Security news
The vulnerabilities and attacks that matter for websites, explained in plain words — with what to do about them.
CISA confirms PHP2Shell is exploited; US agencies must patch by 29 October
The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.
Ivanti Connect Secure: root flaw in exploited VPN chain now patched; CISA adds CVE-2026-111357 and CVE-2026-118527 to KEV
Ivanti has patched the last flaw in a zero-day chain used to get root on fully patched Connect Secure VPNs. The October fixes did not cover it; CISA listed it as exploited on 30 October.
Binance: $6.3 billion theft may have started on a DevOps engineer's compromised laptop
Binance now puts the 29 October theft at about $6.3 billion and says a compromised DevOps engineer's laptop may have let the attacker reach a service container and submit withdrawals. About $3 billion is frozen; the full cause is not yet confirmed.
Binance suspends withdrawals as billions drain from its hot wallets
Analysts estimate $3.3–5.9 billion left Binance hot wallets on 29 October. Binance says it is investigating and will cover all losses; the cause and the attacker are not confirmed.
CISA adds critical GitLab flaw CVE-2026-97229 to exploited list; upgrading GitLab alone may not be enough
CISA added the CVSS 10.0 GitLab CI/CD flaw CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October. Fixes exist since 12 October, but the bug sits in Ruby's regex engine, so self-built installs also need a fixed Ruby.
Patch GitLab again: 19.5.3 removes trust in compromised eMudhra CA certificates (CVE-2026-111943)
A week after its 21 October critical patch, GitLab released 19.5.3 and six other versions on 29 October. They stop trusting eight eMudhra intermediate CA certificates whose private keys were compromised. Runner and AI Gateway need separate updates.
EMBRACE: built-in browsers in Cursor, VS Code, Codex, Copilot and Claude Desktop could run code, leak files or spoof URLs
Forever Security disclosed EMBRACE on 29 October: flaws in the embedded browsers of five AI coding tools. Cursor allowed code execution and has been fixed; file-read flaws in VS Code and Codex are, per the researchers, still unpatched.
Tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor on developer machines
For about 11 hours on 29 October, Cursor's extension marketplace served a modified Claude Code extension that adds an attacker SSH key and persistence. Updating or uninstalling does not remove the backdoor.
China-linked hackers used VMware ESX logging flaw CVE-2026-41709 as a zero-day to hide their actions; CISA lists it as exploited
CrowdStrike says the Warp Panda group exploited an ESXi logging bypass as a zero-day, as late as early 2026. Broadcom fixed it in July; CISA added it to its exploited list on 28 October 2026. Update ESX hosts and do not rely on ESXi logs alone.
WordPress 7.1.4 fixes an update-process flaw that can lead to code execution; attackers started probing within hours
WordPress 7.1.4 (28 October) fixes a race condition in the core update process affecting 4.7–7.1.3. Wordfence blocked tens of thousands of attempts in the first day; no successful compromises have been reported. Update, and block web access to wp-content/upgrade/.
Exploit attempts seen against Oracle E-Business Suite RCE flaw
A honeypot operator reports exploratory attacks on CVE-2026-101767. There is no confirmed breach yet, but internet-facing EBS should be patched first.
JPCERT/CC warns of a wave of data-stealing intrusions at Japanese organisations
Since September, attackers have leaked personal data by scanning for known flaws, abusing hidden APIs found in mobile apps, and exploiting a Metabase SQL injection.
SiteGuard Server Edition WAF flaw exploited to run commands as root
An OS command injection in the widely used Japanese web application firewall is being exploited. It is on by default; collect diagnostics before you upgrade.
Microsoft October 2026 Patch Tuesday: 1,411 fixes and three zero-days
A record-size monthly update includes vulnerabilities already exploited in the wild, among them a Windows Shell security feature bypass.