Blog

The Binance hack is the theft of about $6.3 billion in crypto from Binance hot wallets on 29 October 2026, the largest crypto theft on record. Binance’s initial investigation points to a compromised DevOps engineer’s laptop. TRM Labs and Chainalysis attribute the attack to North Korea’s TraderTraitor group.

This post reflects public reporting up to 30 October 2026, one day after the theft. Binance has not published a full root cause, so we separate what is confirmed from what is assessed.

HTTP2Shell, also called Node2Shell, is the nickname for CVE-2026-111497, an out-of-bounds write in Google’s Brotli decompression library. Fixes shipped on 21 October 2026. Any service that automatically decodes Content-Encoding: br traffic can be pushed into corrupting its own memory, and from there into running attacker commands.

This post walks the attack chain and the response that actually contains it. Everything here mirrors our free HTTP2Shell RCE exercise, where you play both the attacker and the platform engineer on call.

PHP2Shell is the nickname for two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Together they let an attacker run commands on a web server with one malformed request and no login. Exploitation started on 17 October, four days before PHP shipped fixes on 21 October.

This post walks the attack chain, the response that actually closes it, and the cleanup that patching alone never does. Everything here mirrors our free PHP2Shell RCE exercise, where you play both the attacker and the engineer on call.

A leaked secret in Git or CI/CD is any credential, such as an API key, deploy token or private key, that ends up in a repository’s history, a tracked file or a build log. Deleting it from the latest commit does not revoke it. Anyone with a clone or log access can still read and use it until the credential itself is rotated.

This post covers the four places secrets leak in a delivery pipeline, the order to fix them in, and the guardrails that stop the next one.

Zero-day patch management is the process of closing a vulnerability that attackers are already exploiting, often before or within hours of a vendor fix. It covers four steps: install the fixed build, make sure the running service actually loads it, verify the exploit fails, and clean up anything the attacker reached while the hole was open.

Most teams are good at the first step. The other three are where incidents keep happening.