Top news stories this week
- Crypt-no. Crypto giant Binance hit by potentially record-breaking hack.
- Auto-m-AI-tic. AI-enabled cyberattacks become increasingly autonomous.
- Ransom remorse. Hackers apologise after disrupting New Mexico healthcare facilities.
- Coming out of its shell PHP2Shell moves to successful exploitation.
- Ransom where? Law enforcement seize hosting domain and sentence affiliate.
- Patch now. Attackers target critical flaws as vendors rush out patches.
1. Crypto giant Binance hit by potentially record-breaking hack
Cryptocurrency exchange Binance has suffered a major cyberattack, with the value of stolen cryptocurrency potentially making it the largest crypto hack on record. The company said initial checks suggested an engineer’s laptop had been compromised, giving the attacker access to a service container, although the full attack chain remains under investigation.
So what?
Organisations holding crypto assets should secure privileged endpoints and ensure access to wallets and high-value transactions is segregated and subject to multi-party approval.
[Researcher: Milda Petraityte]
2. AI-enabled cyberattacks become increasingly autonomous
A spate of recent incidents suggest attackers are increasingly using AI to automate cyber operations. 123 Reg has disclosed a suspected AI-enabled attack on customer data, while researchers uncovered an autonomous agent capable of hijacking exposed AI models and carrying out attacks with limited human intervention. Separately, a former penetration tester allegedly used ARTEX AI to steal 82 million records.
So what?
AI can allow attackers to find and exploit targets faster and at greater scale. Organisations should expect automated attacks to increase and ensure internet-facing systems are tightly controlled and monitored. Organisational cyber security priorities should include securing endpoints, enforcing strong authentication on model APIs and monitoring for automated data access and credential theft.
[Researcher: Steve Ross]
3. Hackers apologise after disrupting New Mexico healthcare facilities
The BYOD ransomware group apologised after a cyberattack on the University of New Mexico Health Sciences Center disrupted healthcare services, claiming it had not realised the compromised systems supported patient care. The group offered free decryption keys and reportedly promised affected patients compensation of up to USD 2,500, despite retaining stolen patient and employee data.
So what?
BYOD’s unusual response reflects attempts by some ransomware groups to claim ethical boundaries around healthcare attacks, although its retention of stolen data undermines these claims.
[Researcher: Asya Sonnichsen]
4. PHP2Shell moves to successful exploitation
Two critical PHP vulnerabilities, collectively dubbed PHP2Shell, are now being actively exploited, prompting CISA to add both to its Known Exploited Vulnerabilities catalogue. After earlier unsuccessful attempts, researchers recorded 35 successful remote code execution events across three PHP targets, confirming attackers can execute commands on vulnerable systems.
SO WHAT?
PHP powers a significant share of the web, giving attackers a potentially large pool of exposed targets. As newly disclosed vulnerabilities can be operationalised quickly, organisations should prioritise patching internet-facing PHP systems and actively hunt for signs of exploitation.
[Researcher: Gabriella Nolan]
5. Law enforcement seize hosting domain and sentence affiliate
The FBI has seized the domain of bulletproof hosting provider Virtualine, which the US Department of Justice alleges facilitated cybercrime and laundered illicit funds. It’s infrastructure was reportedly linked to ransomware, infostealers, phishing and darknet markets.
Separately, a Ukrainian national has been sentenced to 70 months in prison for his involvement with the Nefilim and Hive ransomware operations targeting hospitals, law firms, government entities and high-revenue businesses.
So What?
The seizure of criminal infrastructure alongside the prosecution of a ransomware affiliate demonstrates a broader law enforcement strategy of targeting both cyber criminals and the services enabling their operations. Threat actors will likely adapt by migrating to alternative providers and infrastructure.
[Researcher: Robin Toulalan Parr]
6. Attackers target critical flaws as vendors rush out patches
Threat actors are scanning the internet for systems vulnerable to the critical Oracle E-Business Suite flaw CVE-2026-101767, which was patched on 20 October. The vulnerability allows unauthenticated remote code execution through SQL injection.
Attackers have also begun exploiting HTTP2Shell, a critical vulnerability in the Brotli compression library that could allow attackers to corrupt memory, access sensitive data and achieve remote code execution in affected Node.js, .NET, Python and other applications.
Separately, Microsoft released emergency Windows updates that remove trust in certificates linked to compromised eMudhra certificate authority keys, preventing the affected certificates from being trusted for potentially malicious purposes.
Additionally, Tailscale is patching 11 “Tailworm” vulnerabilities affecting its VPN software that could allow authorised attackers to escalate privileges to root, steal credentials, bypass access controls or disrupt services.
SO WHAT?
Organisations should ensure that the vulnerabilities that are being exploited by the threat actors are patched as soon as the patch becomes available.
[Researcher: Milda Petraityte]
The information contained herein is intended for informational purposes only. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details. S-RM does not assume, and shall have no liability for the control, correction, continuation or modification of any existing conditions or situation.
