One Laptop, $6.3B Gone — Plus AI Hackers, ChatGPT Traps & a PHP Emergency
Saturday, October 31, 2026 · 5-minute read
A Chinese government-linked hacking group called Vapor Panda has been using an AI-powered penetration testing framework called ARTEX to attack more than 200 organizations worldwide since October 17. Targets include foreign ministries and other high-value institutions. Security firm CrowdStrike says the AI tool lets a small team hit far more targets than human hackers could manage alone — a troubling force multiplier for state-sponsored espionage.
↗ The Hacker NewsThe ShinyHunters ransomware group is falling apart fast. A Dutch suspect was arrested after police caught him mid-session on Signal, exposing alleged murder-for-hire orders and secret conversations with ransomware negotiators in the US and Canada. One of those negotiators — a Canadian cybersecurity executive — has now been charged with helping the gang extort its own victims. The FBI says the group has collected over $70 million in extortion payments this year alone.
↗ Krebs on SecurityCloudflare blocked 18.2 million DDoS attacks in Q3 2026 alone — a 38% jump from the previous quarter. That works out to roughly one attack every half-second. The surge is being driven by cheap, easy-to-use "DDoS-for-hire" services that let almost anyone knock a website offline for a few dollars. Short, sharp attacks under ten minutes grew by 208%.
↗ The Hacker NewsSecurity researchers at Parameter discovered a flaw in ChatGPT where a malicious shared-chat link could silently run attacker code inside your logged-in session. Simply opening the link and clicking the Preview button was enough — no downloads, no passwords entered. The attacker could then read all your private ChatGPT conversations. OpenAI rated this its most severe category of bug (P1) and patched it within eight days of being notified on October 18.
A counterfeit version of Anthropic's Claude Code coding assistant was quietly slipped into the Cursor extension marketplace and sat there for about 11 hours on October 29. Up to 5,000 developers may have installed it. The fake extension installed a hidden SSH backdoor, giving attackers persistent remote access to infected machines — including likely access to source code and credentials stored there.
Three Ivanti Connect Secure flaws are being chained together by attackers to get full, unauthenticated root access to affected systems. The first bug lets attackers bypass login entirely. The second lets a logged-in attacker gain admin-level privileges. The third lets them upload malicious files to a known location. Together, they hand an attacker complete control — no password needed. CISA added two of the three to its list of actively exploited vulnerabilities on October 30. The hacking group behind the attacks is previously unknown and has been labeled UTA0576.
Status: CISA has flagged these as actively exploited. Patch immediately if you run Ivanti Connect Secure — federal agencies have a deadline to do so.
A researcher has released a working proof-of-concept exploit for an Android vulnerability that lets an attacker crash your phone or cut off your cellular service just by sending a specially crafted malicious SMS message. You don't have to open anything — receiving the message is enough. A patch exists, but unpatched phones remain exposed.
Status: Patch available. Install the latest Android security update as soon as possible. Check Settings → Security → Security Update.
Two critical bugs in PHP — the language running nearly 70% of all websites — can let an attacker take complete control of any vulnerable server. Working exploits already exist and are being used in the wild. Government websites in Europe went offline after the flaws were made public. Cloudflare deployed emergency firewall rules within hours of disclosure. OpenAI, which helped with the research, called it "one of the most impactful security issues in recent memory."
Status: Emergency patch released. If you manage a website or use a hosting provider, verify your PHP version has been updated immediately. Most managed hosts will patch automatically.
Researchers at Anthropic developed a working exploit for a critical Linux kernel bug that lets an attacker run commands as root on any server running Multipath TCP listeners — with no username or password required. Linux powers the vast majority of the world's web servers and cloud infrastructure, making the potential blast radius enormous.
Status: Patch available. Linux system administrators should apply the latest kernel update immediately. Cloud providers are rolling out fixes, but verify your instances are updated.
Researchers uncovered a cluster of malicious Chrome extensions with a combined install base of 13.4 million users that were quietly redirecting search queries to earn fraudulent ad revenue. The extensions appeared legitimate on the surface — some had high ratings and thousands of reviews. This is a reminder that browser extensions have deep access to everything you do online, including passwords and banking sessions. Until a better vetting system exists, treat extensions like apps: only install ones you truly need and trust.
↗ BleepingComputerCloudflare's automated defense systems blocked 18.2 million network-layer attacks and 14.4 trillion malicious HTTP requests in Q3 2026 — all without human intervention. At one attack every 0.44 seconds, there is simply no way to respond manually. Cloudflare's web application firewall now adapts in real time, including deploying new rules within minutes of novel attacks being spotted, as it did with the PHP vulnerability disclosures this week.
↗ The Hacker NewsSix point three billion dollars. That's how much cryptocurrency was stolen in what Binance is now calling one of the largest crypto thefts ever traced to a single compromised device — a laptop belonging to a DevOps engineer. If you've ever wondered why cybersecurity professionals obsess over employee devices and access controls, this week gave you the starkest possible answer.
A DevOps engineer is someone with unusually broad access to a company's internal infrastructure — they need it to do their job. When their laptop was compromised (Binance hasn't said exactly how), attackers inherited all of that access. Think of it like stealing a master key to a skyscraper. One key. Every door. The attacker didn't need to hack Binance's core systems directly — they just used the engineer's trusted credentials to walk right in. Binance has linked the theft to this single compromised machine and is cooperating with investigators.
For regular people, the lesson isn't just "crypto is risky," though that's true too. It's that the weakest link in any security chain is often a human being with a laptop. Attackers increasingly go after employees — especially those with privileged access — rather than attacking company servers head-on. Supply-chain and insider-adjacent attacks like this are now the dominant playbook. The prize doesn't have to be crypto: the same technique is used to steal customer data, intellectual property, and government secrets.
Watch for Binance's full post-mortem in the coming weeks. The bigger question regulators will ask: did a company handling billions in customer funds have adequate controls to ensure that one compromised laptop couldn't unlock that kind of access? The answer, apparently, was no. Expect tighter rules around privileged access management for financial platforms to follow.