C3RB3R ransomware hits Synology NAS (.L0CK3D): update DSM, close admin ports to the internet
Since early October, Synology NAS owners whose data was encrypted have been asking Chinese security vendor Qihoo 360 for help; 360 published an alert on 29 October. Synology and the researchers disagree on how attackers get in, and one victim was on the latest DSM.
Binance: a hacked DevOps laptop may have started the theft. Check what one admin device can do alone
On Thursday an attacker moved crypto out of Binance hot wallets. On 30 October the exchange estimated the impact at about $6.3 billion and said its early findings pointed to a DevOps engineer's compromised laptop; its co-CEO later added that the attack was more complex and had further points of breach.
PHP2Shell roots Palo Alto firewalls with exposed admin pages: restrict access, look for web shells
Dream reports that a suspected China-linked attacker chained PHP2Shell, two PHP flaws, with the Fragnesia kernel bug and got root on 24 firewalls with internet-facing management across South Korea, Taiwan, Japan and the US on October 23–24. Dream withheld the vendor; The Register, via Mezha, says the devices run Palo Alto Networks PAN-OS versions 12.1 and 12.2.
AES-256 PDFs from MuPDF < 1.28.5 and one Foxit build open without the password: update MuPDF
Researchers at v12.sh showed on 28 October that several PDF programs and libraries generate the AES-256 file key from randomness so limited it can be guessed. The key falls in milliseconds for MuPDF before 1.28.5 and, for recent files, Foxit PDF Reader build 2026.1.3.36551. Decryptors for both are public. The researchers told the vendors; a fix is reported only for MuPDF.
Fake ChatGPT and Claude desktop apps on GitHub carry malware: get AI tools only from the vendor
Check Point Research has analysed Yoba, a campaign it followed for about two months. Fake GitHub projects named after AI desktop apps such as "GPT-5.6 Sol", "GPT-6 Astra" and "Claude Opus" appear near the top of Google, and their ZIP downloads bundle an authentic, signed OpenAI or Claude Setup.exe with a malicious DLL it loads. The first malicious releases went up at the end of August 2026.