Daily cyber recap, Oct 30: PHP2Shell, Binance, Cisco

Watch the 2-minute recap

PHP2Shell attacks are widening and Binance reports a security incident touching about $6.3 billion in assets. Cisco and Drupal flaws are also reported as exploited, and a vendor breach exposed Japan Airlines customers.

Today at a glance

• PHP2Shell attacks keep widening [The Record]
• Binance reports a security incident [The Hacker News]
• Cisco firewall zero-day exploited [BleepingComputer]
• Drupal Commerce Core under attack [The Hacker News]
• Japan Airlines customers caught in a vendor breach [BleepingComputer]
• Belarus-tied FrostyNeighbor hits Ukraine [Dark Reading]
• Operation Serengeti sweeps up arrests [Dark Reading]
• Gheist supply chain campaign, stolen GitHub tokens [Dark Reading]

PHP2Shell attacks keep widening

CISA has confirmed active exploitation of the PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities catalog, and reports describe the bug as an unauthenticated remote code execution flaw rated CVSS 9.2. Researchers say a security firm has listed about six exploitations, and another found a well-targeted, suspected Chinese campaign that breached US government-affiliated servers, reportedly by chaining PHP2Shell with a kernel privilege escalation. If you run affected software, patch it now. [The Record]

Binance reports a security incident

Binance says a security incident on its platform has affected about $6.3 billion worth of assets, and nearly $3 billion of those assets have been frozen on-chain so far. Blockchain analysts link the theft to North Korean hackers and say it bears the hallmarks of TraderTraitor; that is analyst attribution, not a confirmed finding. If you hold funds on an exchange, watch for official updates and be wary of phishing that cites the incident. [SecurityWeek]

Cisco firewall zero-day exploited

Cisco has warned of a denial-of-service zero-day in its Adaptive Security Appliance and Threat Defense software that attackers are exploiting to crash SSL VPN devices. Separately, CISA added a Cisco flaw and a critical GitLab bug, rated CVSS 10.0, to its Known Exploited Vulnerabilities catalog. Teams running these products should check the vendor advisories and apply fixes. [BleepingComputer] [The Hacker News]

Drupal Commerce Core under attack

Drupal warns that threat actors are exploiting a highly critical security flaw in its Commerce Core component, the shopping-cart part of a Drupal store. The flaw is a missing-authorization bug, meaning the code fails to check whether a user is allowed to perform an action. If you run a Drupal shop, update Commerce Core quickly and review recent admin activity. [The Hacker News]

Japan Airlines customers caught in a vendor breach

Japan Airlines says a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. It is a third-party breach, so the exposure sits in a vendor’s system. Affected travellers should be cautious with unexpected messages that mention a booking. Companies should ask which suppliers hold customer data, and how fast those suppliers would report a breach to them. [BleepingComputer]

Belarus-tied FrostyNeighbor hits Ukraine

Dark Reading reports that FrostyNeighbor, a group tied to Belarus, launched a destructive attack in Ukraine, raising concerns about deeper alignment with Russian cyber objectives. The report frames this as a concern, not a settled conclusion. Organisations with links to Ukraine should confirm their backups are offline and tested, since destructive attacks aim to wipe systems rather than steal quietly. [Dark Reading]

Operation Serengeti sweeps up arrests

Interpol’s third Operation Serengeti led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds, according to Dark Reading. The operation is described as the third iteration, and it shows cross-border policing can recover money. The practical lesson: if you are defrauded, tell your bank and the authorities quickly, because speed helps. [Dark Reading]

Story of the week: Gheist and stolen GitHub tokens

Dark Reading describes Gheist as an ongoing supply chain attack that is harvesting credentials and sensitive data from thousands of developer repositories using stolen GitHub tokens. Infosecurity Magazine reports that the attackers abused stolen access tokens to target 13,500+ branches and repositories, and its headline says the attackers stumbled in the attempt. [Dark Reading] [Infosecurity Magazine]

The story is still developing, so details may change. As advice rather than a finding from the reports: if you maintain repositories, review which access tokens exist, revoke the ones you do not recognise or no longer need, and rotate any that could have been exposed. Prefer narrow, short-lived tokens, and check repository activity logs for pushes or branch changes you did not make.

What to do this week

1. Patch internet-facing systems first, starting with anything covered by CISA’s Known Exploited Vulnerabilities catalog.
2. Check Cisco ASA/FTD and GitLab advisories and apply the fixes if you run those products.
3. If you run a Drupal shop, update Commerce Core and review recent admin activity.
4. Keep backups offline and test a restore, since destructive attacks aim to wipe systems.
5. Audit GitHub and other access tokens: revoke what you do not need and rotate what may be exposed.

Sources

1. The Record: https://therecord.media/php2shell-successful-exploitation-reports-emerge (2026-10-29)
2. The Hacker News: https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html (2026-10-28)
3. The Hacker News: https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html (2026-10-27)
4. The Hacker News: https://thehackernews.com/2026/10/binance-suffers-security-breach.html (2026-10-30)
5. SecurityWeek: https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/ (2026-10-30)
6. BleepingComputer: https://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/ (2026-10-29)
7. The Hacker News: https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html (2026-10-30)
8. The Hacker News: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html (2026-10-30)
9. BleepingComputer: https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/ (2026-10-29)
10. Dark Reading: https://www.darkreading.com/physical-security/russia-cyber-war-belarus-steps-forward (2026-10-30)
11. Dark Reading: https://www.darkreading.com/cybersecurity-operations/third-serengeti-sweep-1400-arrests-investigations-mature (2026-10-28)
12. Dark Reading: https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets (2026-10-26)
13. Infosecurity Magazine: https://www.infosecurity-magazine.com/news/gheist-attackers-abuse-stolen/ (2026-10-26)

Follow for the daily recap

Follow if you like this content and want to stay up to date. Find more at edwinvonlabja.com and watch the recap at https://www.youtube.com/watch?v=yWSP5qKSmXY.

Produced with an AI-assisted pipeline; every claim is checked against the linked sources.