Binance's $6.34B Breach, OpenSSH Flaw Under Attack, and Cold-Chain Threats

Binance Confirms $6.34 Billion Theft Tied to North Korea

Binance disclosed that attackers stole about $6.34 billion in digital assets after combining a fake recruitment interview, a tampered software installer, and compromised internal AI tooling to reach its wallet-signing service. The breach began in June when an engineer installed a poisoned Homebrew build, and culminated on October 29 when attackers exploited Ethereum's EIP-7702 mechanism to gain partial control of a hot wallet. The FBI has linked the attack to North Korea's TraderTraitor group. Binance says it has restored withdrawals and recovered a large share of user losses. (Help Net Security)

CISA Adds Actively Exploited SonicWall SSLVPN Flaw to KEV

CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN single-factor authentication flaw, to its Known Exploited Vulnerabilities catalog on November 6 based on evidence of active exploitation. The flaw can let a user holding valid alternate credentials bypass SAML authentication, including SAML-enforced multi-factor authentication. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws that grant full control of exposed assets. CISA encourages all organizations, not only federal agencies, to treat this flaw as a high priority for patching. (CISA)

US Agencies Warn of Attacks on Cold-Chain Refrigeration Systems

CISA, the FBI, HHS, USDA, and DOT jointly warned on November 5 that malicious actors are targeting industrial refrigeration and cold-chain monitoring systems used across healthcare, food, chemical, and transportation sectors. Attackers are exploiting unpatched or internet-exposed electronic temperature and refrigeration controllers in retail grocery and cold-storage facilities, potentially forcing continuous heating and defrost cycles that risk inventory loss, fire hazards, and spoiled medicine or food. The agencies urged operators to remove devices from the internet, change default passwords, patch firmware, and retire unsupported legacy equipment. (CISA)

Cyberattack on Refrigeration Vendor Hits French Blood Banks

France's Blood Establishment (EFS) disclosed that a cyberattack on a refrigeration equipment provider altered temperature and defrost settings in cold rooms at three blood banks, part of a wider wave of attacks on European supermarket and cold-storage refrigeration units. EFS said its monitoring systems caught the anomalies in time, no blood products were affected, and collection and distribution continue normally. The provider was reportedly compromised on November 2. EFS is working with ANSSI, France's national cybersecurity agency, and the Ministry of Health to investigate. (Help Net Security)

Norad Grants Portal Breach Exposes 20,614 Users

Norway's development aid agency Norad disclosed that attackers used 27 compromised accounts to breach its Grants Portal, potentially exposing the names and email addresses of all 20,614 registered users across 12,511 organizations. The intrusion, discovered on October 30, also resulted in theft of applications and supporting documents from three organizations outside Norway. Norad cannot rule out that attackers saw applicant names tied to conflict zones and authoritarian states. The agency has reported the incident to police, Norway's Data Protection Authority, and the National Security Authority, and brought in external cybersecurity experts. (Help Net Security)

Supply-Chain Attack on cPGuard Hits Nearly 3,000 Servers

OPSShield disclosed that an attacker compromised cPGuard's update infrastructure and pushed a malicious update to roughly 2,950 of the Linux security suite's customer servers on November 2. The attacker also stole contact information and hashed passwords for about 7,900 customers from OPSShield's billing and licensing server, along with password hashes, root SSH keys, and cloud storage keys collected from compromised servers. OPSShield has revoked the stolen update key, rotated credentials, released clean update 5.88.26, and is still investigating how the attacker first gained access. (Help Net Security)