This week in cyber security: Binance's US$6.3bn theft, exploited PHP flaws and FNB's POPIA fine
Attackers took about US$6.3bn from Binance, PHP and GitLab flaws were exploited, VPN gateways came under attack, police took down a criminal host, and the Information Regulator fined FNB R1m.
The week of 26 October to 1 November 2026, in six items. Each one says what the organisation involved, or a government agency, has confirmed, and keeps apart what has only been reported.
Binance loses about US$6.3 billion from its hot wallets
On 29 October, attackers made unauthorised withdrawals from the hot wallets of Binance, the cryptocurrency exchange. Binance puts the impact at about US$6.3 billion and says it will cover all losses itself.1
Two exploited PHP flaws, and a Linux kernel flaw chained with them
On 21 October, PHP fixed two flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.8 This week, CISA added both to its catalogue of exploited vulnerabilities (26 October), followed by a Linux kernel flaw, CVE-2026-46300 (28 October).9
GitLab's maximum-severity CI/CD flaw is now exploited
CISA added CVE-2026-97229 in GitLab Community and Enterprise Edition to its catalogue on 29 October.9 GitLab fixed it on 12 October and rates it critical, CVSS 10.0: an unauthenticated user could run code on the GitLab server with a crafted regular expression in a CI/CD configuration.10
VPN gateways under attack: Cisco and Ivanti
Cisco. On 28 October, Cisco disclosed CVE-2026-76418 in the SSL VPN service of its Secure Firewall ASA and Threat Defense software. An unauthenticated attacker can make the device reload. Only devices with SSL VPN enabled and secondary authentication configured on a tunnel group are affected, and Cisco says it learned of active exploitation in October.11 CISA added it to its catalogue on 29 October.9
Ivanti. On 30 October, CISA added two more Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its catalogue. Both can be chained with CVE-2026-104935, which was added on 13 October.912
Police take down the Virtualine "bulletproof" host
On 27 October, US prosecutors announced the court-authorised seizure of virtualine.net, the site of a hosting service that, they say, advertised itself to criminals on cybercrime forums.13 Dutch police seized dozens of physical servers in a Limburg data centre, taking hundreds of virtual servers offline, and obtained data on more than 3,000 customers for further investigation.14
South Africa: the Information Regulator fines FNB R1 million
On 26 October, the Information Regulator announced administrative fines under POPIA: R1 million for First National Bank (FNB) and R500,000 for Central Johannesburg TVET College.16
Sources
Official sources are the organisation's own statement, a regulator, a government agency or a vendor advisory. Reports are news or third-party analysis; we say so in the text when a claim rests only on them.
- 1Security Incident Update (2026-10-30)↩
- 2Security Incident Update #2 (2026-10-30)↩
- 3Security Incident | Recovery Update #4: Withdrawals Resume in Phases (2026-11-01)↩
- 4North Korea Responsible for $6 Billion+ Binance Attack↩
- 5Binance hit by $6.3-billion hack, the biggest crypto heist ever↩
- 6FBI links $6.3 billion Binance crypto heist to North Korean hackers↩
- 7Binance resumes withdrawals following $6.3 billion breach↩
- 8Security advisory: Critical remote code execution vulnerabilities, update now↩
- 9Known Exploited Vulnerabilities Catalog (catalogue version 2026.10.30)↩
- 10GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8↩
- 11Cisco Secure Firewall ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability↩
- 12CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (revised 30 October 2026)↩
- 13“Bulletproof” website domain seized in international law enforcement operation↩
- 14Internationale politieactie tegen bulletproof hoster↩
- 15FBI seizes 'bulletproof' hosting site accused of facilitating child abuse, money laundering↩
- 16Information Regulator fines Central Johannesburg TVET College and First National Bank for POPIA contravention↩
Share
How we write: every claim links to its source and date, confirmed facts are kept apart from reports, and corrections appear at the top of the post. Facts and sources checked on 2 November 2026. Spotted an error? Email hello@refact0.com.