Cybersecurity News: 31 October 2026

Northflank told customers to rotate environment variables and API keys after a breach disclosed October 30 led to unauthorized use of AI API keys. Northflank said it assumed all environment variables had been decrypted and asked users to check AI provider usage and billing logs. It patched network policies after Wiz's alert and enabled credential rotation and audit logs, but has not said how attackers got in or how many customers were affected.

Hackers tied to North Korea stole roughly $6.36 billion from Binance across ten blockchains, in what blockchain intelligence firms are calling the largest crypto theft in history. The attack began at 8:05 p.m. UTC on October 29, and Binance suspended deposits and withdrawals while saying user funds would be covered in full. About $3 billion was frozen, but more than $2.4 billion remained in attacker control as of press time.

Researcher Mark Blah has published a proof-of-concept exploit for Android flaw CVE-2026-58882, dubbed SMS of Death, that can remotely crash phones or interrupt calls, including emergency calls, with no user interaction. The zero-click flaw sends a malformed WAP Push message that crashes the Android phone process. Google reportedly patched it in October 2026 updates for Android 14 through 17, but Android 12 and 13 devices remain vulnerable.

Chainalysis said an external actor used offensive agentic techniques to access its systems and internal tools, exposing non-sensitive customer data such as user IDs, full names, email addresses and organization role labels. The company said the breach did not reach investigation content, authentication credentials or session tokens, and it is patching vulnerabilities and hardening systems. It comes as AI-driven attacks rise.

Ahmad Umar Agha, a Syrian Electronic Army hacker, was sentenced in the US to 42 months in prison more than 12 years after charges over a hacking conspiracy prosecutors say was directed by figures close to Bashar al-Assad. The operation, running from 2011 to 2024, compromised about 47 targets, including the 2013 Associated Press Twitter takeover that briefly wiped $136 billion from Dow Jones Industrial Average component stocks.

Drupal said missing authorization checks in its Commerce Core module let attackers bypass access to certain routes and entity fields, potentially affecting a vendor financially. The flaw, CVE-2026-118539, affects Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13 and is being actively exploited. Drupal recommends updating to the latest available release.

CISA added two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after active exploitation. Volexity said actor UTA0576 chained them with an earlier authentication bypass to gain unauthenticated root access, steal credentials and hunt for BitLocker keys. Ivanti said patches are available, with federal civilian agencies required to apply fixes by November 2 and November 13, 2026.

Researchers at Parameter found that a malicious ChatGPT share link could run attacker code in a logged-in visitor's session, letting them list recent conversations and read a private chat. The flaw came from a Preview page and a MathLive graph library that left a listener accepting messages without checking the sender. OpenAI fixed it eight days after the October 18 report and rated it P1, its most serious category.

Cloudflare said it mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026, up from 13.2 million and 10.0 million attacks in the prior two quarters. The company linked the increase to DDoS-for-hire booter or stresser services, with short-burst, low-bandwidth attacks under 10 minutes and 1 Gbps surging 208 percent. Media, IT, gambling, software and telecom were among the most targeted.