VulnHub

Binance recently reported a staggering theft of $6.43 billion from its platform, attributing the breach to a complex scheme involving fake job interviews and the misuse of an altered Homebrew installation. Attackers targeted two of Binance's engineers through social engineering tactics disguised as recruitment efforts. This incident is significant as it illustrates the lengths to which cybercriminals will go to infiltrate a major cryptocurrency exchange. The theft not only impacts Binance but also raises concerns for users and investors in the cryptocurrency space about the security of their assets. As the largest exchange globally, the breach may have wider implications for trust and security in the entire crypto market.

Google has issued a warning about a new type of cyber attack known as LLMjacking, where attackers exploit enterprises' access to Large Language Models (LLMs) for fraudulent gain. These attackers typically acquire an API key through methods like phishing, source code leaks, or misconfigured environments. As a result, companies can face significant financial losses, with some reporting up to $1 million in additional cloud charges due to unauthorized use of AI services. This situation poses a serious risk to businesses relying on LLMs, highlighting the need for better security practices to protect sensitive access credentials. Companies must be vigilant and ensure their systems are properly configured to prevent such hijacking incidents.

On November 2, an attacker compromised the update system of cPGuard, a security tool for Linux servers, and deployed a malicious script to its users. This script created a backdoor on the affected servers, allowing the attacker to collect sensitive information, including password hashes. The company behind cPGuard, OPSSHIELD, confirmed that some of this stolen data has already been retrieved by the attacker. The breach specifically affects users running cPGuard version 5.88.25 and later. This incident raises concerns about the security of update channels and the potential for attackers to exploit trusted software to infiltrate systems.

BTCPay Server, a self-hosted cryptocurrency payment processor, has issued a warning after discovering that hackers have been stealing Bitcoin and Litecoin from hot wallets on servers running outdated software. The attacks specifically targeted versions of BTCPay Server up to and including 2.4.1, which was released on July 23, 2026. Users are strongly encouraged to update to the latest version to protect their assets. This incident highlights the ongoing risks associated with using older software versions, particularly in the cryptocurrency space where funds can be easily stolen. Users need to stay vigilant and ensure their systems are up-to-date to minimize the risk of similar attacks in the future.

Synology is warning users to update their DiskStation Manager (DSM) software after discovering that attackers are exploiting a vulnerability that was patched in December 2024. The company noted that these ransomware attacks specifically target older versions of the DSM software, allowing threat actors to encrypt files and demand ransom from users. This situation affects anyone using Synology NAS devices that have not yet updated their software, putting sensitive data at risk. Synology's call to action emphasizes the importance of keeping software up to date to prevent falling victim to these types of attacks. Users should take immediate steps to secure their devices to avoid potential data loss and financial extortion.

On November 2, 2023, supermarkets across Europe, including countries like Belgium, Sweden, and Estonia, experienced a wave of cyberattacks that targeted refrigeration systems. Attackers remotely altered the settings of refrigeration controls, causing fridges and freezers to warm up. While no chain reported extensive damage, several dozen stores were affected, leading to the disposal of chilled and frozen food and removal of items from shelves. This incident raises concerns about the security of critical infrastructure and how vulnerable it is to cyber threats. Danfoss, a Danish company that produces refrigeration controls, is involved in the investigation of these attacks, which could have broader implications for food safety and supply chains across the region.

A serious security vulnerability has been discovered in Siemens SIMATIC IoT2050 Advanced devices, identified as CVE-2026-58115, which has a maximum severity score of 10.0. This flaw allows unauthenticated remote attackers to exploit missing authentication for a critical function, potentially enabling them to execute arbitrary code on the affected devices. This is particularly concerning as it poses significant risks to organizations that rely on these devices for their Internet of Things (IoT) applications. Researchers from VulnCheck have reported that this vulnerability is currently being actively exploited, meaning that organizations using these devices need to take immediate action to protect their systems. The urgency of the situation calls for heightened awareness and prompt remediation efforts to mitigate potential attacks.

Researchers at Defused Cyber have identified a serious vulnerability in the CryptoPayment Gateway WordPress plugin, designated as CVE-2026-81648. This flaw has a maximum severity rating, scoring 10.0 on the CVSS scale. It allows unauthenticated users to delete arbitrary files from the server, which could lead to the exposure of sensitive wallet credentials. As a result, sites using this plugin are at risk, and immediate action is required to protect against potential exploitation. Users of the affected plugin need to ensure they apply necessary updates or implement workarounds to mitigate this risk.

Chinese hackers have exploited ARTEX, an open-source AI tool designed for penetration testing, to launch automated attacks on over 200 organizations across 14 countries. This widespread campaign has raised concerns about the potential for increased cyber threats as more attackers adopt advanced technologies for malicious purposes. The targeted organizations span various sectors, indicating a broad impact that could affect sensitive data and operational integrity. As ARTEX automates certain aspects of penetration testing, its misuse by malicious actors poses significant risks to cybersecurity, prompting a need for organizations to bolster their defenses. Companies should remain vigilant and consider enhancing their security measures in light of these developments.

This week saw a range of cybersecurity threats, including a Linux-based DDoS botnet that has been exploiting vulnerabilities to launch attacks. Researchers also reported on phishing scams that used fake support calls and trusted browser extensions to trick users into giving up sensitive information. Additionally, Android spyware was discovered that can surveil users without their knowledge. These incidents underscore the need for vigilance as attackers continue to find new ways to exploit small oversights, like leaving devices unprotected or clicking on seemingly harmless links. The implications of these attacks are significant, affecting both individual users and larger networks that could be compromised as a result.

BTCPay Server, a popular open-source cryptocurrency payment processor, has issued a warning about hackers stealing funds from hot wallets on older versions of its software. The maintainer emphasized that users must update to the latest version to protect their assets. Instances that haven't been updated are particularly vulnerable to these attacks, which could lead to significant financial losses for users. This alert serves as a reminder of the importance of keeping software up to date, especially in the rapidly evolving cryptocurrency space. Users who are still running outdated versions should take immediate action to secure their wallets and prevent unauthorized access.