Briefing — 2 November 2026

Security News

FBI links $6.3 billion Binance crypto heist to North Korean hackers (BleepingComputer)
The FBI formally attributes the largest cryptocurrency exchange theft on record to North Korea's TraderTraitor group, tying the heist directly to DPRK weapons programme financing.

Binance reopens to $3.64B in net outflows — "98% choose to stay" (Slashdot)
Binance resumes withdrawals on Sunday; $3.64 billion leaves in the first 24 hours while founder Changpeng Zhao reports the vast majority of users retained their accounts.

ARTEX and Friends: Enter Agentic Offensive Frameworks (Google Threat Intelligence)
Google documents purpose-built attacker toolkits that autonomously perform reconnaissance, exploit chaining, persistence, and exfiltration with minimal human direction — already weaponised in active intrusions.

Chainalysis discloses data breach from "offensive agentic techniques" (BleepingComputer)
The breach disclosed last week is now confirmed as the first publicly named incident attributed to the agentic offensive tooling class documented in the ARTEX report.

PHP2Shell attacks root Palo Alto firewalls — 22.6 million instances potentially exposed (SecurityWeek)
Active exploitation of a critical PHP vulnerability is successfully rooting Palo Alto perimeter devices; exploitation has been ongoing for over a week across a vast attack surface.

Alpine Linux rebuilds GitLab server after attempted RCE attack (BleepingComputer)
Following a critical GitLab RCE exploitation attempt on October 20–21, the Alpine Linux project took the cautious approach of full server rebuild and universal password reset rather than risking a partially compromised environment.

AI compresses vulnerability-to-exploit timeline to days, researchers warn (Washington Post / Slashdot)
Security researchers cite AI-enabled exploitation as a systemic threat to patch cycles; a 26-year-old in southern China allegedly compromised at least nine South Korean banks using AI-assisted techniques.

Cyberattacks on Ukraine and Russia early warning systems — false nuclear alerts reported (unverified)
Unverified claims that Ukrainian and Russian hackers targeted each other's early warning infrastructure, injecting false nuclear missile launch alerts. No official confirmation; the incident class carries significant escalation risk regardless of intent.

CISA Known Exploited Vulnerabilities

No new additions to the CISA KEV catalogue in the last 48 hours.

Ransomware Activity — 35 victims, 14 groups (48 hours)

Qilin — 10 victims ⚠️

fzmb GmbH (Germany) — Medical Technology & Biotechnology Research ⚠️ Healthcare/Research
BKV Vasúti Jármjavító (Hungary) — Railway maintenance / public transport ⚠️ Critical National Infrastructure
Professional services firms (Germany, Austria), Japanese manufacturer, US property management company (5 further victims)

Safepay — 9 victims

Rood Trucking (United States) — Logistics
Universities in Japan and Mexico; further victims across Ecuador, Taiwan, Peru, Argentina, and Israel

Payload — 3 victims

SALEG (Germany) — State-linked development company
Educational materials supplier (Germany); retail garden centre (Germany)

Further groups

Direwolf: My Cloud Grocer (United Kingdom)
Whitearmor: AmplifAI (United States, technology) + ongoing Gamdom extortion
Rhysida: Phoenix Charter Academy (United States, education)
Emperador: Holcim (construction materials)
Also active: Vexy Ransomware, Barracuda, HYFLOCK, lockbit5, Sarcoma, N0n, Shiba

Threat Feed Highlights

Belgian military database — A threat actor is selling an alleged 2,700+ file dataset spanning 2011–2026, including personnel records, organisational reports, and psychosocial assessments.

Chilean hospital data breach — 207,000 patient files (47 GB) allegedly exfiltrated from Hospital San Juan de Dios in San Fernando, including clinical records, diagnoses, and personal identifiers.

Zillow breach claim — Alleged 13.6 million US records and 3.5 million Canadian records (names, email addresses, phone numbers) circulating. Unverified.

Hosting group breach — A single threat actor has posted breach claims across Hostopia, HudsonValleyHost, Managed.com, ChicagoVPS, and Hostwinds — 3.75 million records alleged from what appears to be a shared hosting group database.