this week in security — november 1 2026 edition

THIS WEEK, TL;DR

Hacker breaches Homeland Security login system, personnel data published
TechCrunch ($): Buckle up for another eyewateringly bad week in cyber… Homeland Security is the latest U.S. federal department to get hacked after a hacker stole names, email addresses, phone numbers, and business contact information for 40,000+ agents, officers, and staff across the department and its many agencies, like CBP and ICE. The database, dubbed Icepick by nonprofit transparency group DDoSecrets, which hosts the data, was sourced from an Okta system used by Homeland Security. The leaked data is the broadest look at DHS as a whole right now, and will allow researchers to FOIA for records that they couldn't before. The data also shows how DHS is using web snooping and phone hacking tools via access to employee user groups. (Disclosure: I wrote this story!) A search site allowing anyone to access the data was briefly knocked offline after DHS filed a takedown request with the domain registrar, and Bluesky kicked off a storm by blocking links to DDoSecrets. This breach follows at least two other major government hacks on the FBI and the Pentagon's HR department. If only CISA (also affected by the DHS breach) wasn't gutted by Trump, the department might've had a fighting chance.
More: Wired ($) | BBC News ($) | Techdirt | FlockiNET | BankInfoSecurity | Biometric Update | @emma.best

Binance hacked by suspected North Koreans, over $6.3 billion in crypto stolen
Associated Press: The world's largest crypto exchange Binance was hacked and its hot wallets raided to the tune of ~$6.3 billion — yes, billion — about half of which looks like it may have been irretrievably lost. North Korea is the top suspect in the breach, per blockchain trackers TRM Labs and Elliptic, and — as of the weekend — the FBI. This is by far the largest crypto heist in history, and clearly not good if North Korea's involved, as the regime's sole focus is dedicated to furthering its internationally sanctioned nuclear weapons program. The New York Times ($) has a rundown of how the hack played out, which largely happened during a 20 minute window. Binance initially blamed the hack on a compromised engineer's laptop, leading to the obvious question: How was a single employee's laptop able to access systems capable of controlling billions of dollars in funds? Binance's investigation continues, including into "additional points of breach." Citation Needed also does a fantastic job of explaining how North Korea may (or may not!) cash out. Also in financial fusterclucks: Polymarket paused trading after $2.5 million in funds were drained, thanks to a compromise of third-party code on its website.
More: NBC News ($) | BBC News ($) | NPR | Sky News | Associated Press | Decrypt | @oration | @binance | @molly.wiki | @cz_binance

CISA confirms PHP2Shell bugs are now being used in attacks
The Record: It looks like we've largely avoided mass-hacks relating to PHP2Shell, the two recently discovered bugs in the widely used programming language, but exploitation is starting to happen across pockets of the internet. New research from Dream found that PHP2Shell was chained together with another bug to target firewalls made by Palo Alto Networks, allowing hackers to break into networks. Dream found evidence that 25 servers had been exploited, including at least one "affiliated" with the U.S. government. CISA has also confirmed there's now confirmed in-the-wild exploitation of PHP2Shell. If it's feeling like it's just one cyber fire after another, you're not wrong — the WSJ ($) dives into this awful month for cyber, dubbed Black October — whereas astute readers will also remember that October was… Cybersecurity Awareness Month. Well, now we're aware!
More: Wiz | Microsoft | SecurityWeek | Bleeping Computer | Infosecurity Magazine | The Register | NextGov | ~this week in security~

A wave of cyberattacks and data breaches hit companies in Asia, Europe, and Israel
A minute-blast through some international news… *start the clock*… Japanese internet giant GMO had a breach of its Onamae service, which provides cloud virtual desktops to financial traders. Some 26,000 customer servers could be affected, per TechCrunch ($)... Meanwhile, a fresh wave of hacks hit South Korea's financial industry as three big firms report breaches, reports Reuters ($)... and Belgium's tax agency was targeted by a cyberattack, forcing it to take down its tax portal (via Euronews)... Dotting across Europe now to Moldova, and more than 80 public service websites were downed by a cyberattack, with close to two-dozen sites still offline. Some 750,000 people had personal data stolen during the breaches, or around a third of the Moldovan population… Oh, and, Israel's largest vehicle importer Colmobil was hit by ransomware. *stops watch*
More: /r/cybersecurity ($) | Risky.biz | @metacurity.com

THE STUFF YOU MIGHT'VE MISSED

Thousands of solar systems around Germany are vulnerable to hacks
Die Zeit: Hackers had access to backend systems that allowed them to control some 250,000 solar systems made by Chinese maker Sungrow across Germany, mostly run by private citizens. The hackers' access could have allowed them to switch off the systems at the same time, potentially causing a power grid crash across Europe. More from security firm Jakkaru on the technicals. Flashback: In 2024, researcher @evstykas sounded the alarm on how rooftop solar systems can be super hackable.

U.S. military treating base freezer malfunctions as suspected cyberattack
Reuters ($): A series of apparent freezer malfunctions across U.S. military bases are now being treated as suspected hacks, per @raphae.li, @ajvicens, et al, who report (and pun) throughout. The freezer issues resulted in food spoiling — not just from defrosting but the active heating up of freezer units. Weeks later, a spate of mass-hacks similarly involved the heating up of refrigeration units across France. That connection seems to have the U.S. and French officials now in cooperation to investigate the incidents. The suspected hacks were first reported back in August by Signal and Silence. U.S. officials now believe that Iran may be behind the freezer attacks. Also, catch up with @tarah who has some smart words for the Financial Times ($) about why low-level bugs are now getting popped.

Web hosts DreamHost, Linode, and 123-Reg disclose security incidents
Several web hosts reported incidents this week, including… *breathes in*... DreamHost reset a bunch of customer passwords for email and FTP access after a now-resolved security incident, reports Bleeping Computer, which is more than what DreamHost seems to have said so far (booo!)... 123-Reg says it was hit by an AI-driven hack that allowed the scraping of customer contact information, per The Register (of no relation)… and, Linode is working on deploying server-side fixes for a critical-rated bug in Linux Red Hat, which many web hosts use to run their servers, but has no patches yet.

Israel ads-for-spyware company targeted Starlink satellite users
Reuters ($): Security researchers at TrendAI found that Discover-Tech, an Israeli ads company that helps spyware makers target people by showing them malicious online ads, was heavily targeting Starlink satellite internet users. The researchers believe the ads were most likely being used to geolocate or otherwise spy on people.

How security researchers prevented a potential future Popcorn Time botnet
Eye Security: Eye researchers found that the long-abandoned Popcorn Time app was still pinging out for updates at a domain that was no longer registered, potentially exposing millions of app users to getting hacked by way of malicious updates. Eye registered the domain, and remotely disabled the update mechanism by pushing an update to some 2-3 million computers around the world, located thusly:

Russian hackers are launching attacks across NATO that cause physical damage
Bloomberg ($): In a brilliant bit of work by Bloomberg, the incredible @rjgallagher.co.uk explores how hackers aligned with Russia are causing physical damage and disruption to physical systems, such as crematorium ovens to winery temperature control systems, across Spain and 20 other countries — many of which are NATO members. This is thought to be the latest prong in Putin's "hybrid" war against the West, including causing cyberattacks and other acts of sabotage designed to sow confusion and spark panic.

Please, for the love of all that is holy, don't share your banking passwords with AI
TechCrunch ($): In things that probably shouldn't have to be said and yet we're here saying it, Bank of America would like to remind you that sharing your banking password with an AI model, agent, or assistant is a very bad idea. If things go wrong, then the responsibility is still on you! (Disclosure: I wrote this.) This comes as Axios reports that banks are trying to figure out if humans are logging in or their AI agents. Uhhh: I guess, ditto for defense contractors with Pentagon systems access?! Come on!

What happens when an AI company goes bankrupt? Your data can get sold
BBC News ($): We all know by now that the economics of AI don't add up and don't seem sustainable, which is why we're already seeing AI companies going out of business. Character.ai is one such company, whose assets are going to Disney, but whose user data can get sold elsewhere. U.S. attorneys-general aren't happy, but might not be able to do much since there are no data privacy laws in the United States. The Beeb explores why the sale of AI companies' data can put anyone at risk, and what you can do about it.

OTHER NEWSY NUGGETS

Wyden's surveillance siren is blaring again: Two senators who've long overseen U.S. intelligence in Congress say that the Trump administration is illegally withholding a secret court ruling until lawmakers pass a law that allows the government to continue spying on Americans without a warrant. This is just the latest Wyden siren this year… (via Wired ($))

Wake up, BAE; no data leaked: U.K. defense contractor and IT firm BAE apparently got lucky after a recent cyberattack on the U.S. bankruptcy court systems didn't leak anyone's personal data. (via SecurityWeek, U.S. Courts)

Apple warns of bug under attack: Apple has sent out a new round of threat notifications warning an unknown number of customers that spyware was targeting them. Apple doesn't attribute attacks, but does say that this latest round went out to people in 99 countries. A filmmaker received one of the threat notifications. (via Cyberscoop, @craiu)

Researchers detail Volt Typhoon's hack chain: The network investigators at Lumen have put solid evidence behind the U.S. government's long-standing claims that Volt Typhoon, a China-backed hacking group, is prepositioning malware on U.S. critical infrastructure in the event of an invasion of Taiwan. Lumen disclosed how the Chinese hackers are pulling off their stealthy hacks, oftentimes by chaining together lists of compromised routers and internet-of-things devices to slip in and out of networks. Kim Zetter with the deets.

Cursor 'ccused of Claude Code compromise: Anthropic's official Claude Code for VS Code extension bundle on the Cursor Marketplace was compromised for half-a-day. The hacked bundle planted a persistent cross-platform backdoor on the system of anyone who installs the software, or auto-updates it. (via Phorion, Wired ($), DoublePulsar ($), Ars Technica)

Bunch of breaches: Ed-tech maker Frontline, which makes school management software for 50 million students, had a data breach exposing student Social Security numbers and more, per a scattering of notices with state AGs so far. Not to be outdone: A new breach at Florida's Department of Education's student financial aid portal affects just shy of 5 million people, including kids. Also… *pinches bridge of nose*... Applebee's left its customers' personal data exposed to the web after leaving a hardcoded key in its app. And: Fan-fic site AO3 will be down for weeks as it rebuilds following a cyberattack.

ICO slaps GCHQ over lost USBs: U.K. privacy watchdog ICO said [PDF] it was "disappointed" (which is a 10.0 on the severity scale of things British people say — source: me) that U.K. spy and eavesdropping agency GCHQ can't account for literally thousands of flash drives, discs, and external drives that may have had surveillance data on them. Not ideal! (via The Record, Politico)

THE HAPPY CORNER

Welcome back to this week's happy corner, where we're in for a retro treat!

"Save it in the cloud," they said. Well, how's that turning out? Thanks to @helenkennedy for showing us that it's still possible to run decades-old software and have fun doing it.

And since we're here… Hey, kids, anyone under the age of 30 probably won't remember this but, soak in this raw nostalgia from 1998 by listening to this computer boot up. Just listen to those physical button presses, the floppy drive buzzing, and the gentle crackle from the cathode ray tube monitor… ahhh. They really don't make computers like they used to!

Shoutout to friend of the newsletter @yaelwrites, who was in NYC this week to pick up her Pulitzer Prize along with @byrontau, @dakekang and others, for their incredible work uncovering secret government surveillance and tracking.

Before we go… pour one out for Sir Patrick Stewart, acting legend, ally, and man of many memes, who passed on this week. In the belated Hallowe'en spirit, here he is dressed one year as a lobster.

And, lastly, the ~spoooooky~ season may be over, but never stop checking for North Koreans in your candy, your enterprise, your open-source projects… you never know where they'll pop up.

Have good news to share? Get in touch! [email protected].

CYBER CATS & FRIENDS

This week's cyber cat is Ramona, who will lure you in with promises of belly fuzz but will steal your passwords the minute you're distracted. Thanks so much to Kez for sending in!

SUGGESTION BOX

And that's it for another very busy, crazy week month of cybersecurity. Pretty much every day has felt a little bit like this:

In any ongoing shituation, especially cybersecurity, it's important to rest as much as it is to battle. Take the time for yourself, rest, recharge, and remember what matters most: people, community, and doing things that are offline. That's where I'm going now, specifically a pottery studio in my neighborhood to wheel-throw some clay. These days, if I'm not doing something cyber, I'm probably doing ceramics.

Thank you so much for reading and supporting this newsletter, and I hope it helps you weed out the news from the noise. It's also a joy to write it every week — thanks to everyone who drops me tips and ideas. If you have any feedback, please do get in touch — I love hearing from you, and it always helps me to make the newsletter better. And feel free to share this edition on your social media, it's always appreciated.

November, here we go!
@zackwhittaker

Subscription details

You are receiving this because you are a free subscriber to ~this week in security~.