation: Hunt for campaign indicators, revoke compromised tokens and rotate every secret reachable from affected repositories.
13. Third-party script breach drains funds and halts Polymarket trading
Polymarket temporarily halted trading after a compromised third-party service distributed cryptocurrency-draining JavaScript through its website. The malicious script used authenticated sessions to liquidate positions or transfer user assets. Approximately $2.5 million was traced through a suspected attacker wallet. Polymarket did not confirm the amount stolen or the number of affected users. Trading resumed about an hour after the suspension, and the company said affected traders would be reimbursed.
What this means: A trusted browser script can become a route into active customer sessions without compromising the platform’s core application. For leaders: third-party monitoring code belongs inside the organization’s security and financial-risk boundary. For defenders: inventory external scripts, minimize their privileges and maintain a tested removal process. Watch for unexpected script changes in integrity monitoring and unusual transactions in account or blockchain records. A rise in customer reports during the affected period may also appear in support queues. The larger lesson is that lightweight website dependencies can carry high-impact supply-chain risk.
Recommendation: Audit third-party browser scripts and maintain a tested process to disable them without taking the full service offline.
14. PeopleSoft attack chain turns trusted access into full compromise
A chained attack against Oracle PeopleSoft can turn an externally reachable integration feature into code execution on the server. The chain spans weaknesses in the Integration Gateway and Environment Management Hub. One weakness makes an attacker’s request appear to come from localhost and bypasses a trusted-client check. The chain has been associated with reported mass exploitation. Attackers may write a webshell or plant malicious data that executes after a service restart.
What this means: The attack undermines a control intended to reserve management functions for trusted systems. For leaders: patched applications still require review for earlier compromise when exploitation has already occurred. For defenders: apply Oracle’s fix and inspect affected systems for webshells, unauthorized files and altered environment metadata. Watch for unexpected files in web directories and suspicious metadata changes in application records. Unusual activity after a service restart may provide another signal in process and server logs. The larger lesson is that a seemingly limited trust bypass can unlock a much more serious attack chain.
Recommendation: Apply Oracle’s fix and inspect affected PeopleSoft systems for webshells, unauthorized files and altered environment metadata.
15. Older iPhones and iPads receive a fix for targeted attacks
Older Apple devices received protection against a security issue used in highly targeted attacks. Apple extended the fix through iOS and iPadOS 18.7.11 after initially addressing newer software. A maliciously crafted file could allow code execution on an affected device. Public details about the attacks and their targets remained limited.
What this means: The update covers older iPhone and iPad models that may still be used by employees and other high-risk individuals. For leaders: supported older devices require the same prompt patch enforcement as newer hardware. For defenders: identify eligible devices and verify installation instead of assuming automatic updates completed. Watch for outdated versions in mobile-device management reports and failed installations in update status records. Unexpected file-driven application crashes may also appear in device or support telemetry. The larger lesson is that targeted attack fixes can arrive in stages across device generations.
Recommendation: Identify eligible older Apple devices and verify that iOS or iPadOS 18.7.11 is installed.