Cyber News: Week Ending October 30, 2026

This week the money moved, and it moved fast. A hacker walked out of Binance with roughly $6.3 billion dollars in the largest crypto theft on record, and within hours the phishing sites and fake support calls appeared. Alongside that, attackers spent the week impersonating IT departments inside Microsoft Teams, exploiting a flaw in the language that runs much of the web, and hiding malicious code on nearly a thousand online stores. If there is a single lesson from the last seven days, it is that attackers keep choosing the path of least resistance: the tool you already trust. Here is what happened, why it matters, and what you need to do about it.

1. Binance Lost $6.3 Billion Dollars and the Scams Started Within Hours

Attackers moved approximately $6.3 billion dollars out of Binance wallets across ten blockchains on October 29, the largest cryptocurrency theft ever recorded. The exchange froze withdrawals, and stablecoin issuers moved to freeze a large share of the funds. Reporting indicates the intrusion began with a compromised employee laptop rather than a flaw in the exchange's own code. One research group has attributed the theft to North Korean operators.

The theft is the headline. The follow-on fraud is what will reach your customers and your staff. Within hours of the news, fake Binance support accounts began contacting users offering to restore balances, refund portals appeared asking people to log in or connect a wallet, and text messages promised withdrawals were open again with a link and a countdown clock. Every one of those is a credential harvest.

BET-R Actions:

Tell your staff and your customers one rule this week: no legitimate company contacts you first about a breach. Not your bank, not an exchange, not a vendor. Any message that creates urgency about a hack, a frozen account, or a refund is hostile until proven otherwise. If someone you employ holds crypto for the business, check the wallet permissions today and move anything long term into cold storage. And if you take crypto payments, expect fake invoice and fake refund messages aimed at your accounting contact for the next several weeks.

2. Someone Pretending to Be Your IT Department Is Now the Fastest Route to Ransomware

Researchers documented more than 400 incidents in which attackers messaged employees through Microsoft Teams while posing as internal IT support, using names like IT Support or HelpDesk Supervisor. About a third came from throwaway Microsoft domains dressed up to look official. The sequence is consistent: a burst of junk email to create alarm, then a chat offering to help, then a phone call that walks the employee into installing remote access software. From there the attacker escalates to domain controllers and deploys Chaos ransomware.

Nothing technical fails in this attack. There is no exploit and no malware in the first message. There is a calm, helpful voice asking an employee to click one thing, and most security tools have nothing to alert on until it is too late.

BET-R Actions:

Restrict external chat so people outside your organization cannot message staff in Teams by default, then allow only the partners you actually work with. Give your team one rule they can follow under pressure: IT never calls and asks you to install remote software. Hang up and call the number on the intranet. On the detection side, watch for remote access tools appearing on machines with no support ticket behind them, because that is the moment where intervention still helps.

3. A Flaw in PHP Is Now Being Used Against Firewalls and Websites Alike

The PHP vulnerabilities disclosed on October 21 are now confirmed as exploited in the wild. Palo Alto Networks reported attacks against the management interfaces of its next generation firewalls, and researchers linked the flaws to a campaign that escalated to root on 25 servers in the US, Japan, Taiwan, and South Korea before moving into Active Directory. Because the bug lives in PHP itself rather than in any one vendor's code, it reaches a very long list of products that quietly embed PHP.

For most small businesses the relevant attack surface is not a firewall. It is the website, the intranet, the old ticketing tool, and the plugin nobody has updated since it was installed.

BET-R Actions:

Find out what version of PHP your website and any internal tools run. If you cannot answer that in the next ten minutes, that gap is the real finding. Ask your host for the runtime version in writing, update to the current supported release, and confirm the change actually took effect rather than trusting a control panel. A web application firewall rule slows this down but does not fix it, because the flaw is in the language interpreter.

4. Nearly a Thousand Online Stores Are Serving Hidden Malicious Code

Researchers found 953 online stores, most running Magento, injecting hidden scripts into their pages since July 2025. The code fingerprints each visitor first, so automated scanners see a clean page while real shoppers get the payload. One store was compromised despite being fully patched, through a rogue administrator account created by the attacker.

This is a small business problem specifically. Online stores carry payment flows, customer records, and enough traffic to be worth attacking, and many run on the same handful of platforms with a long tail of unmaintained extensions.

BET-R Actions:

Review the administrator accounts on your store today and remove any you do not recognize, then confirm who has access and whether two factor is required. Ask your developer when the store software and its extensions were last updated, not just whether the version is supported. If you sell online, treat unexplained changes to page content as a security event rather than a cosmetic issue.

5. A Critical Linux Flaw Ships With No Fix From Ubuntu or Red Hat

A use after free vulnerability in the Linux kernel's handling of TCP connections is rated 9.8 by the kernel team, while distributions argue for a lower score. A remote, unauthenticated attacker can read freed memory. A working exploit achieved address randomization bypass and root on a test listener in under an hour. Debian, Oracle, SUSE, and Amazon Linux have shipped fixes.

Ubuntu and Red Hat have not. Both consider the flaw serious but have not produced a patch that meets their quality bar, which means a large share of the servers running small business websites, email gateways, and internal tooling remain exposed with no vendor fix available.

BET-R Actions:

Ask whoever runs your servers which distribution and version they are on. If the answer is Ubuntu or Red Hat, treat this as an open item you track weekly until a patch lands. Reduce exposure in the meantime by removing multipath TCP from public services and restricting which ports are reachable from the internet. This is also a useful moment to confirm you can answer the question at all, because an accurate server inventory is the foundation for every other security decision.

Recent Incidents This Week

Cisco ASA and FTD VPN flaw: A high severity logic error in the SSL VPN service lets an unauthenticated attacker send a crafted request that reloads the firewall, dropping every VPN session. It was added to the federal must fix list within a day of disclosure.

What this means for you: If your team connects through a Cisco VPN, that device needs the update this week. Unexplained reloads during business hours deserve a second look rather than a shrug.

GitLab rated 10.0 and added to the must fix list: An integer overflow in GitLab's bundled regular expression engine allows remote code execution through a crafted CI/CD configuration. Alpine Linux disclosed attackers probing its server before the fix and rebuilt the entire instance from scratch out of caution.

What this means for you: If you host GitLab yourself, patch it and then review recent pipeline configurations for anything you do not recognize.

Tailscale SSH privilege escalation: Tailscale released 1.104.4 to close four issues, the worst allowing a device already on your private network to obtain administrative control of another machine without any stolen password.

What this means for you: Private networks are not automatically safe networks. Update the client everywhere, then remove devices nobody recognizes from the network.

Dahua cameras and recorders hijacked: Authorities warned that attackers remotely accessed Dahua surveillance equipment, watched live video, changed settings, and created their own accounts. Device serial numbers follow a predictable pattern, making them practical to find.

What this means for you: Cameras are computers inside your network. Change the default password, update the firmware, and turn off cloud peer to peer features you do not use.

Oracle PeopleSoft chain behind ShinyHunters attacks: Researchers broke down the flaw used against universities and then a wider set of victims into three chained issues. In later attacks, a firewall rule blocking the vulnerable path was bypassed by encoding a single character in the URL.

What this means for you: Blocking a path is not patching a flaw. Anything standing between an attacker and code execution needs the vendor fix behind it.

How Individuals and Small Businesses Can Respond

Write down what you run: Software, services, and hardware, including the pieces nobody thinks about: the website platform, the chat tool, the VPN, the camera system. You cannot protect a list you have never made, and this week half the stories required knowing a version number.

Patch internet facing systems within 48 hours: Anything a stranger can reach from the internet gets critical updates within two days. Internal systems can follow your normal change process, but that process needs a deadline attached to it or it becomes a permanent excuse.

Assume the helpful message is an attack: No one installs software, shares a code, or approves a login because someone asked in a chat or on a call. Verify through a channel you already trust, and make sure your team knows they will not be in trouble for hanging up.

Turn on multi factor authentication everywhere: Email, remote access, cloud storage, banking, and the admin account on your website. It removes the easiest path attackers use once they have a password, and this week alone it would have blunted several of the campaigns above.

Audit admin accounts quarterly: Former employees, old contractors, shared logins, forgotten administrator accounts on the website or the store. The most common finding in a small business review is access that should have been removed a year ago.

Test one restore before you need it: Pick one file and one system this month and prove you can bring them back. Backups that have never been tested are a hope, not a recovery plan.

Write the first hour down on one page: Who to call, how to cut off access, how to reach customers, and who talks to your lawyer and insurer. One accurate page that someone has actually read beats a binder on a shelf.