BLOG
Notes from the field
Threat analysis, detection engineering and hands-on training notes from the practice.
-
Threat digest: 2026-10-31
A record $6.3bn theft from Binance, attributed to North Korea, dominates the day, alongside two exploited Ivanti VPN flaws, a CVSS 10.0 GitLab remote code execution flaw used…
-
Security bulletin: Binance hot wallet compromise, 29 October 2026
Bulletin ISB-2026-10-30-01. Status: ongoing, under investigation. Severity: critical. Last updated 01:15 UTC on 30 October 2026. This bulletin covers a live incident; figures are moving and each is…
-
Threat digest: 2026-10-30
Binance confirms a breach with up to $5.8 billion in outflows in what may be the largest exchange theft on record, CISA adds GitLab and Cisco flaws to…
-
Threat digest: 2026-10-29
PHP2Shell exploitation escalates into a rooted 25-server intrusion that reached a US government-affiliated network, two more actively exploited flaws enter CISA's KEV list with deadlines inside a fortnight,…
-
Threat digest: 2026-10-28
Two CISA KEV additions, an exploited Adobe Commerce upload flaw and the Brotli memory bug, lead a day that also brought a ransomware threat against 26,739 Onamae cloud…
-
Threat digest: 2026-10-27
CISA adds PHP2Shell to its exploited catalog as honeypots record working shells, Microsoft and others rush emergency patches for the Node2Shell Brotli flaw, and a 525,000 person breach…
-
Node2Shell: the Brotli decoder bug behind CVE-2026-111497, where it is reachable, and how to detect it
Node2Shell is the nickname that Imperva and then the wider community attached to CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder that ships inside Node.js and a long…
-
PHP2Shell: the two PHP bugs behind CVE-2026-109618 and CVE-2026-109619, and how to tell if you were hit
PHP2Shell is the name that stuck to two memory-safety vulnerabilities in PHP’s core request handling, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4 and both allowing unauthenticated…
-
Threat digest: 2026-10-26
An agentic attacker reached MFA secrets at a European government body within two hours, Tailscale SSH flaws went public with no patch, Microsoft shipped unscheduled .NET fixes, and…