{"id":3711,"date":"2026-10-31T10:11:00","date_gmt":"2026-10-31T17:11:00","guid":{"rendered":"https:\/\/cyber.mag212.com\/borrowed-trust-mag212-cyber-weekly-october-31-2026\/"},"modified":"2026-10-31T12:39:14","modified_gmt":"2026-10-31T19:39:14","slug":"borrowed-trust-mag212-cyber-weekly-october-31-2026","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/borrowed-trust-mag212-cyber-weekly-october-31-2026\/","title":{"rendered":"Fiducie emprunt\u00e9e : MAG212 CYBER Weekly, 31 octobre 2026"},"content":{"rendered":"<p class=\"has-text-align-center has-small-font-size wp-block-paragraph\">MAG212 CYBER \u00b7 Weekly Intelligence \u00b7 31 October 2026 \u00b7 31 pages<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"\/wp-content\/uploads\/2026\/10\/MAG212_CYBER_Weekly_October_31_2026_1.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Read the full magazine (PDF, 31 pages) \u2192<\/a><\/div>\n\n\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.calameo.com\/books\/008325361cc316715dc6d\" target=\"_blank\" rel=\"noreferrer noopener\">Read online on Calam\u00e9o \u2192<\/a><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Feuilletez le magazine<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Turn the pages below, or use full-screen mode for the best reading experience. Prefer a file? Use the download button above.<\/p>\n\n\n<div class=\"_df_book df-lite\" id=\"0\"  data-title=\"\" wpoptions=\"true\" thumbtype=\"\" source=\"\/wp-content\/uploads\/2026\/10\/MAG212_CYBER_Weekly_October_31_2026_1.pdf\" height=\"auto\" webgl=\"true\" ><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MAG212 CYBER | October 31, 2026<\/strong><br>By El Mostafa Ouchen<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This was a week about borrowed trust. In the stories that mattered most, attackers did not break the strongest control; they stood where that control already trusted them. A signing service signed because an internal caller asked, a firewall obeyed its own management plane, and a genuine Microsoft sign-in page handed a real session to someone else. This edition follows that thread across twelve stories, and turns each one into a defensive reference architecture you can check against your own systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Inside this issue<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Binance loses billions in minutes<\/strong>: Attackers got Binance systems to sign valid withdrawals across 10-11 chains, and freezes clawed back under half within hours.<\/li><li><strong>Chainalysis discloses internal-tool intrusion<\/strong>: An attacker reached internal tools and customer contact data, but Chainalysis says it found no evidence of access to investigations, credentials or session tokens.<\/li><li><strong>PHP2Shell turns firewalls into footholds<\/strong>: Attackers chained critical PHP flaws in PAN-OS management interfaces with a kernel bug for root, and CISA reportedly set a three-day deadline.<\/li><li><strong>Tailscale patches Tailworm SSH and Serve flaws<\/strong>: Four bulletins fix root-socket access, memory exhaustion and capability leaks, and every one needs an authenticated tailnet or local foothold first.<\/li><li><strong>Oracle EBS flaw draws early probes<\/strong>: An unauthenticated EBS servlet flaw chains SQL execution as APPS into OS commands, and honeypots logged probing within a week.<\/li><li><strong>Backdoored Claude Code builds hit Cursor<\/strong>: Two tampered extension builds planted an SSH key, a reverse tunnel and persistence during a roughly 11-hour marketplace window.<\/li><li><strong>Patched Magento stores keep skimming<\/strong>: One operator&#8217;s database-resident loader survives PolyShell patching, and Sansec ties it to 953 compromised stores since July 2025.<\/li><li><strong>Brotli bug reportedly added to CISA KEV<\/strong>: A Brotli decoder flaw in Node.js and other runtimes is reportedly on CISA&#8217;s exploited list, though RCE on standard builds is unproven.<\/li><li><strong>Kernel TCP race reaches remote root<\/strong>: An IPv4 TCP use-after-free present since Linux 4.4 gave Anthropic&#8217;s researchers zero-click root against servers running MPTCP listeners.<\/li><li><strong>SkyW4lker phishes Microsoft 365 device codes<\/strong>: A kit abusing OAuth device-code sign-in has victims complete real Microsoft MFA while the attackers collect the tokens.<\/li><li><strong>AI spending fears sink Nasdaq<\/strong>: Intel&#8217;s outlook and Amazon&#8217;s AI-driven cash burn sent the Nasdaq to its worst day since June on October 30.<\/li><li><strong>OpenAI reportedly trims funding target<\/strong>: The FT reports that OpenAI cut its round to about $20 billion at a $1.25 trillion valuation as investors pulled back.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">A technical page after every story<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Each feature is followed by a field guide with a defensive architecture diagram, the controls behind it explained in plain language, and verification steps with read-only commands or queries. The issue closes with a weekly roundup of twelve more confirmed stories, a &#8220;what to watch&#8221; list for November, and eight defender tips for next week. Every fact is attributed, with 69 linked sources at the back.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Reported facts are attributed to their sources. Diagrams, actions and checks are original MAG212 defensive interpretation, not incident findings. Editorial photographs are AI-generated conceptual illustrations. Vendor advisories take precedence when versions or mitigations change.<\/em><\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"\/fr\/subscribe-free\/\">Get the next issue free in your inbox \u2192<\/a><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>The October 31, 2026 weekly magazine: twelve stories from Binance to SkyW4lker, each with a defensive architecture field guide, plus the weekly roundup and what to watch.<\/p>","protected":false},"author":1,"featured_media":3695,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,13,21,15],"tags":[],"class_list":["post-3711","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-cyber-incidents","category-digital-magazine","category-threat-intelligence"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3711"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3711\/revisions"}],"predecessor-version":[{"id":3738,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3711\/revisions\/3738"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3695"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}