Elliptic’s 2 November snapshot of the Binance theft puts about $2.85 billion frozen or seized and about $3.24 billion still sitting in addresses no issuer can freeze. A day earlier Mercado Bitcoin, Brazil’s largest exchange, stopped deposits and withdrawals after its hot wallets were drained across at least ten chains. Loss estimates run from about $38 million to $49 million. For patching, a CVSS 10.0 Node-RED flaw on Siemens SIMATIC IoT2050 Advanced gateways is being exploited, and Synology has issued its first attack warning in years over C3RB3R ransomware hitting outdated DSM.

Do today

  • Siemens SIMATIC IoT2050 Advanced: update to V4.3.4.1, or uninstall Node-RED or put authentication on it. VulnCheck has seen exploitation since 30 October. (Siemens SSA-834709, VulnCheck)
  • Synology NAS: update DSM to the builds listed in Synology-SA-24:20, turn on automatic updates, and take DSM management off the internet. (Synology warning)
  • KEV due today: Plex Media Server CVE-2026-96652 and CVE-2026-96655, and Siemens Software Center CVE-2026-110936. (CISA KEV feed mirror)
  • Langflow: upgrade to 1.13.0. Every release from 1.0.0 through 1.12.8 has an unauthenticated bypass and code injection. (IBM security bulletin)
  • Exchanges and bridges: add the Mercado Bitcoin drain address that Arkham identified, 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478, to screening alongside the FBI’s Binance list. (Arkham research, Blockscout transaction)
  • WordPress sites with CryptoPayment Gateway: remove the plugin, rotate the wallet credentials it stored, and check for settings changes. There is no fix. (WPScan)

AI and agent security5 stories

  • Langflow: unauthenticated bypass and code injection in every release up to 1.12.8 (CVE-2026-93680, CVE-2026-110186) — IBM’s bulletin, published 28 October and updated 29 October, covers seven flaws in Langflow OSS 1.0.0 through 1.12.8. Two are rated 9.8: an improper-authentication bypass and a code injection that lets a remote attacker run code. A third, rated 8.8, lets a low-privileged user get the built-in Agentic Assistant to generate code that runs OS commands. The fix is 1.13.0, and IBM lists no workarounds. One press report says a public Metasploit module already references the bypass. We could not confirm that, so treat it as unconfirmed. Our take: Langflow servers usually hold API keys for every model and tool they connect to, so treat an exposed instance on 1.12.x as a credential incident, not just a patch job.
    CVSS 9.8 (v3.1, IBM) EPSS 0.0218 / 0.0062 KEV no (IBM security bulletin, CVE-2026-93680 record)
  • AWS Serverless MCP Server: project names could walk out of the deployment-status folder (CVE-2026-116635) — AWS published bulletin 2026-164-AWS on 2 November for awslabs.aws-serverless-mcp-server, its MCP server for building and deploying serverless apps. An actor who can influence the agent could put traversal sequences or an absolute path in the project name. That lets them read JSON files outside the deployment-status directory, and create or overwrite them if write access is enabled. Version 0.2.1, released on PyPI on 30 October, fixes it. AWS lists no workarounds and rates it Important without giving a score. Our take: this is a textbook case of prompt-controlled input reaching file paths. Treat every MCP tool argument as attacker-controlled, as you would a web form.
    CVSS not published by AWS EPSS not yet scored KEV no (AWS bulletin 2026-164-AWS, PyPI release history)
  • VOLTA infostealer asks an LLM which victims are worth working — Cisco Talos describes VOLTA-AUTODOXER, a self-deleting Windows stealer. It packages stolen credentials, sessions, cards and wallet data into an identity report, then sends the report through OpenRouter to a hosted model for a monetisation and opsec assessment. The default model is a Claude Opus model, and when it refuses the stealer falls back to Kimi K2 and then Gemini 2.5 Flash. It also uses stolen sessions to search Gmail for receipts that confirm a home address. The sample was first seen on 11 October. Talos describes a builder sold to customers and saw no attacker-owned infrastructure, because every endpoint is a third-party service. Our take: the AI layer saves the criminal triage time, but the defences don’t change. Alert on headless Chrome started by unknown processes, which is how VOLTA gets past App-Bound Encryption, and keep secrets in hardware-backed stores. (Cisco Talos)
  • DeepSeek publishes a proactive coding agent that listens to team chats — DeepSeek released dsh-superagent as an MIT-licensed research prototype. It watches one GitHub repository, and Feishu if enabled, and opens work items when an allowed person asks or a team-written rule permits it. The README says plainly that it is not an official product or production-ready, and the authorization rules live in a separate design document. Our take: this design, where chat messages can trigger a coding agent, is where indirect prompt injection does its damage. Anyone piloting it should keep the request allow-list short, review any automatic merging, and run it with a repository token scoped to that one repository. (dsh-superagent repository)
  • OpenCode’s free model tier could be reset by changing IP address — Socket reports that usage limits on OpenCode’s free hosted models were keyed to the connecting IP address. Switching VPN exits restored quota without breaking the session, and the reporter says they automated this for weeks. The GitHub issue was closed in October without an announced fix and later deleted, but an archived copy remains. An October change addressed spoofed IP headers, which is a different problem, and the hosted service’s current enforcement is unclear. Our take: limits on anonymous AI access are a fraud-control problem, and pricing them by IP address invites abuse through residential proxies. Anyone running a free inference tier should expect the same. (Socket, OpenCode issue 57102, OpenCode PR 55120)

Application security5 stories

  • ACF Extended PRO: unauthenticated calls to arbitrary WordPress functions (CVE-2026-120534) — Wordfence’s record, published early on 3 November, covers Advanced Custom Fields: Extended PRO through 0.9.2.6. The plugin merges form configuration into field settings and passes it to call_user_func_array without enough validation. Two non-default conditions must both hold: an admin has enabled shortcode_preview on a form, and the server lacks OpenSSL, so ACF Pro’s decryption falls back to unverified base64. The CVE record names no fixed version, so check the vendor changelog. Our take: the preconditions make mass exploitation unlikely, but check for OpenSSL-less PHP builds anyway. They weaken more than this one plugin.
    CVSS 9.8 (v3.1, Wordfence) EPSS not yet scored KEV no (NVD CVE-2026-120534, ACF Extended changelog)
  • Ultra Addons for Contact Form 7: unauthenticated file deletion through a PDF gadget chain (CVE-2026-102435) — Versions through 3.5.54 fail to validate a file path in _getObjAttr. With the PDF Generator add-on active and a form set to generate PDFs, an unauthenticated attacker can delete arbitrary files through a deserialization gadget chain in Contact Form 7. Deleting wp-config.php usually leads to a site takeover. The record cites a plugin changeset but does not name a fixed version, so the fixed release is unconfirmed. Our take: if you use the PDF add-on, update and confirm that your release includes changeset 3738548. If you don’t use it, turn it off.
    CVSS 9.8 (v3.1, Wordfence) EPSS not yet scored KEV no (NVD CVE-2026-102435, plugin changeset 3738548)
  • s2Member: PHP code execution through PayPal notification templates (CVE-2026-86596) — In s2Member up to version 260927, strip_php_tags_deep() removes only literal <? sequences. A later placeholder cleanup can rebuild a <?php opener after the attacker’s item_name value has been inserted into an email template. The scores disagree with the text: Wordfence’s vector says no privileges are needed, but the description requires an authenticated user with a custom access level or higher. The fixed version is unconfirmed. Our take: membership sites hand out custom levels to paying users by design, so “authenticated” here can mean any customer.
    CVSS 9.8 (v3.1, Wordfence; vector disputes description) EPSS not yet scored KEV no (NVD CVE-2026-86596, plugin changeset 3722434)
  • ape-volo-admin: a hard-coded JWT key forges admin tokens (CVE-2026-120442) — VulnCheck reports that the .NET admin framework shipped its JWT signing key in appsettings.json. Anyone can therefore sign a token offline, set the jti claim to the seeded administrator ID, and take full control of the API. Version 3.6.1 fixes it. Our take: rotating the key is not optional. Deployments that copied the sample settings keep the published secret even after upgrading, so generate a new key per environment.
    CVSS 9.8 (v3.1, VulnCheck) CVSS 9.3 (v4.0, VulnCheck) EPSS not yet scored KEV no (VulnCheck advisory, ape-volo-admin V3.6.1)
  • madong-admin-saas: the platform tenant API checks no credentials (CVE-2026-120446) — In madong-admin-saas through 5.1.4, the platformapi middleware key never matches the platform application. Unauthenticated users can therefore call tenant account, plan-binding and data-sync endpoints. The CVE record cites a commit and an issue but names no fixed release, so the fix is unconfirmed. VulnCheck scores it 9.4 under v3.1 but only 8.8 under v4.0. Our take: in multi-tenant admin kits, the platform-level API is the crown jewel. Firewall it to operator IP addresses until a tagged release ships.
    CVSS 9.4 (v3.1, VulnCheck) CVSS 8.8 (v4.0, VulnCheck) EPSS not yet scored KEV no (NVD CVE-2026-120446)

Exploited and critical CVEs4 stories

  • Siemens IoT2050 Advanced: unauthenticated Node-RED is being used to plant bots and web shells (CVE-2026-58115) — Siemens fixed the missing-authentication flaw in August (SSA-834709). It affects SIMATIC IoT2050 Advanced below V4.3.4.1 running Industrial OS with Node-RED installed, and lets an unauthenticated attacker create flows that run arbitrary code. VulnCheck’s canaries caught exploitation on 30 October. One source IP hit them 16 times through 1 November, first dropping a Linux bot, then a second dropper and persistent web shells. VulnCheck has added it to its own KEV list, but it is not in CISA’s catalog. Our take: these are edge gateways that often sit between IT and OT networks. Update, or remove Node-RED, and check existing flows for anything you didn’t write.
    CVSS 10.0 (v3.1, Siemens) EPSS 0.0095 KEV no (CISA); yes (VulnCheck) (Siemens SSA-834709, VulnCheck)
  • Synology warns of C3RB3R ransomware hitting outdated DSM — Synology’s 29 October warning says attackers are exploiting a vulnerability patched in December 2024 to encrypt NAS data and demand ransom. It points owners to advisory Synology-SA-24:20, which was published in November 2024 and covers three flaws: code execution, file read and file write. Synology does not say which flaw is being used, so the CVE is unconfirmed. Synology tells owners to update DSM and enable automatic updates. Press reports say victims find a read-me3.txt note and a .L0CK3D extension. Our take: Synology issues attack warnings rarely, so take this one seriously. Any NAS whose DSM login page is reachable from the internet should be pulled behind a VPN today. (Synology warning, Synology-SA-24:20)
  • KEV: no additions since 30 October; Plex and Siemens Software Center fall due today — CISA’s catalog is still at version 2026.10.30. Today is the due date for Plex Media Server SSRFs CVE-2026-96652 and CVE-2026-96655 and the Siemens Software Center search-path flaw CVE-2026-110936, all added on 20 October. The GitLab regex-compiler bug CVE-2026-97229 and Cisco ASA/FTD CVE-2026-76418 passed their 1 November deadlines, and GitLab’s EPSS now sits at 0.273 (98th percentile). Next up: Broadcom ESX CVE-2026-41709 on 11 November and Ivanti CVE-2026-118527 on 13 November. Our take: past-due KEV entries with EPSS this high are the ones attackers keep scanning for. Confirm every self-managed GitLab carries GitLab’s 12 October patch release.
    EPSS 0.2730 (CVE-2026-97229) KEV yes (CISA KEV feed mirror, GitLab 19.4.2 patch release)
  • Control Web Panel: OS command injection in the protected-directory module (CVE-2026-77876) — VulnCheck’s 2 November advisory says CWP before 1.16 passes the file parameter of the protected-directory delete action to shell_exec without escaping. That gives command execution in the user-panel context. Version 1.16 fixes it. The CVSS vector says no privileges are needed, but the description places the flaw in the user panel. Treat it as reachable by any hosting customer until proven otherwise. Our take: hosting control panels are reachable by every tenant on the box, so update shared-hosting servers first.
    CVSS 9.8 (v3.1, VulnCheck) CVSS 9.3 (v4.0, VulnCheck) EPSS not yet scored KEV no (VulnCheck advisory, CWP changelog)

Cloud and infrastructure2 stories

  • Google Cloud adds a $250,000 tier for full tenant takeover — Google’s Cloud VRP now pays up to $250,000 for proof of owner-level IAM control over arbitrary Google Cloud organisations or projects. Qualifying chains cannot start from prior access, stolen credentials or social engineering. Researchers prove control against a designated service account rather than real customer projects. Remote code execution reports in Borg are assessed for the same tier, and researchers must stop at first execution there. Our take: a top reward that requires cross-tenant isolation bypass shows where cloud providers think their real risk lies. Customers should still assume shared-tenancy bugs will happen and keep their own detection on IAM changes. (Google Cloud blog)
  • Second wave of freezer sabotage hits supermarkets in Belgium, Sweden and beyond — Belgian refrigeration installer Sabcobel says about 20 of the hundreds of units it manages were switched remotely into defrost mode from around midnight on Sunday. Delhaize, Carrefour and Spar stores were among those hit. Technicians disconnected the affected units, and the installer says a software update alone won’t fix them: they need physical changes. The Record reports more than 50 Belgian stores affected and over a dozen more across Ireland, Estonia, the Netherlands and Luxembourg. It also says Danfoss and Copeland describe the devices targeted in France in October as mostly discontinued. Our take: these are internet-exposed controllers that no longer get updates. Move them behind a VPN or onto a cellular private network, and alarm on any setpoint change made outside a maintenance window. (Belga / Sabcobel, The Record)

Crypto and Web34 stories

  • Binance: about $3.24 billion of the stolen funds is still loose, mostly in ETH and BTC that no issuer can freeze — Elliptic’s 2 November snapshot says about $2.85 billion has been frozen or seized, mostly stablecoins. Circle froze all 823 million stolen USDC, but about $786 million of stablecoins was converted before the freezes took effect. The laundering has run mainly through Tron, split across about 7,700 addresses, with at least $147 million bridged off as ETH through at least seven bridges. Since 1 November, ETH, SOL, NEAR and XRP have started moving, and about 28 BTC has gone through Wasabi-style coinjoins. Roughly 68,700 ETH sits in about 850 addresses, and the nine largest have not moved since 30 October. Our take: freezes depend on the issuer. Screening for native ETH and BTC, and for bridge payouts, is where the rest of this money will surface. (Elliptic, laundering update, Elliptic, compliance guidance)
  • Mercado Bitcoin: hot wallets drained across at least ten chains; loss figures range from $38M to $49M — Brazil’s largest exchange suspended deposits and withdrawals on 2 November and confirmed unauthorised access to one of its systems. It says no customers were harmed and no data was breached. On-chain, a 2,852.07 ETH transfer at 06:24 UTC on 2 November moved from an exchange hot wallet to 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478, the address Arkham labels as the attacker’s. That one transfer was worth about $6.5 million. Arkham puts the total at at least $46 million. Press reports cite about $49 million from Chainalysis and $48.5 million from Bitquery, while the company itself cites $38 million involved and $11 million blocked. The figures don’t agree, and the reports don’t say whether the blocked funds are included. Blockchain analysts also dispute the claim that no customer funds were touched, saying some customer deposit addresses were emptied. Our take: when ten chains’ hot wallets drain within hours, the attacker controlled the signing infrastructure, not a single key. Look at how your hot-wallet signers share infrastructure. (Arkham research, Blockscout: 2,852 ETH transfer, The Record)
  • Premia v3 on Arbitrum: six option vaults emptied in two transactions a second apart — Arbiscan shows the first transaction at 03:15:39 UTC on 1 November, from an address tagged Premia Exploiter 1 to a contract tagged Premia Exploit Contract. It drew funds from the Balancer Vault and minted and burned option tokens repeatedly, and about 43.2 ETH reached the exploiter. Reported outflows across the six vaults are about 3.64 WBTC, 43.5 WETH, 48,479 USDC.e and 46,215 ARB. Firms’ dollar estimates differ: about $400,500 (Blockaid), $437,000 (Coindaro) and $464,600 (PeckShield). Premia has not published a root cause or recovery plan. Our take: if you integrate Premia v3 pools on Arbitrum, pause deposits until the team explains the bug. (Arbiscan transaction)
  • CryptoPayment Gateway for WordPress: exploitation attempts against an unfixed 10.0 (CVE-2026-81648) — WPScan lists versions 1.2.1 and 1.2.2 as letting unauthenticated users delete arbitrary files and overwrite the gateway’s settings through an unguarded AJAX router, and has no known fix. Press reports add that stored wallet credentials can be recovered in cleartext. WordPress.org closed the plugin in August. Defused Cyber reports in-the-wild exploitation attempts as of 3 November. We could only see that claim on social media, so treat the exploitation as reported, not confirmed. Our take: any site that ever ran this plugin should assume its wallet keys are known and move funds to a new key. Uninstalling isn’t enough.
    CVSS 10.0 (WPScan) EPSS 0.0050 KEV no (WPScan, WordPress.org listing)

Incidents and industry1 story

  • Google dismantles the XCPE Android TV box botnet and bans the manufacturer it blames — Google Threat Intelligence Group says a firmware backdoor enrolled more than 1.3 million set-top boxes. It assesses with high confidence that Android OEM Videostrong Technology built and ran the botnet, selling access to criminals for ad fraud, residential proxies and further malware. Legal takedowns also hit the command-and-control domains of more than a dozen affiliate families, cutting off at least 10 million more devices. Videostrong is barred from building certified Android devices. Partners included Japan’s National Police Agency, Lumen, HUMAN, Plume, Synthient and TrendAI. The packages reinstall from the firmware partition, so the takedown does not clean the boxes. Our take: block Google’s published command-and-control domains at the network edge, and treat unbranded TV boxes on corporate or guest networks as compromised proxies. (Google Threat Intelligence Group, Synthient)

Bottom line

  1. Binance’s stablecoins were largely frozen, but about $3.24 billion in ETH and BTC is still moving or waiting. Screening native assets and bridge payouts now matters more than issuer freezes.
  2. Mercado Bitcoin is the second exchange in a week to lose hot wallets across many chains at once. Review signer isolation and withdrawal circuit-breakers, not just key storage.
  3. The exploited bugs today, on Siemens IoT2050 and Synology DSM, were patched months or years ago. Find edge and storage devices that aren’t on your patch reports before attackers do.