It was a heavy week. Attackers turned network firewalls against their owners, a three-part flaw handed over VPN appliances without a password, WordPress shipped an urgent fix, and North Korean hackers carried out the largest cryptocurrency theft on record. Here is all of it in one place, with what to do. The bigger stories have their own articles, linked below.
Act this week
Palo Alto Networks firewalls taken over through php2shell. Attackers combined the PHP flaws we wrote about last week with a Linux flaw to take full control of firewalls whose management page was reachable from the internet. What to do: install Palo Alto's October updates and take the management page off the internet. Full article.
Ivanti Connect Secure VPN: three flaws chained into a full takeover. No password is needed. In the attack Volexity investigated, the intruder stole the credentials stored on the appliance and then searched the company's Active Directory for BitLocker recovery information. CISA listed the last two flaws as actively exploited on 30 October. What to do: update, then change the passwords of everyone who uses the VPN. Full article.
WordPress 7.1.4, Drupal Commerce and Magento. A WordPress flaw can be abused during an automatic core update, an access flaw in Drupal Commerce is being exploited, a Magento flaw fixed in July joined CISA's exploited list, and the retailer Revolve disclosed that customers' saved card details were taken. What to do: update your website and online store this week. Full article.
Cisco ASA and Firepower firewalls can be knocked offline remotely. Cisco published an advisory on 28 October for a flaw in the remote-access VPN service that lets anyone on the internet make the firewall reboot, and said it had seen the flaw exploited in October. CISA added it to its exploited list the next day. Only devices with the SSL VPN enabled and secondary authentication configured are affected. What to do: upgrade to the fixed release for your version listed in Cisco's advisory.
Self-hosted GitLab: a flaw rated 10 out of 10. A crafted CI/CD configuration can run code on a self-managed GitLab server without logging in. GitLab fixed it on 12 October, attackers tried it against the Alpine Linux project's server on 20 and 21 October, and CISA listed it as exploited on 29 October. GitLab.com users are already protected. What to do: upgrade self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8 or later.
Worth knowing
ConnectWise Cloud Backup is coming back after its compromise. The Microsoft 365 backup service, formerly SkyKick, is moving customers to a rebuilt app. The cause is still unknown. What to do: if you or your IT provider use it, make sure each Microsoft 365 tenant is reconnected to the new app and that backups are actually completing. Full article.
TeamViewer: the computer you connect to can take over yours. A flaw lets a malicious or infected computer run code on the technician's machine during a remote session. No attacks have been reported. What to do: update TeamViewer, including any Remote Management add-ons. Full article.
Microsoft fixed the Always On VPN failures caused by September's updates. Since September, some Windows 11 users' VPN connections had hung at "Connecting" when the profile was set to choose between protocols automatically. Microsoft confirmed on 28 October that the fix is in KB5127936, the October optional preview update, after earlier saying wrongly that the regular October update fixed it. What to do: install KB5127936 or wait for November's Patch Tuesday; until then, setting the VPN profile to a single protocol works around it.
A Brotli decompression flaw joined CISA's exploited list. On 27 October CISA added CVE-2026-111497, a memory-corruption flaw in Google's Brotli compression library, to its list of actively exploited vulnerabilities. Brotli is built into a lot of software: Node.js fixed it in its 21 October security releases, and PHP rebuilt its Windows packages on 26 October to include the fix. What to do: if you run applications on Node.js, ask your developer to update to the October 2026 security releases or later; if you run PHP on Windows, install the rebuilt packages ending in -1.
Breaches
$6.3 billion stolen from Binance. The FBI attributes the theft on 29 October to North Korea's TraderTraitor group. Binance says it may have started with a compromised engineer's laptop, and has since found other points of breach. Full article.
Florida's student financial aid website: 4.9 million people. The Florida Department of Education learned on 19 October that an unauthorized party had accessed its student financial aid website and announced it on 29 October. Names, addresses, phone numbers, email addresses, dates of birth and Social Security numbers of about 4.9 million applicants were exposed. The site has been taken offline, and how the attacker got in has not been disclosed. What to do: if you or your employees applied for Florida student aid, watch credit reports and consider a credit freeze. Full article.
Chainalysis breached by attackers using AI agents. The blockchain-analysis firm disclosed on 30 October that an outside actor used what it called "offensive agentic techniques" to get into internal systems earlier in October. Names, email addresses and role labels of platform users were exposed; Chainalysis says it found no evidence that investigation data or credentials were accessed, and that the breach is unrelated to Binance. What to do: if you use Chainalysis, expect phishing that uses its name, especially "fund recovery" offers.
Sources
- Cisco Secure Firewall ASA and FTD Remote Access SSL VPN denial of service vulnerability — Cisco
- GitLab patch release 19.4.2 — GitLab
- CISA adds actively exploited GitLab RCE — The Hacker News
- Microsoft finally fixes VPN issues caused by September updates — BleepingComputer
- October 2026 security releases — Node.js
- CISA adds two known exploited vulnerabilities to catalog — CISA
- Florida warns 5 million affected by financial aid site breach — The Record
- Chainalysis discloses data breach from offensive agentic techniques — BleepingComputer
