Read Time: 8 minutes

Brought to you by:

Howdy friends!

So they’re calling it Black October. It even has it’s own Wikipedia page. I don’t disagree things seem crazy right now, but as for cybersecurity’s worst month ever? I think that is recency bias and headline sensationalism. We found a bunch of vulns, they got fixed, not a lot of real world impact from them. PHP, eMudrha, LiteLLM, Node2Shell - the pile seems big but the impact is much smaller than many other high profile bugs we’ve seen in our careers.

Hard to stand out amongst the noise since it is en vogue to get on the cybersecurity doomer soapbox. A bit frustrating, but I get the fear since the AI megaphones backed by seemingly endless money have been screaming we should be scared for years. Now every headline seems like proof they’ve been right, and yet…

🎧 Something I heard: The Low Down - live from Las Vegas @ OneCon

🎤 Something I said: 32 Million vulnerable PHP Servers, why isn’t it all on fire?

🔖 Something I read: Jason’s thoughts about the talk, Building an Autonomous N-day Exploit Generation Pipeline

Thursday afternoon someone emptied Binance's biggest Ethereum hot wallet in a single transaction, then hit two more. BleepingComputer has the tracked haul anywhere from about $3.5 billion on Ethereum up to the $5.8 billion Arkham is watching across 55 wallets, though that bigger number counts everything those wallets now hold. Even the low end blows past Bybit's $1.5 billion as the largest crypto heist on record. Tether and Circle froze more than $2.3 billion in stablecoins within hours, and Binance has paused all deposits and withdrawals and says it will cover every loss.

The mechanism is …interesting. A wallet funded through Tornado Cash the day before deployed a contract, then used an Ethereum feature called EIP-7702 to point Binance's hot wallet at that contract, and four minutes later the wallet swept itself. That delegation only works with a signature from the hot wallet's own key, so the attacker had Binance's signing authority somehow, whether that's a stolen key or a compromise upstream of whatever signs for it. Binance hasn't said which and promises a full postmortem. (read more here and here)

An agent can use legitimate access to take a task further than you intended. It can also follow instructions it shouldn’t trust, including prompt injection and tampered skills.

On Tuesday, November 17 at 11 AM Eastern, join Origin security researcher Tyler Holmwood to trace how agents go off course. See what they were asked to do, which instructions they followed, and where they crossed a line. Leave with practical steps for reviewing agent access and using existing controls to limit the consequences.

Save your seat

*Sponsored

Polymarket froze trading for about an hour Thursday after a performance-monitoring script on its site turned into a wallet drainer. Researchers traced the malicious code to DebugBear, a UK vendor whose real-user monitoring snippet Polymarket embedded, and DebugBear has since told every RUM customer to pull its embed code. The script waited for a logged-in user, sized up their balances and positions, then sold positions or moved tokens straight to the attacker using the trading session the victim's browser already held. About $2.5 million landed in the attacker's wallet from hundreds of accounts, and Polymarket says everyone will be made whole.

This is the second time this year Polymarket users got drained through a vendor's JavaScript, after a nearly identical June incident that cost about $3 million. Every third-party script on a page that can move money runs with the user's full session, so analytics and monitoring snippets belong behind a strict content security policy, pinned to known file hashes, or off authenticated pages entirely. BleepingComputer also found DebugBear's own servers both delivered the payload and collected the results, which points to deep access inside the vendor. If you embed DebugBear anywhere, pull it now.(read more here and here)

This is a great article by Kim Zetter and the original over at Lumen. A fantastic look behind the curtain at a Chinese nation state threat actor and their MO. Black Lotus Labs came with the receipts. For three years they've tracked a framework they call Silent Train: one-time chains of hacked VPSes, SOHO routers, IoT junk and enterprise gear like Fortinet and Cisco, built in under two minutes, aimed at a single target, then wiped with every hop restored to how it looked before. Device types stay locked to overseas or domestic roles so no single vendor ever sees the full chain, and session times track a China Standard Time work week, Chinese New Year breaks included.

Silent Train went after organizations that sit in positions of trust: telecoms, MSPs, satellite and emergency comms providers, defense contractors, universities with military ties, and the utilities, rail and shipping that the military leans on too. Victims cluster in Hawaii, California and Texas, the states that carry US operations in the Indo-Pacific. That lines up with the long-running theory that Volt Typhoon is pre-positioning for a Taiwan conflict, though Black Lotus Labs' Mike Horka told Zetter he's also watching them steal military documents and long-lived credentials, so he reads it as both. It also explains the years of "trust us" from officials, since an actor this disciplined leaves almost nothing for anyone to find. If you run management or control-plane gear for anyone downstream, treat it like the crown jewels, keep it off the internet, and get its logs somewhere the attacker can't reach. (read more here and here)

PHP2Shell now has real victims. Dream Research recovered an attacker's whole kit: a custom PHP2Shell exploit chained with a Linux kernel privilege escalation, tuned for nine firmware versions from an unnamed large firewall vendor, plus the campaign logs. The attacker started with 19,000 internet-facing firewall management interfaces, filtered down to 240 in the US, Japan, Taiwan and South Korea, and rooted 24. Two belonged to a US government-affiliated org. Within hours the attacker had a persistent tunnel inside, owned the central firewall management server, and was enumerating and spraying Active Directory. Claude Code was installed on the attacker's box, along with an offensive tool wired to DeepSeek and Kimi.

Separately, public honeypot data logged 35 working shells on Oct 24, though on a deliberately favorable setup, and CISA added both CVEs to KEV on the 26th. Censys still counts about 30 million PHP services reporting an affected version. That's an upper bound because of distro backports, but most of that population is on 8.1 or older, which gets no fix at all. And evergreen advice is to of course get management interfaces off the internet. (read more here and here)

I heard you like Javascript so I put Javascript in your Python so you could Javascript while you Python. This Brotli thing seems to have squirrled it’s way into a lot, not just Node JS. OpenAI's Codex Security team found an out-of-bounds write in Google's Brotli decoder during red-teaming. The fun part is that the root cause was already fixed in Brotli's source in February. Nobody knew it was a security bug, so nobody cut a release, so every project bundling its own copy sat on it for eight months. That list keeps growing: Node.js, Bun, Envoy, Istio, .NET, PowerShell and two Python packages so far, per SecurityWeek's roundup.

Pay attention to how the bad data gets in. Imperva got there through a stock Express 5 JSON body parser, and also through responses fetched from a malicious server. Node's built-in fetch decodes Brotli automatically, so scrapers and agents that read web pages are in scope too. Patch Node.js to 22.23.4, 24.22.1 or 26.12.1, and check the rest of your stack against the Patch the Planet list. Then actually rebuild containers and restart services, because running processes keep the old decoder. If you can't patch today, reject Brotli-encoded requests at the edge and turn off automatic Brotli decompression in your HTTP clients. (read more here and here)

It was 4 again. Not even the same root cause and it still was 4. FoxIO found three TLS bugs in GoAhead, the embedded web server behind management interfaces on a huge pile of routers, printers, firewalls and OT gear, and one of them ends the same way. A buffer length typo in the Mbed TLS integration shrinks a 2048-bit Diffie-Hellman modulus to a single byte. That leaves eight possible shared secrets, and in their proof of concept the right one was 4. Solst had the correct reaction. I thought of the Bo Burnham country song “It’s the scarecrow again!”

The one that sounds scariest is the OpenSSL backend. It loads a certificate revocation list and then never checks it, so revoked client certificates keep working (CVSS 9.1). That bug and the LibreSSL chain-depth bypass only matter on devices doing mutual TLS. The DH bug needs a client sloppy enough to accept a one-byte modulus, and standard OpenSSL clients refuse it. So the real exposure is a lot narrower than the "hundreds of millions of devices" in the announcement. GoAhead 6.1.1 fixed all three back in August, and now we're in the usual embedded wait for every vendor who baked GoAhead into firmware to ship an update. (read more)

Your employees and agents use AI. Can you see what either is doing? The AI Playbook for Security Teams maps nine entry points, from browser chats to MCP integrations, with pointed questions that expose blind spots, a checklist to evaluate AI readiness, and an AI maturity assessment. Find your gaps before someone else does.

Find your AI blind spots. Download the playbook.

Quest Diagnostics, which says it serves one in three US adults a year, found someone inside Quanum Lab Services Manager on Oct 21. That's the portal doctors' offices and hospitals use to order lab tests and pull up results, so it's a pretty direct line to patient records. Quest's 8-K says an unauthorized party accessed some of those records, and its FAQ confirms both health information and personal info were involved, with specifics still under investigation. Quest paused two other client systems as a precaution, had everything restored by Oct 26, and says this has nothing to do with PHP2Shell. No group has claimed it yet. (read more here and here)

The headline says this UEFI bug threatens most servers on planet Earth. Deep breath. CVE-2026-97631 is a 16-year-old buffer overflow in the network boot driver of EDK II, the open-source UEFI codebase that firmware vendors like AMI, Insyde and Phoenix build on. Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google) found it. While a machine is PXE booting, an oversized ICMP error message overflows a fixed buffer. An attacker who knows the exact firmware build can then run code before Secure Boot has checked anything. The 9.5 is earned, and pre-boot code execution is about as bad a position as an attacker can get.

Now the preconditions. The target has to be in the middle of a PXE boot, and the attacker has to get an ICMP packet to it during that window. Machines that boot from local disk never run this code, and the payload doesn't persist across reboots on its own. The advisory also makes no claim about how many vendor firmware images actually carry the bug. The fix landed upstream Oct 15, after AMI published its own fix in September and blew the embargo. Now it has to trickle through every BIOS vendor, which will take ages. (read more)

Anthropic's Frontier Red Team published five exploit chains an unreleased internal model built against Chrome, Safari, Android, Windows and Linux (Chrome alone ended up with 62 CVEs). The Linux one is the scariest: zero-click remote root on servers with a multipath TCP listener. The bug is a race in how the kernel's IPv4 TCP code handles incoming connection requests. Per Ubuntu's tracker, it traces back to a 2015 change that let those requests be processed without holding the listener's lock. Losing the race just fails the handshake without crashing anything, so an attacker can retry forever. Anthropic's proof of concept took 48 minutes to leak a kernel pointer remotely and five more to run a command as root. (read more here and here)

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay