Cybersecurity News: 30 October 2026

Florida's Department of Education said a breach of the Florida Student Financial Aid website exposed names, addresses, phone numbers, emails, Social Security numbers and dates of birth for nearly 5 million people. The state took the site down, said the incident is contained, and reported it to the Office of the Attorney General. It urged affected people to monitor credit and financial accounts, and said aid disbursements would not be delayed.

A China-linked group rooted Palo Alto Networks firewalls by chaining PHP2Shell flaws with the Fragnesia kernel privilege escalation bug to deploy root webshells. Dream Research said at least 25 firewalls were compromised, and Palo Alto Networks confirmed the campaign and issued patches. The company said only about 0.02 percent of its installed base had internet-facing management interfaces and found over 22.6 million exposed PHP instances.

The FBI seized virtualine.net, the domain of a Russian-speaking bulletproof hosting provider that court documents say helped cybercriminals evade takedown attempts. Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, was used by ransomware groups and an infostealer operator, according to TRM Labs. The firm said Virtualine received more illicit-attributed cryptocurrency than any other TRM-labeled bulletproof host.

Kaspersky said suspected nation-state hackers developed NetamLoader, malware tailored to a specialized Windows 10 used by government agencies in Asia. The firm detected it on one computer in the first half of 2026 and suspects a supply chain attack, but did not identify the country, agency, or group. NetamLoader uses legitimate Microsoft components to run code, evade security tools, delete logs, download code and contact attackers.

Trezor told CryptoBilis buyers of Trezor wallets since March 2026 to move funds to a new wallet and recovery phrase after a customer reported an extra board in a Safe 5 that can send the recovery phrase over a mobile network when plugged in. Trezor has not examined the device but said the report is believable enough to warn now.

No CryptoBilis buyer has reported losing funds, and Trezor dropped the reseller on October 9 after Ledger investigated losses.

Defiant said threat actors began exploiting a high-severity WordPress race condition within hours of the October 28 patch in WordPress 7.1.4. The unauthenticated flaw in the Core update process can allow remote code execution through predictable, web-accessible staging paths, though attack complexity is high. Wordfence logged more than 18,500 requests targeting staged setup-config.php paths in the first 21 hours.

The Investigatory Powers Commissioner's Office said GCHQ has lost thousands of storage drives containing sensitive data and still cannot establish their exact scale or location. The missing removable media may contain data related to the Investigatory Powers Act, and officials have known about the problem for years. GCHQ said it is implementing an automated asset-tracking system by the end of the year to count the lost devices.

Russian home goods retailer Poryadok closed some stores and suspended online services for five consecutive days after a cyberattack. The company, which operates 48 stores in 32 Russian cities, said customers could not collect orders, access loyalty accounts or reach support, but did not say who attacked or when operations would resume. DownRadar showed online services were still unavailable on Friday.

Microsoft said its October 2026 KB5127936 preview update fixes Always On VPN connection failures on Windows 11 caused by the September 2026 security updates. The failures occurred when automatic protocol selection used IKEv2 and SSTP, leaving connections stuck or producing a port-in-use error. Admins can also avoid the issue by setting the VPN profile to SSTP only or IKEv2 only.

A U.S. federal court sentenced Ahmad Umar Agha, a Syrian Electronic Army hacker known as Th3Pr0, to 42 months in prison for his role in a conspiracy that targeted Western news outlets. The Justice Department said the group was organized by members of former Syrian President Bashar al-Assad's inner circle and that Agha carried out the 2013 Associated Press Twitter hack, causing a temporary $136 billion Dow Jones Industrial Average drop.

Polymarket paused trading on its international platform on October 29 after unauthorized withdrawals, saying a third party provider was compromised and affected traders would be made whole. Researchers linked the theft to malicious JavaScript served from DebugBear, a UK website performance monitoring firm. Loss figures vary: GoPlus put losses at roughly $2.71 million, while Hudson Rock saw about $2.19 million at a hard coded fallback address.

GitLab disclosed CVE-2026-97229, a CVSS 10/10 flaw in Onigmo, Ruby's regular expression engine, that could let an unauthenticated user run arbitrary code via a crafted CI/CD regular expression. Alpine Linux said an attacker used the flaw against its instance on October 20 and 21, causing eight worker crashes, but found no evidence of success and rebuilt it. CISA added the flaw to its KEV catalog and urged federal agencies to patch within 3 days.

Binance linked the theft of about $6.3 billion to a compromised DevOps engineer laptop that let attackers reach a service container and submit unauthorized withdrawals. The exchange suspended deposits and withdrawals, said user funds are safe, and will cover losses from its SAFU fund and company funds. TRM Labs called it the largest crypto theft on record, and Chainalysis attributed it to North Korea's TraderTraitor.

A trojanized version 2.1.313 of Anthropic's Claude Code VS Code extension was distributed through the Cursor Marketplace under the legitimate publisher identity, affecting at most 5,000 users. Its 66-line loader could add an SSH key, open a reverse tunnel, install persistence, and send reconnaissance data. Cursor removed the package and Anthropic published version 2.1.314.

TeamViewer disclosed CVE-2026-111585, a high severity, CVSS 8.8 integer overflow in the remote control screen processing component of its clients on Windows, macOS, Linux, and Android. Remedio said a malicious or compromised host could trigger the bug during an established session by announcing oversized screen dimensions, causing crashes or arbitrary code execution on the viewer's machine.

Drupal warned that a highly critical missing authorization flaw in Commerce Core, tracked as CVE-2026-118539, is being actively exploited in the wild. The issue affects versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13 and can let unauthenticated attackers bypass access in ways that may financially impact vendors. Drupal asked admins to upgrade to Commerce Core 3.3.13 or 8.x-2.41 and audit orders for inconsistencies.

CISA added a GitLab remote code execution flaw and a Cisco firewall denial of service flaw to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. For GitLab CVE-2026-97229, Alpine Linux said an attacker sent crafted CI configurations to its unpatched instance on October 20 and 21, crashing worker processes eight times. Federal civilian executive branch agencies were told to apply fixes by November 1, 2026.

Binance said a compromised DevOps engineer laptop allowed an attacker to reach a service container and submit unauthorized withdrawals worth about $6.3 billion. The exchange paused deposits and withdrawals, said it has frozen nearly $3 billion, and pledged to cover losses from its Secure Asset Fund for Users and its own funds. Chainalysis and TRM Labs attributed the heist to North Korea, and Binance expects withdrawals to resume in 48 hours.