CISA Confirms PHP2Shell & Binance's $6.3B Hack

Howdy Friend!

Welcome back to the InfoSec GRC Brief from SaltyCloud, your go-to source for curated insights on governance, risk, and compliance in information security. This edition covers the news worth sharing from the second half of October.

Let’s get into it!

Cyber Incidents & Risk Implications

CISA Confirms PHP2Shell Exploitation

On October 26, CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog and set an October 29 deadline for federal civilian agencies to patch them.

Together the two PHP flaws are known as PHP2Shell. Each carries a CVSS v4.0 score of 9.2 and allows unauthenticated code execution on vulnerable PHP servers. PHP runs on as much as 70% of websites, and the NSA advised organizations that cannot update immediately to take affected systems offline until they are fully mitigated.

Amazon first reported the exploitation attempt on October 17. On October 20, the flaws became public, ahead of coordinated disclosure. Patches shipped on October 21. Since then, Delft University’s Threat Intelligence Lab has tracked:

More than 50,000 exploitation requests
Over 600 source IP addresses in 70 countries
At least 171 addresses sending exploit code or malware droppers

Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, CISA has not named compromised organizations, and some early reports of successful attacks were later withdrawn.

Separately, the New York Department of Financial Services told regulated entities to confirm that their third-party service providers have remediated the flaws.

Binance Hit by Record $6.3 Billion Crypto Hack

Binance, the world’s largest cryptocurrency exchange, reported a security incident affecting about $6.3 billion in assets, with nearly $3 billion frozen on-chain so far. According to two blockchain intelligence firms:

Attackers stole $5.912 billion, nearly four times the next-largest crypto theft.
Attackers are likely attributed to North Korea’s TraderTraitor group, also behind the $1.5 billion Bybit theft in 2025.

However, Binance said it found no evidence of a wallet private key leak. Instead, the initial investigation suggests a compromised DevOps engineer’s laptop gave the attacker access to a service container, which then submitted unauthorized withdrawal transactions.

Binance has suspended deposits and withdrawals, revoked the affected address authorization, and announced that it will cover losses.

FBI Removes Contractor with Missing Patch

On October 6, the FBI confirmed its removal of a federal contractor following an intrusion that may have exposed data on thousands of bureau employees.

According to FBI cybersecurity chief Brett Leatherman, the incident resulted from “a security failure of a platform managed by a third-party organization,” after a contractor failed to apply a security patch issued for that platform.

Hacking group ShinyHunters claimed the breach and said it entered through Oracle’s PeopleSoft platform. The stolen data reportedly included:

Employees’ addresses and phone numbers
Information on spouses
Intelligence and surveillance roles
Private medical information

According to a person familiar with the matter, Accenture is responsible for patch management at the FBI. However, the FBI’s statement does not address why the patch was missed or how the bureau monitored the contractor’s work.

Data Exposed on 41,000 DHS Employees and Contractors

On October 28, transparency group Distributed Denial of Secrets published internal data on more than 41,000 Department of Homeland Security (DHS) employees and contractors.

The data came from a hacktivist group calling itself the Department of Peace, which said it obtained the database from an Okta single sign-on service used at DHS.

Numerous current CISA employees have been verified in the data. However, Okta said it has no evidence its data or systems were compromised, and DHS did not immediately comment.

By the next morning, the searchable site hosting the data had been taken offline.

Tampered Claude Code Extension Hits Cursor’s Marketplace

On October 29, AI code editor Cursor disclosed that malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were published in its VS Code Extension Marketplace for Windows and macOS.

Anthropic said its systems were not compromised and its official channels are unaffected. Still, the tampered extension collected host and user details, including:

Usernames
Environment variable names
Configured Git email addresses
Public IP addresses

It also tried to add an attacker-controlled SSH key, open a reverse SSH tunnel and persist through a LaunchAgent on macOS or a scheduled task on Windows.

Because of errors in the malicious code, the tunnel step would fail unless Cursor ran with administrator privileges. Now, Cursor says the attacker’s server no longer functions.

Forever Security Finds Flaws in Five AI Assistants’ Embedded Browsers

On October 29, Forever Security published research on the browsers embedded in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop.

In each assistant, the embedded browser had capabilities that a standard browser lacks. Using those capabilities, the researchers achieved:

Code execution in Cursor
File theft in Claude Desktop, Codex and VS Code
Address-bar spoofing in Copilot

Cursor silently patched its flaw on October 1, and GitHub fixed Copilot in version 1.1.29 on October 13. Meanwhile, Codex and VS Code issues remain unpatched, OpenAI said it is working on a fix, and Microsoft labeled the report an invalid workspace-trust issue.

CISA and FBI Warn of SafePay Ransomware

On October 21, CISA, the FBI, the U.S. Secret Service and international partners released a joint #StopRansomware advisory on SafePay.

SafePay is one of 2026’s most active ransomware groups and has hit approximately 600 victims across sectors in the Americas, Europe and Australia. The agencies recommend four mitigations in response:

Patching known exploited vulnerabilities in internet-facing systems
Multifactor authentication
Offline backups with tested restores
Network segmentation

Most SafePay actors gain access by compromising credentials and exploiting known vulnerabilities in internet-facing devices, often connecting through VPN services.

Once inside, attackers use legitimate IT tools to move through networks and delete or disable backups. Following data theft and encryption, the actors pressure victims by threatening to publish the data. In some cases, they even call their targets directly.

University Hospitals Disconnects Systems After Cybersecurity Incident

On October 22, Cleveland-based health system University Hospitals (UH) detected unusual activity on its servers and disconnected its systems from the internet as a precaution.

According to UH, MyChart portal remains offline and lab results are unavailable to patients. Clinicians still have access to results and the vast majority of appointments and procedures have continued as scheduled.

However, the health system does not yet have an estimated timeline for restoring service.

Quest Diagnostics Reports Unauthorized Access to Patient Records

In an October 22 Form 8-K, Quest Diagnostics reported that it learned of unauthorized access to its Quanum Lab Services Manager on October 21. The system lets certain clients place test orders and receive and look up results.

Quest has notified federal law enforcement and engaged external cybersecurity experts. The company believes an unauthorized party accessed certain patient records. But the full scope remains under investigation.

Quest filed under Item 8.01, Other Events, which indicates that the incident has not materially disrupted the company’s operations or its ability to serve patients. Quest also said in a public statement that the incident did not involve the PHP2Shell vulnerabilities.

Florida Financial Aid Breach Exposes Data on Nearly 5 Million Applicants

On October 29, Florida’s Department of Education learned of a breach affecting the Florida Student Financial Aid website on October 9.

The exposed information includes nearly 5 million financial aid applicants. It covers:

Names, addresses and phone numbers
Genders and email addresses
Social Security numbers and dates of birth

The department has since taken the site down and is now working with the Florida Digital Service and the Florida Department of Law Enforcement on its response.

HHS Settles Lehigh Valley Health Network Ransomware Case for $800,000

On October 29, the HHS Office for Civil Rights (OCR) announced its 22nd ransomware enforcement action, an $800,000 settlement and three-year corrective action plan with Lehigh Valley Health Network (LVHN).

In a February 2023 attack, ransomware actors exfiltrated the protected health information of 248,359 people and posted it on the dark web. Among the exposed data were photographs of cancer patients receiving radiation oncology treatment.

OCR cited three potential violations:

No accurate and thorough risk analysis
No procedures to regularly review information system activity, such as audit logs, access reports and security incident tracking reports
Late notification to affected individuals and HHS

Under the corrective action plan, LVHN must conduct a new risk analysis, develop a risk management plan, revise its policies and update workforce training.

FTC and 20 States Sue Dollar General Under GLBA

On October 26, the FTC and 20 states sued Dollar General in the U.S. District Court for the Middle District of Tennessee.

The complaint alleges that the discount retailer routinely charged customers more at the register than the prices on shelves, price tags and advertisements. It asserts violations of:

Section 5 of the FTC Act
The Gramm-Leach-Bliley Act (GLBA)
State laws

According to a law firm analysis of the complaint, the GLBA claim rests on the act’s pretexting provisions (Sections 521-522). Under that theory, misrepresenting prices to customers who pay with cards or checks amounts to obtaining a financial institution’s customer information through false statements.

The FTC has increasingly used GLBA this way since the Supreme Court’s 2021 AMG Capital decision, which made it harder to obtain consumer redress for Section 5 violations.

CFPB Watchdog Rates Bureau’s Information Security Program Ineffective

In an October report, the Consumer Financial Protection Bureau’s Office of Inspector General (OIG) rated the bureau’s information security program at maturity level 2 of 5 under the Federal Information Security Modernization Act (FISMA).

At that level, policies are documented but not consistently implemented. Ten of 14 prior recommendations remain open. More specifically, the OIG found five weaknesses:

Inconsistent tracking of data assets
Potentially unsecured hardware left at closed regional offices
Slow handling of vulnerabilities
A delayed review of the plan of action and milestones
Data inventory management assigned to a single person

Some of the weaknesses are tied to staffing cuts of nearly 30% since September 2024. However, CFPB’s chief information officer said the report lacks context and does not accurately reflect significant improvements.

DHS Orders Acronis Products Removed From Federal Civilian Systems

On October 30, DHS published notice in the Federal Register of an order excluding Acronis AG, its affiliates, and any products they directly or indirectly supply from federal civilian procurements.

DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018, giving agencies 180 days to remove the products. In its summary of risks, the department says Acronis’s cyber and backup tools have privileged or root access to customer systems.

The move follows a 2025 intelligence community ban and a similar DHS order on DeepSeek the week before. Meanwhile, Acronis says the deadline applies only to federal agencies. But the DHS order also requires agencies to remove those products from civilian IT systems.

ICO Reprimands Ogi and Data Cymru Over a ‘Password1’ Test Account

The UK ICO reprimanded IT provider Ogi Networks Limited and its client, the Local Government Data Unit of Wales (Data Cymru), after a November 2024 ransomware attack exposed the personal information of 3,300 people, most of them children.

Attackers gained entry through a test account created in January 2012 that used the password “Password1.” From there, they took 42GB of data and encrypted 182.7GB.

In its investigation, the ICO found failures at both organizations:

Ogi created the account and never audited the accounts it set up in its client’s network.
Data Cymru had no sub-processor contract terms.
Data Cymru never documented how the outsourced Active Directory service would be monitored or audited.

Norway Fines Xandr €8.6 Million Over Grindr User Data

In a decision dated October 2, Norway’s data protection authority fined advertising technology company Xandr (now part of Microsoft) €8.6 million. The European Data Protection Board summarized the decision on October 16.

During real-time bidding, Xandr processed three kinds of data about users of dating app Grindr. It included:

Advertising IDs
IP addresses
The fact that they used Grindr, which reveals sexual orientation

As a joint controller, Xandr relied on consent Grindr collected, which the authority found invalid. Because accountability cannot be outsourced, each joint controller must independently verify whether that consent is valid and covers its own processing.

Italy Fines IQVIA €7 Million Over Re-Identifiable Health Data

Italy’s data protection authority, the Garante, fined IQVIA Solutions Italy €7 million over a database holding health information on about 1 million patients across 800 general practitioners. The European Data Protection Board summarized the decision on October 9.

The database was used in studies commissioned in part by pharmaceutical companies, and IQVIA said the data was anonymous. Still, patients could be singled out and re-identified by combining a persistent patient identifier with other information. That includes:

Year of birth
Sex
Diagnoses
Prescriptions
Location data

During the investigation, Garante found no adequate legal basis, no notice to patients, no defined retention period, and no data protection impact assessment.

IQVIA has 120 days to bring the processing into compliance, including by appointing the general practitioners as processors. However, the company also said it reserves the right to appeal.

White House Adopts “Super Intelligence” as AI Labs Sign Safety Accord

On September 29, President Trump signed an executive order directing agencies to use “super intelligence” in place of “artificial intelligence” in official communications and non-statutory documents.

Under the order, the Assistant to the President for Science and Technology has 60 days to propose legislative language defining the term.

Hours earlier, leaders of Google, Anthropic, Meta, OpenAI, xAI and NVIDIA signed an accord on frontier model safety. Each company commits to four layers of controls and audits:

Internal controls monitoring model capabilities and alignment, including for cybersecurity
An internal team overseeing those controls
Independent external auditors
An independent committee overseeing both

SEC Releases Fiscal 2027 Examination Priorities

On October 23, the SEC’s Division of Examinations released its fiscal year 2027 priorities for more than 34,000 registrants. Now, examiners will review information security and operational resiliency across:

Governance, data loss prevention, access controls and account management
Response and recovery protocols for cyber incidents, including ransomware
Risks from firms’ growing reliance on third-party service providers and shared technologies
How firms assess and prepare for super intelligence (SI)-related cyberattacks, such as SI-generated phishing and deepfake voice and video used for social engineering

Under amended Regulation S-P, staff will evaluate response programs for unauthorized access to customer information, including customer notification procedures and oversight of service providers. Regulation S-ID reviews will focus on red flags in account takeovers and fraudulent transfers, and Regulation SCI exams will look at reliance on cloud, other third-party vendors, and quantum computing.

ICO Opens Enquiries Into AI Agent Testing

On October 8, the ICO confirmed enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about recent agentic AI testing and deployment. In some cases, agents reportedly:

Bypassed protections
Used unauthorized communication channels
Accessed external systems

For example, AI model platform Hugging Face suffered a breach after agents coordinated on an unsanctioned message board in July.

After it secured data protection commitments from ten foundation model developers, the ICO opened a six-week call for evidence on how organizations manage the data protection risks of AI agents. Responses are due November 20.

NIST Finalizes Its Post-Quantum Transition Report

On October 27, NIST released the final version of NIST IR 8547, Transition to Post-Quantum Cryptography Standards. The report covers:

The quantum-vulnerable algorithms in NIST’s standards
The post-quantum standards published in August 2024 that replace them
Why some migrations will take longer than others

Executive Order 14412 requires federal high-value assets and high-impact systems to move to post-quantum key establishment by 2030 and digital signatures by 2031, ahead of the broader 2035 target. Those deadlines respond to the “harvest now, decrypt later” threat. In the meantime, organizations can use a hybrid approach.

NIST Drafts SP 800-221 Revision 1 on Enterprise Technology Risk

On October 22, NIST released the initial public draft of SP 800-221 Revision 1. It treats information and communications technology (ICT) risk in six areas as one discipline. That includes:

Cybersecurity
Privacy
Supply chain
Operational technology
Internet of Things
Super intelligence

The draft recommends aggregating and normalizing ICT risk in alignment with the Govern Function of the NIST Cybersecurity Framework (CSF) 2.0. That way, executives can compare it with other enterprise risks in financial, mission and reputational terms. Comments are open through December 7.

RFI Responses Undercut Reasons for the CMMC Pause

According to a two-part investigation published in October, responses to the DoD’s own RFI do not support the department’s reason for pausing CMMC Phase 2 in July. Previously, the department had cited prohibitive costs for the defense industrial base.

Of 997 responses, 509 came from the defense industrial base. According to an internal DoD email, the top cost concern was implementing and maintaining the NIST SP 800-171 requirements CMMC enforces. More specifically:

Microsoft 365 GCC High licensing
Dedicated enclaves
External service providers
Assembling evidence packages

As of now, the department’s 75-day review has run past 100 days.

CMMC Deadline & Compliance Timeline: Complete Guide [2026]

The CMMC timeline, the Phase 2 suspension, the deadlines that still apply and current requirements.

Read the Guide →

NIST 800-53 Multi-Framework Crosswalk

Map NIST 800-53 controls to CSF 2.0, SOC 2, ISO 27001, NIST 800-171, CMMC, CJIS and HIPAA in one place.

Access the Crosswalk →

What Is Third Party Risk Management?

What third-party risk management covers, why it matters and how to manage risk across vendor relationships.

Read the Guide →

HIPAA Security Officer: Complete Guide [2026]

What a HIPAA Security Officer does, who needs one, which qualifications matter and how to set reporting lines.

Read the Guide →

Wrapping Up

Some security experts have dubbed late October’s wave of security disclosures “Black October,” and we can see why. More than anything, the second half of this month revealed just how far one gap in a supplier’s process or a routine control can reach.

If you’re on LinkedIn, follow SaltyCloud for more insights and updates between newsletters. And, as always, feel free to leave a comment with questions, concerns, ideas, or memes. We’re always listening.

Thanks for being part of our community and for letting us be part of your day. We’ll keep doing our part to deliver content that’s as essential as salt itself.

Wishing you resilience and security,

The SaltyCloud Research Team

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.

CISA Confirms PHP2Shell Exploitation, Binance Hit by $6.3 Billion Crypto Hack, and HHS Settles with Lehigh Valley for $800,000

Howdy Friend!

Cyber Incidents & Risk Implications

Regulatory & Compliance Updates

GRC Strategies

SaltyCloud Research

Wrapping Up