Fiducie empruntée : MAG212 CYBER Weekly, 31 octobre 2026

MAG212 CYBER · Weekly Intelligence · 31 October 2026 · 31 pages

Feuilletez le magazine

Turn the pages below, or use full-screen mode for the best reading experience. Prefer a file? Use the download button above.

MAG212 CYBER | October 31, 2026
By El Mostafa Ouchen

This was a week about borrowed trust. In the stories that mattered most, attackers did not break the strongest control; they stood where that control already trusted them. A signing service signed because an internal caller asked, a firewall obeyed its own management plane, and a genuine Microsoft sign-in page handed a real session to someone else. This edition follows that thread across twelve stories, and turns each one into a defensive reference architecture you can check against your own systems.

Inside this issue

• Binance loses billions in minutes: Attackers got Binance systems to sign valid withdrawals across 10-11 chains, and freezes clawed back under half within hours.
• Chainalysis discloses internal-tool intrusion: An attacker reached internal tools and customer contact data, but Chainalysis says it found no evidence of access to investigations, credentials or session tokens.
• PHP2Shell turns firewalls into footholds: Attackers chained critical PHP flaws in PAN-OS management interfaces with a kernel bug for root, and CISA reportedly set a three-day deadline.
• Tailscale patches Tailworm SSH and Serve flaws: Four bulletins fix root-socket access, memory exhaustion and capability leaks, and every one needs an authenticated tailnet or local foothold first.
• Oracle EBS flaw draws early probes: An unauthenticated EBS servlet flaw chains SQL execution as APPS into OS commands, and honeypots logged probing within a week.
• Backdoored Claude Code builds hit Cursor: Two tampered extension builds planted an SSH key, a reverse tunnel and persistence during a roughly 11-hour marketplace window.
• Patched Magento stores keep skimming: One operator’s database-resident loader survives PolyShell patching, and Sansec ties it to 953 compromised stores since July 2025.
• Brotli bug reportedly added to CISA KEV: A Brotli decoder flaw in Node.js and other runtimes is reportedly on CISA’s exploited list, though RCE on standard builds is unproven.
• Kernel TCP race reaches remote root: An IPv4 TCP use-after-free present since Linux 4.4 gave Anthropic’s researchers zero-click root against servers running MPTCP listeners.
• SkyW4lker phishes Microsoft 365 device codes: A kit abusing OAuth device-code sign-in has victims complete real Microsoft MFA while the attackers collect the tokens.
• AI spending fears sink Nasdaq: Intel’s outlook and Amazon’s AI-driven cash burn sent the Nasdaq to its worst day since June on October 30.
• OpenAI reportedly trims funding target: The FT reports that OpenAI cut its round to about $20 billion at a $1.25 trillion valuation as investors pulled back.

A technical page after every story

Each feature is followed by a field guide with a defensive architecture diagram, the controls behind it explained in plain language, and verification steps with read-only commands or queries. The issue closes with a weekly roundup of twelve more confirmed stories, a “what to watch” list for November, and eight defender tips for next week. Every fact is attributed, with 69 linked sources at the back.

Reported facts are attributed to their sources. Diagrams, actions and checks are original MAG212 defensive interpretation, not incident findings. Editorial photographs are AI-generated conceptual illustrations. Vendor advisories take precedence when versions or mitigations change.