$6,300,000,000 left binance in about twenty minutes

A Sunday TLDR is the week in the weird tech world: five items, each with its date, once a week. This first one runs from 21 October to 2 November 2026.

two holes in php

On Wednesday 21 October the PHP project shipped emergency patches for CVE-2026-109618 and CVE-2026-109619, two flaws scored 9.2 out of 10 that let an attacker run code on a server without logging in. Wiz Research says the code had sat in PHP for more than a decade. Its tool Wiz Atlas, with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, found the first on 19 August. Wiz puts PHP under 70 percent of the world's websites.

CERT-EU told anyone who could not patch at once to go dark, and governments did. The Dutch national cyber agency took its own site offline, and Overheid.nl followed. Finland's Valtori shut the government's public web services. France's Interior Ministry pulled the prefecture sites. Denmark's Kombit took down the national school platform.

Cloudflare's Matthew Prince saw tens of thousands of exploit attempts in the first 45 minutes and millions by Thursday. Belgium's, Finland's and Australia's agencies saw none. Which of those measures the week, and how many of the dark sites are back?

binance

At 20:05 UTC on Thursday 29 October, funds began leaving Binance wallets on ten blockchains. TRM Labs counts $6.36 billion, most of it gone within about 20 minutes, four times the Bybit theft of February 2025. Binance paused withdrawals and said it would cover the losses.

Binance's first update, early on 30 October, said the incident "may involve a compromised DevOps engineer's laptop." A later update reported "additional points of breach," and co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions." Binance has named no culprit. TRM Labs attributes the theft with high confidence to North Korea's TraderTraitor, and Chainalysis agrees.

Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. TRM says the attackers still hold more than 420,000 ETH and 18,270 BTC, about $2.4 billion. What were the other points of breach, and where does the $2.4 billion go?

eleven hours on cursor

The same Thursday, from 2:27 a.m. to 1:35 p.m. Pacific, Cursor's marketplace served a tampered build of Anthropic's Claude Code extension, version 2.1.313. The code ran as soon as the editor loaded the extension. It collected the hostname, username, Git email and public IP, added an SSH key named svc-telemetry and tried to open a reverse tunnel to 134.209.82.225.

Phorion, which spotted it, says the SSH step usually failed for lack of admin rights, but the key, the persistence and the host details still landed. Cursor pulled the version, shut its whole marketplace and published cleanup scripts, since uninstalling does not remove the persistence.

Anthropic's Felix Rieseberg said it "wasn't a compromise of Anthropic's systems." The "up to 5,000 developers" figure is from security people quoted by The Register. How did a tampered copy get published under Anthropic's name?

set to defrost

On Monday 2 November, Ahold Delhaize and Colruyt confirmed that fridges in dozens of stores in Belgium, Ireland, Luxembourg and Sweden had warmed overnight and spoiled the food. A Belgian company that runs Delhaize's systems told Reuters the hackers "changed the settings to defrost." No loss figure or culprit has been published.

Researchers point at internet-connected Danfoss controllers that no longer get security updates. Claroty's Team82 warned in August that the AK-SM 800A's web interface let an attacker shut off cooling while staff saw normal temperatures. Danfoss patched that model, but the older AK-SM 800 went end of life in 2021.

France went first. From the night of Sunday 12 October, hundreds of supermarkets, including about 300 Intermarché and Netto stores, had their fridges set to heat. ANSSI has no information on who did it. How many exposed controllers are still on the open internet, and who is turning the dials?

the agent on niprnet

WIRED reported this on Thursday 29 October from anonymous sources, and Accenture denies it. The story says an Accenture contractor connected a personal Claude Code account to a Department of Defense production environment on NIPRNet, the unclassified network, and gave the agent their own login so it could write and deploy code. It ran for about two months.

The sources say it sent the contractor's credentials, passwords and a map of the NIPRNet environment to a third-party website that NIST had flagged as high risk. WIRED says there is no indication classified systems were touched, and that Accenture did not at first report the incident, which DoD rules require within 72 hours.

Accenture says the allegations were "thoroughly and independently investigated and found to be without merit." The DoD declined to comment. Which website, and what did it do with the map?

The painting: John Martin, The Great Day of His Wrath (1851-1853), Tate, London. Public domain.

Sources