THE DAY IN SECURITY
🔴 Active incidents the same story from several reports
PHP2Shell PHP RCE disclosure (CVE-2026-109618/109619) 15 reports
- Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- Marcus Hutchins (@MalwareTechBlog) on X
- Today's PHP Security Release, and How We're Strengthening PHP Security
- Remotely exploitable PHP bug found on 70% of world’s websites
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
- PHP2Shell: Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) | Endor Labs
- PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out
- Two critical RCEs in PHP core
- Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2)
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
- Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
- Critical vulnerabilities in PHP (PHP2SHELL)
Binance $6.3B hot-wallet hack (TraderTraitor, EIP-7702) 13 reports
- Binance Just Suffered the Biggest Hack in Crypto History. What Now?
- Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million
- Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'
- How the Binance hack happened on-chain on Ethereum
- Binance Attacker Used EIP-7702 to Bypass Wallet Controls, Teng Says
- Binance hack: the largest robbery in financial history
- What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack
- Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
- TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor
- TRM says Binance crypto hack stole $6.36B across 10 chains, mostly in 20 minutes
- Binance Exploit: Latest Findings and Response
- Binance Finds 'Additional Points of Breach' in $6.3B Hack
- Binance links $6.3 billion crypto theft to compromised DevOps laptop
PHP2Shell critical PHP RCEs (CVE-2026-109618 and CVE-2026-109619) 10 reports
- PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- PHP2Shell Exploitation Started Days Before Patches
- [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
- Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
- Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
- PHP 8.2.35
- Today's PHP security release, and how we're strengthening security
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
- Cloudflare deploys protections against php2shell vulnerability
Ledger wallets with LTE implant (CryptoBilis) drain $86M 8 reports
- Ledger Spyware Scare Spreads Across Asia and Europe
- Ledger hardware wallet breach exposes LTE implant stealing recovery phrases
- German Ledger reseller pauses sales following $86M draining incident
- Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain
- $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
- Karpelès Says Airport-Bought Ledger Flex Contained Spy Implant
- Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
- Ledger Says CryptoBilis-Sold Wallet Implants Transmit Recovery Phrases Over LTE
LiteLLM 1.107.0 supply-chain compromise 6 reports
- LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labs
- LiteLLM Compromised, Steals Credentials
- litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
- LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
- LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
- LiteLLM compromised again: infostealer and RAT found in version 1.107.0
OpenAI model spent testnet ETH from wallet it didn't own 6 reports
- OpenAI Model Helped Itself to Testnet ETH Without Permission
- OpenAI agent questions its own ethics after going rogue and stealing crypto
- OpenAI model’s crypto incident involved spending another wallet’s test tokens
- OpenAI Model Used Testnet Ethereum Wallet Without Permission to Finish Coding Task
- OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks
- An OpenAI agent ran out of Ethereum funds, and took from a wallet it did not own
PHP2Shell PHP engine RCE disclosure and exploitation 5 reports
- PHP2Shell: What This Week Tells Us About the Web We Built
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
- Trail of Bits (@trailofbits) on X
- PHP2Shell: pre-auth RCE via PHP memory-limit fatal errors (CVE-2026-109618/109619)
Ledger wallets drained via CryptoBilis reseller 5 reports
- Ledger says Southeast Asia reseller linked to $86M draining
- Ledger investigates hardware wallet theft reports; losses estimated above $86M
- Ledger Probes Potential Theft of $87M in User Funds Tied to Crypto Wallet Reseller
- Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses
- Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen
LiteLLM 1.107.0 PyPI supply chain compromise 4 reports
Ledger wallets implanted via reseller CryptoBilis drain 4 reports
ZachXBT infiltrates Lazarus-linked Chinese laundering network 4 reports
- ZachXBT Says He Fronted $349,700 to Infiltrate Alleged Laundering Ring
- Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
- ZachXBT poses as money launderer to infiltrate Lazarus network
- ZachXBT Posed as a Client to Infiltrate Chinese Syndicate Laundering Bybit Hack Funds
Bitget $387.5M hack attributed to North Korea 4 reports
Trezor Safe 5 implant from CryptoBilis reseller 3 reports
Malicious Claude Code 2.1.313 extension with SSH backdoor 3 reports
PHP2Shell PHP RCE flaws leaked and exploited 3 reports
Keystone wallet store breach and device key leak 3 reports
PHP2Shell PHP RCE exploitation 3 reports
Critical Brotli decoder vulnerability (Broccoli2Shell) 3 reports
Ethereum delays Glamsterdam Hoodi fork over gas security risks 3 reports
eMudhra / emSign intermediate CA key compromise 3 reports
Ledger reseller wallet implant theft 3 reports
Omar Santos AI-agents-for-cybersecurity repo 3 reports
GhostAction new wave hits GitHub repos 3 reports
MetaMask staking infrastructure compromised, forces mass validator exit 3 reports
Polymarket traders drained via hijacked vendor script 2 reports
GitLab max-severity CVE-2026-97229 exploited 2 reports
Drupal Commerce Core flaw exploited 2 reports
Keystone destroys ~19,000 wallets after stolen key and breach 2 reports
PHP2Shell exploit and exploitation attempts 2 reports
Draft ERC: Agent Safety Framework (ASF) registry 2 reports
Bitcoin Core changes security policy for AI-found bugs 2 reports
ENISA Technical Advisory on SBOM published 2 reports
eMudhra intermediate CAs distrusted over weak keys 2 reports
Attackers abuse Cairn AI platform to breach 100+ organizations 2 reports
Ledger resold wallets with eSIM implant steal recovery phrases 2 reports
Plex2Shell Plex Media Server exploit chain 2 reports
Zakura proposal for quantum-safe Zcash swaps 2 reports
Broadcom WPS Wi-Fi overflow in ISP gateways 2 reports
OpenCode Console breach 2 reports
Claude traces NIST curve seeds to lrand48 2 reports
Critical GitLab CI lint regex RCE 2 reports
Ledger tampered hardware wallets steal recovery phrases in Southeast Asia 2 reports
Attack on French supermarket refrigeration controllers 2 reports
GitLab CE/EE CVE-2026-97229 critical regex overflow RCE 2 reports
Microsoft disrupts YAM Store/CoGUI/Iron Man phishing ecosystem 2 reports
Ivanti Connect Secure zero-day CVE-2026-104935 exploited 2 reports
Anthropic warns small AI models may self-replicate on IoT 2 reports
XRP Ledger decade-old integer overflow bug 2 reports
Bricksforge WordPress plugin RCE exploited 2 reports
Zcash quantum-resistant transparent address plan 2 reports
XRP Ledger decade-old bug patched in xrpld 3.4.1 2 reports
Telegram Desktop one-click IPC file theft fixed in 7.2.9 2 reports
Flax Typhoon/Integrity Tech advisory and disruption 2 reports
UK sanctions Cryptomus, TokenSpot and others 2 reports
ERC-8441 hybrid post-quantum stealth address draft 2 reports
AhsayCBS vulnerabilities exploited in the wild 2 reports
AWS AI vulnerability harness blog series 2 reports
Critical Atlassian path traversal CVE-2026-21589 2 reports
Citrix NetScaler 0-day RCE exploitation (CVE-2026-88771/88772) 2 reports
Bitget $387M hack linked to North Korea 2 reports
Anti-cheat kernel LPE 0day research series (xhunter2.sys) 2 reports
KillSec ransomware admin arrested in Spain 2 reports
Google's PageBreak agentic scanner 2 reports
Binance loses about $6.3 billion in a North Korea-attributed hot wallet drain using EIP-7702
Attackers drained about $6.3 to $6.4 billion from Binance hot wallets across 10 chains, mostly within 20 minutes. TRM and Chainalysis attribute the theft to North Korea's TraderTraitor, and Binance says an EIP-7702 delegation bypass was the method. Circle froze $823 million, and Binance has set aside $6.34 billion to cover losses. Separately, CISA confirmed exploitation of the max-severity GitLab flaw CVE-2026-97229 and two Ivanti Connect Secure flaws, and a malicious Claude Code extension on Cursor's marketplace planted SSH backdoors.
🏦 Binance hack
- TRM and Chainalysis tie the Binance hack to TraderTraitorAnalytics firms cite EIP-7702 sweeper use, Tornado Cash funding and fund commingling with the Bitget exploit.
- How the Binance hack happened on-chain on EthereumShows a stolen Binance 14 key and EIP-7702 delegation to a sweeper contract draining Ethereum funds.
- Binance hack: how a compromised developer laptop can lead to a $6.3 billion breachExplains the suspected laptop vector with North Korean developer-targeting examples and mitigations.
- Binance Hack Puts Developer Machine Security in FocusGives a checklist for tracing what a developer laptop can reach.
- Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 MillionUS agencies investigate while Circle and Tether freeze stolen stablecoins.
- What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance HackExplains how pre-signed authorizations let TraderTraitor sweep a hot wallet.
- EIP Draft: Permanent EOA Delegation Opt-Out (disable EIP-7702)Proposes letting an EOA permanently opt out of EIP-7702 delegation.
🔥 Exploited vulnerabilities and patches
- CISA says max severity GitLab flaw now exploited in the wildCVE-2026-97229 regex-compiler RCE is in KEV with a federal patch deadline.
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversCVE-2026-98432 use-after-free was exploited by an Anthropic AI model for remote root; distro patches are rolling out.
- CISA Adds Two Known Exploited Vulnerabilities to CatalogTwo actively exploited Ivanti Connect Secure flaws fall under BOD 26-04.
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPressPHP2Shell chained with Fragnesia roots exposed PAN-OS firewalls.
- Fresh WordPress Vulnerability in Attackers' CrosshairsA core update race condition can give unauthenticated RCE; fixed in 7.1.4.
- Drupal Commerce Core Vulnerability Exploited Against Online StoresCritical access bypass is exploited; update to 3.3.13 or 8.x-2.41 and audit orders.
📦 Supply chain and intrusion tradecraft
- Malicious Claude Code extension on Cursor planted SSH backdoorsTrojanized extension added SSH persistence, though malware bugs likely blocked access on many hosts.
- Cursor Removes Malicious Claude Code 2.1.313 Extension From Its MarketplaceSocket found no Open VSX or npm record of 2.1.313; Cursor confirms it shipped it.
- Polymarket Sends $3.9M Back to Traders After Vendor Script DrainA hijacked page-speed script drained $2.7M from 726 wallets; CSP and hash pinning would have helped.
- Trezor warns of suspected crypto-theft implant in hardware walletA Safe 5 from reseller CryptoBilis allegedly has a cellular implant; Trezor tells buyers to move funds.
- From help desk impersonation to AD CS abuse: ESC1 and ESC8 intrusion pathsTwo Teams-impersonation intrusions escalated via AD CS, with hunting queries and hardening guidance.
- 4 real? Tracking exploitation and patching of eMudhra's weak keysCloudflare reports forged certificates and slow client patching after weak intermediate CA keys became public.
- Bulletproof Host Virtualine Loses Its Domain to FBI SeizureThe seized host served ransomware and infostealer operators.
🤖 AI security
- "Black October" for AI Developer PlatformsWiz traces stolen platform credentials from vendor breaches to mass Bedrock abuse and LLM token resale.
- How we detect frontier model misalignmentOpenAI describes its monitoring pipeline, including a replay of the Hugging Face sandbox escape.
- Pre-ERC: x402 Payee Verification for ERC-8004 AgentsMeasured only 5 of 5,575 payTo addresses matching an agent's signed wallet.
- Was I wrong about open models & cyber risks?Nathan Lambert's argument that open-weight models like GLM-5.3 have not caused step-change cyber harm.