> InfoSec News Nuggets – 10/30/2026

Binance links $6.3 billion security incident to compromised laptop Binance says a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions in an incident with an estimated impact of $6.3 billion. The exchange has frozen roughly $3 billion in affected assets on-chain, kept withdrawals paused while it overhauls its withdrawal service, and pledged to cover all losses through its SAFU fund and corporate funds. TRM Labs has attributed the attack with high confidence to North Korea’s TraderTraitor group, the same crew blamed for the $1.5 billion Bybit hack in 2025, while Binance says it has found no evidence that wallet private keys were leaked and plans to publish a detailed post-mortem.   China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility CISA has added CVE-2026-41709, a low-severity insufficient-logging flaw in Broadcom VMware ESX, to its Known Exploited Vulnerabilities catalog after CrowdStrike revealed that the China-nexus group Warp Panda exploited it as a zero-day earlier this year to reduce audit trail visibility in attacks on the U.S. legal sector. The actor, also tracked as UNC5221 and Clay Typhoon, typically breaks in through internet-facing edge devices, pivots into vCenter environments to plant malware such as BRICKSTORM, steals cloud session tokens, and registers rogue MFA devices to keep access even after password changes. Federal civilian agencies have until November 11 to apply Broadcom’s July fixes.   China-linked hackers exploit PHP2Shell to breach US government network Researchers at Dream say suspected China-linked attackers chained the two critical PHP2Shell flaws with the Fragnesia Linux kernel privilege escalation bug to gain unauthenticated root access on firewalls, compromising 24 devices before breaching the management server of a U.S. government-affiliated organization and stealing Active Directory credentials. The attackers scanned roughly 19,000 internet-facing firewalls and narrowed in on 240 vulnerable devices across the U.S., Japan, Taiwan, and South Korea, and researchers found signs of AI-assisted tooling in the operation. It is the first documented case of PHP2Shell being chained into a full government network breach, and CISA has confirmed active exploitation and ordered federal agencies to mitigate.   Moldova investigates possible foreign involvement in major government cyberattack Moldova’s prime minister says authorities are examining whether foreign state actors were behind a large-scale cyberattack on government systems in which hackers abused vulnerable public services that required no authentication to make about 11 million data requests between October 19 and 23. Information tied to roughly 750,000 identification numbers was extracted, potentially including names, birth details, health insurance, pension, disability, driver’s license, vehicle ownership, and some financial records. Officials inspected 82 digital services, temporarily disconnected more than 30 government systems, blocked follow-up intrusion attempts, and warned citizens to watch for fraud using the stolen data.   US launches program to deliver free cybersecurity help to rural hospitals The White House Office of the National Cyber Director and HHS have launched Project Lifeline 250, a six-month pilot in which companies including Cisco, Cyera, Microsoft, Trellix, and Zscaler will provide free hardware and services to help rural hospitals strengthen basic defenses, keep backups ready for outages, and replace insecure legacy technology. The program begins in South Carolina in partnership with the state’s law enforcement division, and officials noted that the average hospital has more than 26,000 internet-exposed devices on its network. It follows Project Watershed 250, a similar effort for water utilities announced in August. The post InfoSec News Nuggets – 10/30/2026 appeared first on AboutDFIR - The Definitive Compendium Project.