In partnership with
| FACT | The Amadeus booking platform behind this week's Japan Airlines breach is used by more than 400 airlines, 210 airport operators, 34 cruise and ferry lines and 2 million hotels. (BleepingComputer, October 2026) |
|
The weakest link keeps being the thing you trusted by default: an employee laptop, a vendor's booking system, an extension with a familiar name. This edition is about what slips in through the door you left open on purpose. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
In this edition | | | | | 🏛️ Privacy, Power & Policy |
| | |
|
Nation-State / Crypto Theft One Laptop, 20 Minutes, $6.3 Billion: Inside the Binance Heist Intro Hackers stole at least $6.3 billion from Binance wallets, the largest crypto theft on record. Binance says it began with a single compromised engineer's laptop. What Happened Per Binance, the attacker used that laptop to reach a service container and submit unauthorized withdrawals; it says it has seen no evidence private keys leaked. TRM Labs blames North Korea's TraderTraitor group and says the theft took about 20 minutes. Elliptic also points to North Korea and says some funds hit a wallet tied to this year's $351 million Bitget theft. Binance suspended all deposits and withdrawals, and partners have frozen about $3 billion. Why It's Important One endpoint reaching systems that can move billions is a design problem, not bad luck. TraderTraitor was also blamed for the $1.4 billion Bybit theft in 2025, now the second-largest on record. The Other Side The attribution comes from private firms, not governments, and the total may still change. Binance says "user funds are safe" and promises an updated proof of reserves. | | 👉 Takeaway Map which laptops can reach your money-moving systems, then cut that list down. Treat developer and DevOps endpoints as production. |
TL;DR: North Korean hackers reportedly turned one Binance engineer's laptop into a record $6.3 billion theft. |
| | Exposed Data Researcher Robert Wiggins used AI to comb the app's code and found a credential exposing customers' names, emails, birth dates, phone numbers, veteran status and login IPs; it could also change data. Applebee's had 8.5 million-plus rewards members last year and no way to report bugs. Dine Brands says it has found no evidence of unauthorized access. → If your app ships secrets, attackers with AI will find them first. |
| | Supply Chain Amadeus told JAL on October 23 that someone had access to its passenger system from August 2023 to September 2026. Most lost booking codes, names and routes; about 2,000 also lost passport and frequent flyer numbers. Asiana and Korean Air confirmed impact, and ANA reportedly too. No cards or passwords were taken, JAL says. → Your vendor's breach window can run three years before you hear about it. |
| | Data Breach Florida's Department of Education learned of the breach October 19: names, addresses, emails, birth dates and Social Security numbers of state aid applicants. The site is offline, and the department won't say how it happened or who did it. It follows California's education department breach a week earlier and Florida's DMV breach in September. → Freeze your credit if you ever applied for Florida aid. |
|
Yes, that Arnold Schwarzenegger.
He has a newsletter on beehiiv. So do Codie Sanchez, Jay Shetty, David Begnaud, Colin & Samir, and Joanna Stern.
They could publish just about anywhere. They chose beehiiv to build a direct connection with the people who want to hear from them most. And you can do the same, whether you’re world-famous or just at the start of your plan for world domination.
| | AI Supply Chain Phorion found a tampered version 2.1.313 of the Claude Code extension, live about 11 hours on October 29. Cursor says it "was not developed by Anthropic," though sources dispute whether it was on Open VSX or Cursor's store. It plants an attacker SSH key, opens a tunnel that retries every 60 seconds, and may survive uninstalling. → Check authorized_keys for "svc-telemetry," then rotate credentials. |
| | AI Security Parameter found a malicious shared conversation could load a math library that accepted messages from any sender, letting attacker code run in your signed-in session after one Preview click. In testing it read a private chat. OpenAI fixed it eight days after the October 18 report and paid $5,000; no real-world exploitation is known. → AI chat links are now attack surface. |
|
| 🏛️ Privacy, Power & Policy | |
| | Surveillance The UK's surveillance watchdog says GCHQ misplaced removable drives that may hold Investigatory Powers Act data, and years on has no exact count. Commissioner Lord Leveson remains "concerned." GCHQ admits tracking was "not sufficiently robust" and promises automated tracking by year-end. The report also flags a buggy targeting app behind five terror-law port stops. → Oversight only works if the watched can count their own stuff. |
| | Censorship A French court ordered the free DNS resolver to block sites accused of infringing a sports broadcaster's copyrights, and about 20 similar suits are pending. Quad9 says it can't reliably block only in France, so it stops serving French users November 24. The sites stay online either way. EFF backs the exit and warns US lawmakers off similar bills. → French users: switch resolvers before November 24. |
|
| | Patch Now CISA added two more Ivanti Connect Secure flaws (CVE-2026-111357 and CVE-2026-118527) to its exploited list on October 30. Chained with the CVE-2026-104935 auth bypass, they give attackers unauthenticated root. Volexity says UTA0576 used it to grab credentials, admin passwords and BitLocker recovery keys. The play: upgrade to 25.1.1.3 or 22.8R2.6 today, then rotate any admin and service passwords those boxes touched. |
|
The holiday streaming season is almost here
Are you ready? As revealed in our holiday playbook, Roku Ads Manager lets you easily set up, measure and optimize your self-serve holiday ad campaign. You can even create a shoppable ad unit that lets streamers buy directly from their remote.
 Strange but real Russia's National School Test Came With an Unscheduled Anti-Putin Section Intro Ninth graders across Russia logged in for a state assessment and found anti-government messages where the questions should have been. What Happened The Edutest platform, run by education watchdog Rosobrnadzor, was hit during an October assessment covering 29 regions, forcing a nationwide pause. Pro-Ukrainian group Black Spark claimed it and insisted "Under no circumstances does our movement recruit children." Rosobrnadzor says its systems are restored but won't say how attackers got in or whether data was taken. Why It's Important A national testing platform is a broadcast channel to every classroom logged in. Whoever controls the content controls the message, and a student can't tell a hacked screen from an official one. The Other Side The results don't affect any student's grades, and the outage was temporary, so the real damage may be mostly embarrassment. | | 👉 Takeaway Any system that pushes content to many screens at once, from school portals to digital signage, deserves the same scrutiny as your email gateway. |
TL;DR: Hacktivists swapped a Russian national school test for anti-Putin messages. |
Your search bar is ghosting shoppers with “0 results found.” Gladly understands what your shoppers mean and turns dead ends into product recommendations.
