Daily brief: Monday 2 November 2026

BTCPay Server tells self-hosters to switch off after wallet thefts, Binance reopens withdrawals, several exploited flaws are still missing from CISA's list, a Linux kernel root exploit goes public and FreePBX patches two critical bugs.

Cybersecurity

BTCPay Server tells operators to shut down after hot wallets are drained

On Sunday 1 November, the open-source BTCPay Server project told people who run their own servers to shut them down with ./btcpay-down.sh while it investigates reports of hot wallets being emptied. The attacker logged in as an administrator, but how they got that access is still unknown. Founder Nicolas Dorier said the thefts appear to involve releases older than 2.4.2, and the project's own servers on 2.4.7 were not attacked. No loss figure, count of affected servers or fix has been published yet.

Why it matters for IT: If you or a customer self-host BTCPay, follow the shutdown advice now and don't assume updating fixes a server that may already be compromised. More broadly, any internet-facing admin panel that holds keys or secrets needs MFA and should not be open to the whole internet.

Source: CoinDesk · Cyber Security News

Cybersecurity

Exploited YOOtheme, Oracle EBS and FreeSWITCH flaws are not yet on CISA's list

A weekly report from Daily CyberSecurity, covering 26 October to 1 November, lists flaws seen under attack that were not in CISA's Known Exploited Vulnerabilities catalogue as of its 30 October version. They include YOOtheme Pro CVE-2026-102785 (fixed in 5.0.53), which Unit 42 says is being used to drop PHP web shells, and Oracle E-Business Suite CVE-2026-101767, fixed in Oracle's October patch update. Oracle has not confirmed attacks on the EBS flaw, while Defused reported exploratory attempts. FreeSWITCH CVE-2026-116779 is fixed in 1.11.3.

Why it matters for IT: CISA's list is a floor, not a ceiling. If you run any of these, patch now rather than waiting for a KEV entry, and check YOOtheme sites' media folders for stray PHP files.

Source: Daily CyberSecurity

Cybersecurity

Binance reopens withdrawals in phases after its $6.3 billion theft

Binance began reopening withdrawals on Sunday 1 November, starting with bitcoin, ether, USDT, USDC, BNB and XRP. The exchange says it has replaced about 95% of the affected assets with its own funds and that losses will not be passed on to users. Blockchain analysis firms attribute the 29 October theft to TraderTraitor, a North Korea-linked group. Binance earlier said the attack started with a compromised DevOps engineer's laptop.

Why it matters for IT: The lesson for any IT team is the starting point: one engineer's laptop led to production systems. Admin and engineering devices need the strongest controls you have, including phishing-resistant MFA and separate admin accounts.

Source: CoinDesk · Sherlock Forensics weekly roundup

Open source

Public exploit released for a Linux kernel bonding flaw that gives root

Working exploit code for CVE-2026-31419, a race condition in the Linux network bonding driver rated 7.8, is now public in Google's kernelCTF repository. A local attacker can use it to become root, and researchers also showed a container escape. Red Hat Enterprise Linux 8, 9 and 10 kernels are named as affected. The report gives conflicting affected version ranges, and says there is no confirmed exploitation in the wild yet.

Why it matters for IT: Patch kernels on shared and container hosts first. If a patch can't go on yet, restricting unprivileged user namespaces or removing the bonding module where it isn't needed reduces the risk.

Source: Daily CyberSecurity

Networking

FreePBX fixes two critical flaws in its User Manager module

FreePBX has published advisories for two critical bugs in the User Manager (userman) module. One lets attackers brute-force accounts through a credential check that leaks information. The other lets a logged-in user overwrite an administrator's password, and the authentication bypass issue is rated 9.3. Fixed version numbers and exploitation status were not available in the report.

Why it matters for IT: If you look after FreePBX phone systems, update the userman module today and make sure the admin interface is not reachable from the internet.

Source: Daily CyberSecurity

Weather

Live forecast

Loading the forecast…

Fact of the day

All facts

← All daily briefs