oktsec
Free workflow checkGet started
Radar
All recapsOct 30, 2026
Weekly recap

Exploited infrastructure, runtime fixes and the Binance incident

This week brought new exploitation evidence, revised vendor fixes and Binance’s first findings on unauthorized withdrawals. Here are the material changes in Radar’s published coverage and the checks they require.

By OktsecReporting periodOct 26, 2026 – Oct 30, 202612 incidents · 4 checksUpdated UTC
Team checklist

Summary through 10:26 UTC on Oct 30, 2026. Linked advisories retain subsequent updates.

Attacks against exposed infrastructure

3 incidents

Cisco confirmed active exploitation of ASA/FTD CVE-2026-76418: a reachable SSL VPN with secondary authentication can be forced to restart without a successful login. Separately, Palo Alto reports attacks against exposed management interfaces through PHP2Shell. CISA identifies a chain from the two original PHP CVEs to Linux kernel CVE-2026-46300 and root privileges.

What to checkApply the correction for each deployed branch, restrict management access and verify the PHP workers and kernel actually running. PAN’s October 30 matrix lists 11.1.7-h12 without an ETA; confirm download availability. Keep the separate PHP session mitigation.

New exploitation evidence for GitLab, ESX and Commerce

3 incidents

CISA added GitLab CVE-2026-97229, VMware ESX CVE-2026-41709 and Adobe Commerce CVE-2026-48356 to KEV during this reporting period. The impacts differ: unauthenticated code execution in GitLab, operations missing from ESX logs when performed by a malicious administrator, and a Commerce flaw requiring its separate July security fix.

What to checkInstall the latest supported GitLab patch and use the vendor’s detection guidance. Update ESX and review external telemetry. For Commerce, verify the patch itself, including cloud-patches delivery; a compatible base version is insufficient.

Brotli fixes depend on the product

1 incident

CISA listed CVE-2026-111497 as exploited on October 27. That evidence does not establish attacks against every product that bundles Brotli. PAN updated its corrected builds; AWS distinguishes Lambda runtime updates from the service itself. Solace reports Event Portal exposure resolved on October 28, while other product updates remain separate.

What to checkCheck the exact PAN-OS branch. Rebuild and deploy affected Lambda containers and verify runtime patch identifiers; rollout targets do not prove completion. Follow the guidance for each Solace component.

Binance reports a $6.3 billion estimated impact

1 incident

Binance’s October 30 statement reports an estimated $6.3 billion impact and about $3 billion frozen. Preliminary findings suggest a compromised DevOps laptop enabled access to a service container and unauthorized withdrawals. The investigation remains open. Frozen funds are not confirmed recoveries or a basis for calculating net loss.

What to checkReview which workstations and services can authorize withdrawals, persistent delegations, independent approval requirements and revocation paths. Keep the preliminary access path separate from a completed technical postmortem.

Credentials need a separate response

2 incidents

AWS warns that Strands Agents Tools can return credentials through the environment tool without masking them. Updating the package does not replace the credentials. Railway’s preliminary report separately confirmed that some encrypted environment variables were decrypted and recommended replacing sensitive variables stored before October 21.

What to checkFor agents that loaded the environment tool, update strands-agents-tools to 0.8.6 or later and rotate the credentials present in those environments. Remove the tool if upgrading is delayed. For Railway, replace affected secrets, revoke old access and review use at the issuing service.

Manual patching and certificate replacement

2 incidents

Sophos issued an exceptional manual patch for unauthenticated root command execution in UTM when email proxy scanning is enabled. UTM remains outside support; exploitation is not established in the reviewed sources. Separately, AWS set October 28 for replacing affected identity provider certificates used with ALB OIDC or JWT authentication.

What to checkFollow the Sophos patch KB and plan migration; Radar has not verified the installation procedure. Check affected ALB identity provider chains and confirm replacement after the October 28 deadline. AWS trust store rollout dates do not replace that customer action.

For your team

Recommended checks

Need help checking exposure or verifying remediation? Oktsec can scope a review of the affected systems and the evidence required.

Scope an assessment
  1. 01Confirm exposure before assigning work: SSL VPN configuration, management access, affected runtime and deployed branch.
  2. 02Verify the corrected software is running. Installed packages and scheduled rollouts do not establish that a service has been updated.
  3. 03Complete credential rotation, separate security patches and certificate replacement where required.
  4. 04Preserve evidence where compromise is suspected. An update does not explain activity before the fix.
Sources behind this recap 70 references

Sources

Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.

  1. Microsoft guidance: PHP2Shell, Brotli and eMudhraMicrosoft · Vendor notice · Checked Oct 31, 2026 UTC
  2. PAN-OS October 29 matrix and Transporter correctionPalo Alto Networks · Vendor notice · Checked Oct 31, 2026 UTC
  3. AWS 155: Brotli runtime updates and verificationAWS · Vendor notice · Checked Oct 31, 2026 UTC
  5. AWS trust bundle updates: ALB certificates and Lambda deployment actionsAWS · Vendor notice · Checked Oct 31, 2026 UTC
  6. CloudLinux OS: separate system, EasyApache and alt-php Brotli fixesCloudLinux · Vendor notice · Checked Oct 30, 2026 UTC
  7. Palo Alto: PHP2Shell exploitation and PAN-OS branch fixesPalo Alto Networks · Vendor notice · Checked Oct 30, 2026 UTC
  8. GitLab October 12 security patch release and detection guidanceGitLab · Vendor notice · Checked Oct 30, 2026 UTC
  9. GitLab CNA record: CVE-2026-97229GitLab / CVE Program · Vendor notice · Checked Oct 30, 2026 UTC
  11. BWEnews tally reported by BBX: $5.643 billion in outflows at 21:22 UTCBBX / BWEnews · Media report · Checked Oct 30, 2026 UTC
  12. Binance 14: second transfer at 21:44:11 UTCEtherscan · Research report · Checked Oct 30, 2026 UTC
  13. Binance: investigation into a potential security issueBinance · Vendor notice · Checked Oct 30, 2026 UTC
  14. Binance: $2.54 billion frozen, not a final loss estimateBinance · Vendor notice · Checked Oct 30, 2026 UTC
  15. Binance 14: EIP-7702 delegation at 20:20:59 UTCEtherscan · Research report · Checked Oct 30, 2026 UTC
  16. Binance 14: ETH and token transfers at 20:24:23 UTCEtherscan · Research report · Checked Oct 30, 2026 UTC
  17. Binance Hot Wallet 34: 780 million USDC transferEtherscan · Research report · Checked Oct 30, 2026 UTC
  18. EIP-7702 delegation and transfer analysisOdysseas / Phylax · Research report · Checked Oct 30, 2026 UTC
  19. Circle: more than 800 million USDC frozenJeremy Allaire / Circle · Vendor notice · Checked Oct 30, 2026 UTC
  20. Tether: more than 1.567 billion USDT frozenPaolo Ardoino / Tether · Vendor notice · Checked Oct 30, 2026 UTC
  21. EIP-7702: account code delegation and security considerationsEthereum Improvement Proposals · Research report · Checked Oct 30, 2026 UTC
  22. Cisco ASA/FTD: active exploitation can restart VPN devicesCisco · Vendor notice · Checked Oct 29, 2026 UTC
  23. Solace Brotli product scope and release targetsSolace · Vendor notice · Checked Oct 29, 2026 UTC
  24. Sophos UTM: manual patch for root command executionSophos · Vendor notice · Checked Oct 29, 2026 UTC
  25. Linux CNA record and branch fixesLinux · Vendor notice · Checked Oct 28, 2026 UTC
  26. Red Hat: local privilege escalation and distributor guidanceRed Hat · Vendor notice · Checked Oct 28, 2026 UTC
  27. Broadcom VMSA-2026-0006.2, section 3eBroadcom · Vendor notice · Checked Oct 28, 2026 UTC
  28. AWS bulletin 2026-154: environment masking and credential rotationAWS · Vendor notice · Checked Oct 28, 2026 UTC
  29. Strands Tools GHSA-qjx4-hg6g-2f34Strands Agents · Vendor notice · Checked Oct 28, 2026 UTC
  30. MongoDB CNA record: Compass CVE-2026-115929MongoDB · Vendor notice · Checked Oct 28, 2026 UTC
  31. CISA KEV: CVE-2026-111497, added October 27, 2026CISA · Government advisory · Checked Oct 28, 2026 UTC
  32. APSB26-73: affected products and July security updateAdobe · Vendor notice · Checked Oct 28, 2026 UTC
  33. July isolated patch installation and cloud-patches guidanceAdobe · Vendor notice · Checked Oct 28, 2026 UTC
  34. Adobe CNA record for CVE-2026-48356Adobe CNA · Vendor notice · Checked Oct 28, 2026 UTC
  35. PAN-OS 12.2.4-h1 addressed issuesPalo Alto Networks · Vendor notice · Checked Oct 27, 2026 UTC
  36. PAN-OS 12.1.7-h11 addressed issuesPalo Alto Networks · Vendor notice · Checked Oct 27, 2026 UTC
  37. Java follow-up alert: root certificate removalOracle · Vendor notice · Checked Oct 27, 2026 UTC
  38. Runtime checks and mitigations for eMudhra certificatesOracle · Vendor notice · Checked Oct 27, 2026 UTC
  39. Updated PHP Windows builds for Brotli security fixPHP · Vendor notice · Checked Oct 26, 2026 UTC
  40. Preliminary report: October security incidentRailway · Vendor notice · Checked Oct 26, 2026 UTC
  41. PHP2Shell attribution correction — October 25Unit 42 · Research report · Checked Oct 26, 2026 UTC
  42. PHP incident response and runtime remediationGoogle Cloud · Research report · Checked Oct 26, 2026 UTC
  43. Chrome and Android response to compromised eMudhra intermediatesGoogle · Vendor notice · Checked Oct 26, 2026 UTC
  44. Python 3.15.2 security releasePython · Vendor notice · Checked Oct 26, 2026 UTC
  45. Python 3.14.10 security releasePython · Vendor notice · Checked Oct 26, 2026 UTC
  46. Python 3.13.18 security releasePython · Vendor notice · Checked Oct 26, 2026 UTC
  47. Python 3.12.16 security releasePython · Vendor notice · Checked Oct 26, 2026 UTC
  48. Python 3.11.18 security releasePython · Vendor notice · Checked Oct 26, 2026 UTC
  49. Application updates for compromised eMudhra certificatesGoogle · Vendor notice · Checked Oct 26, 2026 UTC
  50. IO::Compress::Brotli 0.023 security releaseIO::Compress::Brotli maintainers · Vendor notice · Checked Oct 25, 2026 UTC
  51. Platform outage resolution and remaining customer actionsRailway · Vendor notice · Checked Oct 25, 2026 UTC
  52. Java security alert CVE-2026-91403Oracle · Vendor notice · Checked Oct 25, 2026 UTC
  53. Python ssl certificate denylist announcementPython · Vendor notice · Checked Oct 25, 2026 UTC
  54. CPython certificate denylist merged changePython · Vendor notice · Checked Oct 25, 2026 UTC
  55. MongoDB Compass 1.53.1 releaseMongoDB · Vendor notice · Checked Oct 25, 2026 UTC
  56. Electron 44.9.1 certificate mitigationElectron · Vendor notice · Checked Oct 25, 2026 UTC
  57. PHP security advisory: CVE-2026-109618PHP · Vendor notice · Checked Oct 24, 2026 UTC
  58. PHP security advisory: CVE-2026-109619PHP · Vendor notice · Checked Oct 24, 2026 UTC
  59. October Node.js security releasesNode.js · Vendor notice · Checked Oct 24, 2026 UTC
  60. Brotli exposure, fixed releases and mitigationsOpenAI · Patch the Planet · Research report · Checked Oct 24, 2026 UTC
  61. Brotli 1.2.1 security releaseGoogle Brotli · Vendor notice · Checked Oct 24, 2026 UTC
  62. Brotli 1.1.1 security releaseGoogle Brotli · Vendor notice · Checked Oct 24, 2026 UTC
  63. Brotli 1.0.10 security releaseGoogle Brotli · Vendor notice · Checked Oct 24, 2026 UTC
  64. Bun 1.4.4 Brotli dependencyBun · Vendor notice · Checked Oct 24, 2026 UTC
  65. Envoy Brotli decompressor advisoryEnvoy · Vendor notice · Checked Oct 24, 2026 UTC
  66. Istio security advisory and fixed releasesIstio · Vendor notice · Checked Oct 24, 2026 UTC
  67. Node2Shell research demonstrationImperva · Research report · Checked Oct 23, 2026 UTC
  68. PHP critical security advisoryPHP · Vendor notice · Checked Oct 23, 2026 UTC
  69. PHP2Shell observations in MadPotAWS · Vendor notice · Checked Oct 23, 2026 UTC
  70. Session upload progress follow upPHP · Vendor notice · Checked Oct 23, 2026 UTC

Know what needs attention.

Priority security alerts and briefings. Evidence, affected systems and next steps.