HackRead

OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery

Wed, 28 Oct 2026 17:09:09 +0000

New York, United States, October 28th, 2026, CyberNewswire

New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.

OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and CVE-2026-109619) firsthand. Developed in response to AI-accelerated vulnerability discovery and active exploits targeting core PHP engines in the wild, the lab provides penetration testers and enterprise defenders with a safe, controlled environment to study the decade-old memory corruption flaws and implement timely server mitigations.

The two critical flaws sat inside PHP, the language behind roughly 70% of websites whose server-side language is known, for more than a decade. Then researchers at Wiz, a Google-owned cloud security company, pointed AI at the code.

They found the first flaw Aug. 19. The next day they used it to take over a Drupal site without a password. The day after that, it worked on WordPress.

PHP disclosed the flaws Oct. 21 as CVE-2026-109618 and CVE-2026-109619. An attacker with no login can send a series of crafted web requests to crash a server or take it over. PHP’s severity scores rate both vulnerabilities as complex to exploit, even though working attacks already existed. The Cybersecurity and Infrastructure Security Agency (CISA) recommends patching immediately.

Attackers are moving fast. Amazon calls PHP2Shell broadly exploited in the wild. By Oct.24, researchers had confirmed attackers running commands on vulnerable honeypot servers. CISA added both flaws to its Known Exploited Vulnerabilities catalog on Oct. 26.

“PHP is one of those technologies attackers love to see,” said Keegan Bowen, principal DevOps lead at OffSec. “It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn’t designed with security from the start.”

OffSec, which has taught hands-on offensive security since 2006, has released a free PHP2Shell lab in Proving Grounds Play (PG Play). The lab gives penetration testers and other security professionals a controlled environment to explore CVE-2026-109618 and CVE-2026-109619 firsthand. OffSec’s blog breaks down both flaws, and its proof-of-concept exploit is available on Exploit-DB.

AI and the Evolving Pace of Exploitation

PHP scored both flaws 9.2 out of 10, a critical rating. To build a working attack, Wiz researchers had to chain several bugs together and tune the attack to each server’s memory. When they let AI do the grind, one researcher finished in a week what once took a top team month. Attackers can use the same AI models, so flaws once ranked too complex to matter are now fair game.

“At this point, attackers are heavily leaning on AI to find and exploit vulnerabilities; the rate of CVEs is roughly double what was reported last year,” said Matt Freitas-Stavola, staff software engineer at OffSec.

“LLMs don’t get tired and can easily run in the background for as long as attackers have money or compute to spare. Even now, just a hint of where an issue could arise is enough for an LLM to get a workable POC out relatively quickly.”

The Effects of These Flaws

Both flaws start with the same weak spot: what PHP does when a request runs out of memory or hits another fatal error.

“PHP is built from C and memory management becomes increasingly challenging as the code grows,” Bowen said. “Some out-of-memory states were not handled well. In some cases, attackers can access interrupted state data before it is cleaned up. That becomes an opportunity for abuse.”

That leftover state can carry into the next request on the same worker. An attacker who shapes it can run code with the web server’s privileges.

The same bugs can also leak data. Wiz showed attackers could potentially read memory from the PHP process. That memory could hold passwords, session tokens, API keys, and certificates from other requests or the server itself.

The story is still developing. On Oct. 23, PHP disclosed a separate flaw, CVE-2026-115560, that can affect fully patched servers with an unusual session setup. PHP has no fix for it yet. Researchers have also built PHP2Shell exploits that get past ASLR, a common memory defense, and more issues could surface as the flaws are studied. As research continues, new vulnerabilities, exploitation techniques, and mitigations may emerge beyond those covered here.

OffSec’s Current Recommendations

These steps reflect what is known at the time of publication. Check CISA and the PHP project for the latest recommendations.

Patch PHP Now. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address CVE-2026-109618 and CVE-2026-109619. Check vendor advisories rather than relying on version numbers alone.
Update the Underlying PHP Engine. Updating WordPress, Drupal, or another application does not resolve vulnerabilities in PHP itself. Rebuild affected container images, and restart PHP processes so the updated code takes effect.
Apply Temporary Protections While Patching. Disable PHP session upload progress (session.upload_progress.enabled=0), which also mitigates CVE-2026-115560. On PHP 8.5, disable fatal error backtraces and restart affected workers after configuration changes. These measures reduce exposure; they do not replace patching.
Investigate Potential Compromise. Review web server and PHP logs for suspicious multipart requests, memory-limit errors, repeated HTTP 500 responses, malformed session cookies, and unexpected PHP worker restarts. Investigations should consider activity dating back to at least October 17, when exploitation attempts were first reported. Rotate potentially affected credentials, API keys, and tokens as appropriate.

Understand the Exploit. Strengthen the Defense.

When the next disclosure lands, someone on the team needs to judge exposure. Reading about an exploit builds awareness. Working on one hands-on builds the skill to respond.

OffSec’s PHP2Shell lab helps practitioners turn technical knowledge into hands-on experience they can apply to future vulnerabilities. For a deeper look at the vulnerabilities, explore OffSec’s technical analysis. Organizations looking to build these capabilities across their security teams can explore OffSec’s workforce development programs.

About OffSec

OffSec is the world’s leading provider of high-fidelity cybersecurity training and certifications. Built on a foundation of excellence, integrity, and the relentless “Try Harder” ethos, OffSec empowers individuals and organizations to outsmart evolving cyber threats through rigorous, hands-on learning.

Contact

Press Team
OffSec
[email protected]

Summit Public Schools Breach Exposes 115 GB of Student and Staff Data

Wed, 28 Oct 2026 17:55:47 +0000

A hacker has leaked 115 GB of Summit Public Schools data containing billions of lines, student and staff personal records and approximately 21,000 email addresses.

Names, home addresses, birth dates, phone numbers, parents details and school records of thousands of students and teachers are among the 115 GB of Summit Public Schools data published on a hacking forum.

Hackread.com examined the collection and verified that it contains personal information associated with the school network, including historical records and student account fields.

The files appeared on PwnForums on October 22, 2026, posted by an account using the name Sp1d3yG0nz4l3s. The account claimed to have breached the organisation’s cloud environment and described the release as approximately 100 GB, saying it was part of a larger collection. Hackread.com’s review puts the available files at 115 GB and identified approximately 21,000 email addresses.

Summit Public Schools operates schools in California and Washington. Although the forum post introduces Summit Tamalpais, one campus within the network, the released files include California and Washington school exports, education-service records and alumni information.

Personal Information and Historical School Records Exposed

Records examined by Hackread.com contain full names, dates of birth, residential and mailing addresses, gender, ethnicity, student identification numbers and enrollment information.

Some entries also include graduation years, transfer comments and administrative records. Student account usernames and populated password fields also appear in the collection. The reviewed password values are not readable plaintext, and their format and current usability remain unclear.

The files also contain older information, including enrollment entries from 2018 and 2019 and transaction timestamps from 2021. Separate person records list internal identifiers, active-status flags, creation and modification dates and the names of people who last changed entries.

Taken together, the files contain billions of lines, according to Hackread.com’s analysis. That total includes repeated entries that have not been removed, so it cannot be used as a count of individual records or affected people. The approximately 21,000 email addresses likewise should not be read as a victim total.

However, with names, birth dates and addresses available together, criminals could use the information to impersonate school employees or send convincing messages to students, parents and former students.

Samples of leaked Summit Public Schools records reviewed by Hackread.com. The first two screenshots show student records, while the third shows a teacher record. Personal information and account values have been redacted (Credit: Hackread.com)

PowerSchool, Clever and Salesforce Exports Included

The collection is divided into folders labelled POWERSCHOOL_CA, POWERSCHOOL_WA, CLEVER and SALESFORCE_SUMMITPSALUMNI.

Within the California PowerSchool folder, TEACHERS.csv and USERS.csv are listed at 15.82 GB and 8.06 GB. The Washington folder contains six exports covering students, teachers, users, people, email addresses and telephone numbers.

Its largest file, STUDENTS.csv, is 35.12 GB, followed by PERSON.csv at 13.89 GB, while student and teacher exports in the Clever directory are organised under six education-service names, including:

Khan Academy
Lexia Core5 PowerUp
MyLexia
Newsela
NWEA
ST Math

The files also include alumni account and contact records in a Salesforce folder, with the two exports measuring 46.90 MB and 92.68 MB. The hacker used Salesforce and Snowflake hashtags in the forum post but did not explain how either platform was involved. No separate Snowflake folder appears in the listing.

Previously, ShinyHunters hackers breached the Salesforce environment of Instructure, the company behind the Canvas learning management system used by schools and universities worldwide, through social engineering in September 2025.

A separate Canvas breach in May 2026 involved its Free-for-Teacher environment, not a Salesforce flaw. No connection between those incidents and the Summit release has been identified. bitdefender.com

Hacker Claims Access Through a Critical Vulnerability

According to the forum account, an unspecified critical vulnerability allowed access to Summit’s cloud environment in October.

The poster said the weakness was patched an hour after the organisation was contacted, but supplied no CVE identifier, supporting correspondence or technical explanation.

Many files carry October 22 timestamps, although the collection includes information dating back several years. The date of the forum release therefore does not identify when the records were taken.

The October 22 PwnForums post claiming a Summit Public Schools breach and sharing files for download. The download link has been redacted. Screenshot by Hackread.com.

Claims of Student Medical Data Remain Unverified

The account also claimed to possess students’ medical conditions, descriptions of those conditions and assigned doctors. Records reviewed by Hackread.com contain medical-alert and doctor-contact fields, but the examined medical-alert entries were empty. One doctor entry contained an uncertain response and an apparently placeholder telephone number. Genuine diagnoses or doctors’ contact details have not been verified.

Nevertheless, the published material leaves students, families and employees facing exposure of personal information while the affected campuses and number of individuals remain unresolved.

Anyone receiving messages referring to these records should verify requests directly with their school, particularly requests for passwords, payments or additional personal details.

From Rules to AI and Back

Wed, 28 Oct 2026 18:59:12 +0000

This article discusses the evolution of fraud prevention techniques. Fraud-prevention systems have to balance several competing demands: catching fraudulent activity without blocking legitimate customers, adapting quickly to new attack patterns, processing decisions efficiently and keeping those decisions explainable.

It covers the period from the 1970s to the present, when companies moved from rules-based approaches to relying on ML and then eventually adopted hybrid approaches. We’ll look into the main driving forces that caused each shift, the problems each new approach tried to solve and who was first to make the move.

Rules-Based Era

In 1973, Visa launched VisaNet that brought computerised authorisation, clearing and settlement to card transactions (Dee Hock — In memoriam). The system relied on static rules to prevent fraudulent transactions.

Most of rules-based systems were concerned with card-present fraud. They relied on velocity checks, geo anomalies and BIN blocklists.

Rules shined when it came to explainability: they were easy to understand and audit. They were perfect to work with regulators.

Rules-based approach worked well in 90s and 2000s. But fraudsters were constantly adapting their tactics to overcome new security measures. Static rules, meanwhile, were too rigid to catch new fraud schemes. The rules couldn’t automatically find and update them to reflect increasingly complex attacks caused another problem.

Another hurdle was to constantly update various thresholds to maintain acceptable rates of false positives. They weren’t as big of a problem back then, but something worth considering nevertheless.

In order to catch up with fraud schemes, rule sets had become extremely complex and hard to maintain. In its Rules based vs machine learning in fraud prevention report, PayPal says that a rule-based system may work for small companies but it’s becoming too unwieldy when it grows beyond a certain point.

To deal with the evolving fraud tactics and get around the limitations of static rules, companies turned to Machine Learning techniques.

Move to Machine Learning

Visa deployed a neural network-based AI for transaction scoring in 1993 (Visa Prevents Approximately $25 Billion in Fraud Using Artificial Intelligence). It was only a reference indicator for its clients at that time. But it wasn’t until 2010s that machine learning models got wide adoption.

By that time, companies had accumulated high volumes of labelled data. Significant advances in neural architectures and gradient-boosted tree algorithms allowed companies to use that data to deploy machine learning systems in their pipelines. They supplemented the old rules-based algorithms and increasingly handled tasks that static rules struggled with.

Mastercard launched its Decision Intelligence platform in 2016. It analyses each transaction and checks it against the cardholder’s past behaviour. Apart from solving the problem of high maintenance cost of the static rules approach, the new platform allowed Mastercard and issuers to reduce false positives.

PayPal aimed at significant fraud reduction by adopting machine learning (Doing Big Things with Big Data at PayPal). They built an ensemble of deep learning and gradient boosting models. The system checked multiple parameters to score transactions: device fingerprint, account-level risk, transaction graph.

The company later reported a transaction loss rate of just 0.08% of its total payment volume, including losses from fraud (PayPal 2025 Form 10-K).

False Positive Crisis

Every fraud-prevention system has to balance two costly kinds of error: letting fraudulent transactions through and blocking legitimate ones. Most companies naturally aimed at catching as many fraudulent transactions as possible. In other words, they minimized false negatives to protect themselves from direct financial losses, operational costs and reputational damage caused by fraud.

But stricter controls naturally led to a higher number of false positives, which companies often ignored or considered acceptable. Research by Aite Group showed how expensive that trade-off could become. It projected that losses from false declines would reach $443 billion in 2021, exceeding the losses caused by fraud itself (Financial Institutions Ease Cardholder Frustration by Addressing Transaction False Declines with New Fiserv Technology).

More recent Aite-Novarica research put the average false-decline rate for US e-commerce merchants at 1.16%. With more than $960 billion in US online sales in 2021, that translated into over $11 billion in lost legitimate sales (New Experian Link).

But banks suffered from more than just financial losses. High rate of legitimate transactions being turned down caused customers to feel upset and angry. They might leave the offending companies and turn to their competitors, which led to higher churn. Or they went to complain to regulators, who asked the companies to prove that their decisions weren’t discriminatory. Either way, high false positive rate caused significant reputational damage as well as high fraud rate.

Some companies had started to work on keeping the false positive rate low long before the report was published. Mastercard’s Decision Intelligence, introduced earlier, was one example: the company reported that it cut false positives in half. With around 75 billion transactions a year, this reduction was reported to save hundreds of millions of US dollars.

Stripe also launched its Radar Engine in 2016 (A primer on machine learning for fraud detection). They took another approach and concentrated on the merchant. Stripe calculates an acceptable level of risk for each merchant and score transactions based on that level.

For example, a B2B or enterprise software company could tolerate some losses from individual transactions to keep its reputation for high-figure contracts. In Radar 2.0 testing in 2018, Stripe said the upgraded ML models reduced fraud by more than 25% compared with the previous models without increasing the false-positive rate.

The Explainability Problem

When large amounts of legitimate transactions were turned down and the affected people complained to regulators, they had to demand greater transparency and fairness in automated decision-making. The EU introduced GDPR in 2018 which strengthened requirements around automated decisions. In the UK, the Consumer Duty introduced in 2023 added further pressure on financial firms to demonstrate that their systems produced fair outcomes for customers.

Financial institutions were now required to explain their decisions when they turned down transactions. But it was very difficult, if possible at all, to do when the decisions were made by an ML model.

HSBC tackled this problem when it developed its Dynamic Risk Assessment platform in collaboration with Google Cloud (Harnessing the power of AI to fight financial crime). They introduced SHAP values to explain machine learning predictions by measuring how much each feature contributes to a final output, using rules from cooperative game theory. HSBC put this system into production in 2021. Two years later, Google Cloud made it available for other businesses through their Anti-Money Laundering AI.

Advances in Fraud Techniques

While companies moved to more sophisticated measures to prevent fraud, fraudsters improved their methods as well. Rapid development of generative AI allowed them to launch new kinds of attacks at scale.

One of such attacks is Authorised Push Payment (APP) fraud. Fraudsters manipulate victims into authorising the payments themselves. While it had been possible to use this techniques before, advances in generative AI allowed them to automatically generate highly personalized messages.

APP fraud is the most rapidly expanding form of fraud now. UK Finance report says that this type of fraud caused losses of £460 million in the UK in 2023. The most challenging part of dealing with it is that each transaction seems completely legitimate. The victim initiates the transfer, approves it on their device, nothing suspicious. How can the financial company spot a problem?

Revolut approached this problem by adding a specialized layer to their fraud-detection system (Revolut launches AI feature to protect customers from card scams). They rolled out the system in 2024.

Revolut reported a 30% reduction in losses from investment-related card scams after introducing the feature. Separately, in October 2023 they reported a 35% reduction in APP fraud since June 2023, and its broader proprietary fraud system prevented more than £475 million of fraud in 2023 (Revolut doubles Financial Crime Headcount to Combat Rising Industry Fraud).

Evolution of Anti-Fraud Approaches Into Hybrid Systems

Companies naturally wanted to use a single system for fraud detection, whether it was a rules-based or an ML-based one. It’s easier to maintain and to explain to management and stakeholders. But evolution of fraud threat and increasing regulatory requirements pushed teams to adopt hybrid systems.

Just like Revolut added a specialized layer to target one specific form of fraud, other companies’ systems evolved to multi-layered architectures.

In addition to layers specific to some threats, many companies integrated rules-based layers for zero-tolerance matters, such as compliance with sanctions. They replaced resource-intensive ML-models with lightweight encoders for high-volume classification work. Some companies added graph analysis stages to spot fake identities and other fraud enabled by generative AI.

Eastwind, a data analytics provider for mobile operators, implemented a hybrid approach in its SMS-firewall solution deployed in 2025. This solution targets another form of fraud. Mobile operators offer special plans for companies who need to send OTP-codes to their clients. The operators don’t allow their clients to use personal numbers to send the codes.

The primary concern is that this could train users to accept OTP messages from ordinary personal numbers, making them easier targets for fraudsters impersonating legitimate companies. Nevertheless some companies buy large numbers of personal SIMs and use them to send OTP codes more cheaply.

Eastwind’s firewall solution check for OTP codes in SMS messages sent from personal numbers. Many clients operate in emerging markets and can’t afford extensive infrastructure to run an anti-fraud system built with ML-models in real time. But fraudsters keep on coming up with new ways of masking their OTP codes which requires an AI to catch these new trends.

The hybrid approach allowed EastWind to solve the problem of evolving fraud schemes while operating within available resources. Real-time processing is performed by the rules-based layer. Some messages are filtered as suspicious and sent to an asynchronous ML-layer for additional checks.

The results of these checks are inspected by a trained professional who may find new trends and update the rules. This human-in-the-loop approach keeps resource requirements low while helping analysts identify new fraud patterns, update the rules and keep decisions transparent and explainable. (Eastwind — EW SMS Firewall success story in Burundi).

Behavioral Analytics

Hybrid architectures can also incorporate additional sources of evidence when transaction-level signals are not enough. One increasingly important example is behavioral analytics, which examines how users interact with their devices and can complement rules, ML models and human review in fraud-prevention systems.

This method has been in development since 2011 when BioCatch, the leading provider of solutions for behavioral analysis, was founded (About BioCatch). Their platform was first adopted by Nuance Security Suite in 2017 (Nuance Teams with BioCatch to Expand Fraud Detection Across Digital Customer Care Channels). It is in use at some 30 of the world’s leading banks.

The strength of the method is that it analyzes the way the user uses their device. Unlike most traditional approaches that work at the level of transaction, this method reads signals that are hard to reproduce or even read by fraudsters.

BioCatch logs over 3,000 cognitive behavioral markers to build a detailed profile for each user. Among many factors, they look at key stroke dynamics, how hard the user swipes, where and how they move their mouse.

The approach has proved effective in practice. In one case, a large Latin American bank added BioCatch as another layer on top of its existing transaction-monitoring system. The bank increased its fraud-detection rate to more than 90% while cutting false positives by roughly two-thirds (Top LATAM Bank Drastically Increases Fraud Prevention & Reduces False Positives by 66% with Behavioral Intelligence).

Conclusion

Fraud prevention has evolved in response to changing threats and changing limitations. Rules-based systems offered transparency and control, but became increasingly difficult to maintain as fraud schemes grew more complex. Machine learning helped companies analyse larger amounts of data and detect patterns that static rules struggled to capture, while introducing new problems around false positives and explainability.

This pushed companies towards hybrid architectures. Rules remained useful for clear-cut decisions, ML models handled more complex scoring, and specialised layers were added for particular threats, behavioral analysis and human review. The examples from Revolut, EastWind and BioCatch show how different techniques can work together inside the same system.

Fraudsters continue to adapt as well. Generative AI has already made some attacks easier to scale and personalise, so fraud-prevention systems will have to keep evolving. The central lesson is that there is no single final solution. Effective systems depend on combining the right tools for the particular threats, constraints and decisions they have to handle.

(Top, featured image via Tara Winstead on Pexel)

Next-gen privacy protocols: WireGuard vs OpenVPN vs Shadowsocks

Wed, 28 Oct 2026 22:33:34 +0000

WireGuard, OpenVPN, and Shadowsocks often appear in the same privacy conversation, but they were built for different jobs. WireGuard strips VPN tunneling down to a compact modern design.

OpenVPN keeps the flexibility that made it a long-running enterprise standard. Shadowsocks approaches the problem from another direction, using an encrypted proxy architecture designed to make traffic harder to classify and block.

For IT teams, that difference matters more than a generic speed ranking. The right protocol depends on whether the priority is low overhead, compatibility, or resistance to network filtering.

WireGuard keeps the tunnel deliberately small

WireGuard became popular partly because of what it leaves out. Its original Linux implementation was designed to stay under roughly 4,000 lines of code, excluding cryptographic primitives. That is tiny compared with mature VPN stacks built around TLS libraries, multiple authentication systems, and years of backward-compatible options.

The benefit is easier review. A smaller security-sensitive codebase gives auditors less implementation logic to inspect and developers fewer moving parts to configure incorrectly. It does not guarantee that vulnerabilities will never appear, but it makes the protocol easier to reason about.

WireGuard is also intentionally opinionated about cryptography. Rather than negotiating among long lists of algorithms, it uses a fixed modern suite that includes Curve25519, ChaCha20 with Poly1305, BLAKE2s, and HKDF.

That simplicity carries into performance. WireGuard runs over UDP, uses a short handshake, and was designed for efficient packet processing. Its ability to relearn a peer’s endpoint also makes it well suited to laptops and phones that move between Wi-Fi and cellular networks.

OpenVPN still earns its place in enterprise networks

OpenVPN is considerably more complex, but much of that complexity exists for a reason. Its TLS-based architecture supports certificates, certificate authorities, revocation, external authentication systems, TCP or UDP transport, and detailed routing policies. Administrators can fit it into infrastructure that was built long before WireGuard appeared.

A company with an established public key infrastructure may therefore value OpenVPN’s controls more than a smaller codebase.

Historically, that flexibility also came with more processing overhead. OpenVPN handled much of its data path in user space, while its TLS and crypto dependencies created a larger software surface than WireGuard’s fixed design.

That performance gap is no longer as simple as old benchmark charts suggest. OpenVPN 2.6 supports Data Channel Offload on Linux, Windows, and FreeBSD, moving packet-processing work into the kernel and improving throughput considerably.

OpenVPN is best understood as a mature, configurable system rather than simply an older and slower WireGuard. Its extra machinery can be unnecessary for a personal VPN connection and useful for exactly the same reason in an enterprise deployment.

Shadowsocks solves a different security problem

Shadowsocks is not a conventional VPN protocol. It is an encrypted proxy originally created for networks where censorship and protocol blocking are part of the threat model.

Instead of creating the same type of layer-3 tunnel as WireGuard, Shadowsocks forwards traffic through an encrypted proxy connection. Modern implementations commonly use authenticated encryption, while the protocol avoids many of the obvious fixed signatures associated with traditional VPN traffic.

This becomes useful when a network operator is actively looking for VPN connections rather than merely inspecting their contents. A conventional VPN may encrypt every byte perfectly and still be recognizable as VPN traffic. Firewalls can examine handshake structures, packet sizes, timing, transport behavior, and other characteristics even when they cannot read the payload.

Why obfuscation is becoming harder

Older filtering systems often relied heavily on simple protocol signatures. Modern traffic classifiers can work with behavior as well.

That creates an interesting problem for Shadowsocks. Traffic that looks like high-entropy random data can defeat basic signature matching, but on an aggressively monitored network, “unrecognized encrypted traffic” can itself become something worth flagging.

Published research (PDF) has shown that Shadowsocks deployments can be detected through a mixture of passive traffic analysis and active probing. OpenVPN has faced similar research, with classifiers identifying characteristic packet patterns even when the content itself remained encrypted.

WireGuard vs OpenVPN vs Shadowsocks

The architectural differences become clearer when the three are compared by purpose rather than by marketing labels.

Protocol	Best fit	Main strength	Main trade-off
WireGuard	Mobile VPNs, remote work, gaming, general privacy	Compact design and low overhead	UDP-only and fewer enterprise options
OpenVPN	Corporate access and legacy infrastructure	Authentication and configuration flexibility	Larger and more complex stack
Shadowsocks	Restricted or heavily filtered networks	Reduced reliance on obvious VPN signatures	Encrypted proxy rather than a full VPN by itself

This is also why having multiple protocol options in one client can be useful. Toggle says its VPN client supports WireGuard and Shadowsocks, allowing users to choose between them based on connection conditions. These product claims were not independently tested for this article.

That does not mean every connection should layer both technologies or that one automatically fixes the weaknesses of the other. The useful part is having access to different approaches without rebuilding the networking setup from scratch.

Choosing a protocol by the problem in front of you

Protocol selection gets easier when it starts with the environment instead of a favorite benchmark.

Choose WireGuard when efficiency is the priority. It is a strong fit for mobile devices, remote workers, gaming, and other situations where low overhead and quick reconnection matter.
Keep OpenVPN where compatibility matters more. Existing certificate systems, TCP requirements, complex routing, and older enterprise infrastructure may justify the extra complexity.
Use Shadowsocks when filtering is the main obstacle. Its proxy architecture is designed for networks where recognizable VPN traffic may be restricted.
Test the actual route. Server distance, packet loss, firewall policy, and local filtering can matter more than theoretical protocol performance.
Do not equate encryption with invisibility. A tunnel can protect packet contents while remaining easy for a network classifier to identify.

The best protocol depends on what the network is fighting

WireGuard changed VPN design by proving that a secure tunnel could be built with far less code and far fewer configuration choices. OpenVPN remains relevant because enterprise networks often need exactly the controls WireGuard intentionally avoids. Shadowsocks tackles another problem entirely: keeping an encrypted connection usable when the network itself is trying to identify and restrict it.

For IT professionals, there is no need to force those designs into a single winner.

WireGuard is the stronger default when speed, mobility, and a small attack surface lead the requirements. OpenVPN remains useful when authentication and compatibility dominate. Shadowsocks becomes valuable when detection and blocking are part of the network environment.

(Photo by Kevin Paster)

Transferring Unused IPv4 Addresses in Asia Pacific: The Complete APNIC Playbook

Thu, 29 Oct 2026 00:01:19 +0000

If your network needs more IPv4 space in the Asia Pacific region, the transfer market is now the main way to get it. Asia Pacific Network Information Centre (APNIC) became the first regional registry to run out of freely allocated IPv4 on 15 April 2011, according to the IPv4 address exhaustion record.

That makes APNIC’s transfer policy the rulebook for almost every new block in the region. APNIC’s own summary page lists the permitted transfer scenarios and little else. This guide covers the rest: who qualifies, what the registry checks, how the workflow runs, what it costs and where deals tend to stall.

Key Takeaways

Both sides of a transfer inside the APNIC region must be current APNIC account holders, and the smallest block you can transfer is a /24.
Buyers must show a detailed plan to use the space within 24 months. Buyers who already hold IPv4 must also show past usage and compliance with APNIC policy.
Addresses delegated from APNIC’s 103/8 free pool cannot be transferred for at least five years after the original delegation.
The seller starts the transfer in MyAPNIC and the buyer has 30 days to acknowledge it, or the request is cancelled.
Pre-approval lets a buyer clear the needs assessment before finding a seller.
The recipient generally pays APNIC’s transfer fee before the Whois record is updated.

Why APNIC Allows IPv4 Transfers

The goal of the policy is simple. It moves IPv4 from organizations that no longer need it to organizations that do but can’t get it from the free pool, as set out in the APNIC Internet Number Resource Policies.

APNIC treats addresses as licensed for use rather than owned. So a transfer is really a change in who the registry recognizes as the holder, recorded in the APNIC Whois Database. APNIC does not recognize transfers made outside its policy and can require those addresses to be returned.

The Five Transfer Scenarios

APNIC permits five transfer paths for unused IPv4 addresses and AS numbers. Some economies in the region run their own National Internet Registry (NIR) under APNIC, which is why several paths involve one.

Scenario	Who is involved	What to watch
Between APNIC accounts	Two APNIC account holders	Standard in-region rules apply
APNIC and an NIR	An APNIC account holder and an NIR member	Check the NIR’s published transfer rules
Between two NIRs	Members of two NIRs	Check each NIR’s published transfer rules
NIR inter-RIR	An NIR member and another regional registry	The counterpart registry needs a compatible policy
APNIC inter-RIR	An APNIC account holder and another regional registry	The counterpart registry needs a compatible policy

The scenario changes who you deal with, not the core test. Each one still asks whether the seller is the rightful holder and whether the buyer can justify the space.

What APNIC Requires From the Buyer

The recipient must be a current APNIC account holder before anything can move. From there, the test depends on whether you already hold IPv4.

A first-time holder must show a detailed plan for using the transferred space within 24 months. An existing holder needs that plan too, plus its past usage rate and evidence that it complied with APNIC policy on earlier delegations.

The plan has to be backed by real documents. APNIC’s general request rules say evidence can include network engineering plans, subnetting plans, topology and routing descriptions, equipment invoices and purchase orders. Estimates must be realistic and justifiable, and incomplete requests wait until the gaps are fixed.

What APNIC Requires From the Seller

The source must be the currently registered holder of the block and cannot be involved in any dispute over it. The space must sit in the range APNIC administers and be allocated or assigned to a current account holder.

Three limits catch sellers most often:

Minimum size. Nothing smaller than a /24 can be transferred.

The 103/8 lock. Space delegated from APNIC’s final 103/8 pool cannot move for at least five years after the original delegation. If the original reason for the request no longer applies during that time, the addresses go back to APNIC.

Loss of rights. Once the transfer completes, the seller has no further rights to the addresses, according to the APNIC Transfer Conditions.

If you are buying, check the delegation date of any 103/8 block before you sign anything. A block still inside its five-year window cannot be transferred at all.

How a Transfer Runs in MyAPNIC

Every in-region transfer is lodged through MyAPNIC, APNIC’s member portal. The sequence below follows APNIC’s IPv4 Transfer Guide.

Get pre-approved (optional but smart). The buyer submits the Transfer Pre-approval form in MyAPNIC before finding a source. Once approved, any transfer within the approved size moves ahead without the buyer justifying need again.
The seller initiates. The source account starts the transfer in MyAPNIC and selects the addresses to move.
The buyer acknowledges. The recipient has 30 days to accept the transfer. Miss that window and the request is cancelled.
APNIC evaluates. The registry checks the transfer against its IPv4 transfer criteria.
Fees are paid and Whois updates. The recipient pays the transfer fee, then APNIC updates the registration in its Whois Database.

Pre-approval is the step most buyers underuse. Doing it first means the needs review is settled before money changes hands, so a signed deal is far less likely to stall.

Working With a Registered Broker

Most buyers don’t have a seller lined up, which is where brokers come in. APNIC keeps a page of registered IPv4 brokers that have signed an agreement to follow its broker guidelines, including acting in good faith with both sides.

APNIC is clear that these brokers are not its agents and that it does not endorse their services. IPv4 Connect appears on that list under its operator, Brander Group. Its marketplace sells blocks at fixed prices instead of through auctions and includes a free blacklist report with every subnet.

It also offers pre-approval assistance and fully managed transfers across ARIN, RIPE and APNIC, which it says typically take two to three weeks. A good broker also handles cleanup the registry won’t. That includes clearing old BGP announcements, stale route records and DNS entries before the block changes hands, so the space arrives ready to use.

What an APNIC Transfer Costs

There are two separate costs: the price you agree with the seller and APNIC’s own fees. The purchase price is set by the market and depends on block size and supply. For approved transfers inside the region, the recipient pays APNIC’s transfer fee, except NIR members.

The fee is due before APNIC updates the Whois registration. On an outbound inter-RIR transfer, the APNIC account holder sending the space pays instead. APNIC has long calculated this fee as 20% of the annual fee for the block being transferred, as shown in its policy update briefing.

Some transfers are exempt, so confirm the current figure on APNIC’s IPv4 Transfer Fees page before you budget. All APNIC fees are charged in Australian dollars. Membership is a recurring cost to plan for as well. Taking on more address space can raise your annual fees at the next renewal.

Moving Space Between Regions

Inter-RIR transfers let space cross between APNIC and other regional registries, such as ARIN and the RIPE NCC. APNIC only processes them when the counterpart registry has a compatible inter-RIR policy. Each side follows its own registry’s rules. An APNIC recipient still faces the 24-month plan test, while a recipient elsewhere meets its own registry’s conditions.

When space leaves APNIC, linked objects such as route and domain objects are deleted from the APNIC Whois Database.

Due Diligence Before You Sign

A registry approval confirms the paperwork, not the quality of the block. Run these checks before committing funds:

Holder match. Confirm the Whois record names the seller as the current holder with no open dispute.

Delegation date. Rule out any 103/8 space still inside its five-year lock.

Reputation. Check the range against major IP blacklists so you don’t inherit someone else’s abuse history.

Routing hygiene. Make sure old announcements and route objects are cleared, then plan your own route objects and ROAs before you announce the block.

Payment protection. Use escrow or a structure that releases funds only after the registry records the transfer.

APNIC also publishes a public transfer log. It is a useful way to check a block’s recent history before you buy.

Treat the purchase with the same care you would give any security decision. You will be sharing network plans, invoices and account details with brokers and the registry, so follow the basics of how to keep your data safe when transferring large files.

Conclusion

APNIC’s transfer rules are strict but predictable. Buyers need an APNIC account and a credible 24-month plan. Sellers need clean title and a block outside the 103/8 lock. Both sides then work through MyAPNIC on a 30-day clock.

The smoothest deals settle the hard parts early. Get pre-approved first. Then verify the block’s history and reputation and budget for both the price and APNIC’s fees before you sign.

FAQ

Do I need an APNIC account to receive transferred IPv4? Yes. For transfers inside the region, the recipient must be a current APNIC account holder.

How long does the buyer have to accept a transfer? Thirty days from when the seller initiates it in MyAPNIC. After that, the request is cancelled.

Can I buy addresses from the 103/8 range? Only if at least five years have passed since APNIC originally delegated them.

Can IPv6 addresses be transferred in the APNIC region? APNIC only recognizes IPv6 transfers that result from a merger or acquisition.

Can AS numbers be transferred too? Yes. The recipient must meet APNIC’s normal criteria for being assigned an ASN.

Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months

Thu, 29 Oct 2026 11:46:14 +0000

A Ukrainian man who helped carry out Nefilim and Hive ransomware attacks has been sentenced to 70 months in prison. Artem Stryzhak, 36, participated in operations that encrypted victims’ files and demanded payment for their recovery, including attacks against healthcare organisations during the COVID-19 pandemic.

The US Department of Justice announced the sentence on October 27. Stryzhak, formerly of Barcelona, was arrested in Spain in June 2024 and extradited to the United States in April 2025. He pleaded guilty in December to two computer-crime conspiracy counts.

Paying for Access to Nefilim

Stryzhak joined Nefilim as an affiliate around June 2021, agreeing to give its administrators 20% of his ransom proceeds in exchange for access to the malware.

As Hackread.com reported following his guilty plea, the operation gave affiliates tools to research companies before attacking them. Stryzhak and his co-conspirators used public databases to examine prospective victims’ revenue, size and contact information.

They could then prepare a separate ransomware executable, decryption key and ransom note for each victim. The extortion continued after encryption, with threats to publish stolen information on Nefilim’s “Corporate Leaks” websites if companies refused to pay.

According to the DOJ’s press release, prosecutors described one June 2021 attack in which Stryzhak stole information from an oil and gas transportation company. About a week later, he created email addresses used in its ransom note. His participation in the Nefilim conspiracy continued until at least October 2021.

Nefilim Ransomware Group’s ransom note (Image credit: SentinelLABS)

Hive Attacks Included Healthcare Victims

Stryzhak also became one of Hive’s earliest affiliates. He and his co-conspirators deployed its ransomware against seven victims, including law firms, a dental office and a healthcare provider.

During its investigation, the FBI supplied one of those victims with a decryption key, allowing it to recover encrypted files without paying. Authorities said Hive ransomware collectively attacked approximately 1,500 victims between June 2021 and January 2023, a group-wide figure, not Stryzhak’s individual victim count.

Investigators are still seeking his charged co-conspirator, Volodymyr Tymoshchuk, whom prosecutors identify as a Nefilim administrator. The State Department is offering up to $11 million for information leading to his arrest or conviction, or establishing his location.

Volodymyr Tymoshchuk

AppViewX Expands Quantum Trust Hub with Cryptographic Discovery, Posture Management, and Remediation

Thu, 29 Oct 2026 13:00:04 +0000

New York, New York, October 29th, 2026, CyberNewswire

Now available as a standalone solution, Quantum Trust Hub delivers cryptographic posture management and agility for enterprises to uncover risk exposure, drive remediation at scale, and accelerate quantum readiness.

AppViewX, the leading identity security company built for the AI-powered and post-quantum enterprise, today announced new capabilities for Quantum Trust Hub, now available as a standalone solution to help enterprises discover cryptographic assets, assess quantum-related vulnerabilities, prioritize risks by business impact, and take decisive action through integrated remediation workflows. The new capabilities include an agentless-first approach that leverages organizations’ existing security infrastructure to discover cryptographic assets without the additional overhead of agents and sensors. Organizations can also upload Cryptographic Bills of Materials (CBOMs) and Software Bills of Materials (SBOMs) from third-party tools to build a single, unified inventory of cryptographic assets, and initiate remediation planning and execution through existing ITSM solutions.

As enterprises prepare for the transition to post-quantum cryptography (PQC), understanding where vulnerable cryptography exists across their environments is becoming increasingly critical. NIST finalized its first PQC standards in 2024 and has outlined plans to begin phasing out RSA and ECC in 2030. By that same year, Executive Order 14412 directs federal agencies to transition high-value assets and high-impact systems to PQC for key establishment, with PQC adoption for digital signatures to follow by the end of 2031. Meeting these deadlines requires a comprehensive understanding of cryptographic exposure, yet traditional certificate inventories alone do not tell the full story. Cryptographic exposure extends beyond certificates to TLS configurations, keys, and application code, making it difficult to assess true risk and know where to focus first.

Addressing these challenges requires continuous visibility across multiple layers of cryptographic infrastructure. Quantum Trust Hub delivers this through a vendor-neutral approach, consolidating findings from existing security tools and third-party inventories. By building a unified cryptographic inventory and extending visibility across certificates, TLS configurations, cipher suites, and code libraries, the platform gives security teams the cryptographic posture management foundation they need, enabling continuous assessment of exposure, risk-based remediation prioritization, and the cryptographic agility to respond quickly as threats and standards evolve.

“The quantum transition is a complex undertaking that enterprises need to start preparing for now,” said Jennifer Glenn, research director at IDC. “Recent attacks involving compromised cryptographic credentials and signing keys underscore the risks organizations already face today. With federal migration deadlines approaching and quantum computing potentially advancing faster than expected, understanding the full scope of cryptographic exposure will be essential to planning an effective response.”

With the latest Quantum Trust Hub capabilities, enterprises can:

Expand cryptographic discovery using existing security investments: Through a new integration with Qualys, alongside existing Tenable support, organizations can discover cryptographic assets and configurations using security tools already deployed across their environments. AppViewX’s agentless-first approach reduces cost and complexity while supporting deeper discovery when needed.
Build a single, unified cryptographic inventory: CBOMs and SBOMs from third-party tools can be uploaded directly into the platform, consolidating findings from multiple discovery sources across certificates, TLS configurations, cipher suites, keys, and application code. This provides the foundation for true cryptographic posture management.
Prioritize what matters most: Assets are classified as quantum-vulnerable or quantum-resistant. Business application context and NIST-aligned severity ratings enable organizations to surface the most critical remediation priorities to address first. Executive dashboards and continuous monitoring track posture and migration progress over time.
Drive remediation through existing ITSM workflows: Cryptographic findings are sent directly to ServiceNow as ready-to-work tickets containing affected assets, identified risks, recommended fixes, and ownership information. Tickets are grouped by remediation scope, with status tracked end-to-end so teams can ensure findings translate into action, not just reports.
Move faster with cryptographic agility: By maintaining a comprehensive, continuously updated inventory of cryptographic assets and their risk status, organizations can respond quickly to new vulnerabilities, policy changes, and evolving PQC standards, without having to scramble to understand their exposure from scratch.

The expansion of Quantum Trust Hub reinforces AppViewX’s broader mission to secure machine and AI identities, credentials, and cryptography through a cohesive product portfolio as enterprises navigate the transition to post-quantum computing. Quantum Trust Hub works alongside AppViewX’s CLM and SSH Key Lifecycle Management solutions to accelerate remediation of certificates or SSH keys that require replacement as part of a PQC assessment. Additionally, AppViewX recently advanced its Agent Identity Security solution to discover, govern, and control the actions of AI agents at runtime while extending its core CLM and PKI products to issue cryptographically verifiable, quantum-resilient identities for AI agents, establishing an additional layer of trust as they access enterprise systems. Together, these offerings provide enterprises with a more comprehensive approach to securing machine and agent identities while managing cryptographic risk across their environments.

“The quantum clock is ticking, and enterprises cannot afford to wait until post-quantum migration becomes an immediate requirement to understand their exposure,” said Archit Lohokare, CEO of AppViewX. “Certificates are only one part of the equation. Cryptographic risk extends across the identities, keys, protocols, and applications that underpin enterprise trust. With Quantum Trust Hub, we’re giving organizations the continuous visibility and risk intelligence needed to identify vulnerable cryptography, focus on their most critical exposures, and take a more proactive approach to quantum readiness.”

To learn more about Quantum Trust Hub, watch AppViewX’s on-demand webinar, “The Quantum Readiness Clock Is Ticking: What to Do Now” or explore a 30-day quantum readiness assessment by talking to an AppViewX expert.

About AppViewX

AppViewX is the leading machine and agent identity security company built for the AI and quantum enterprise, bringing together discovery, automation, control, and intelligence. The AVX Platform helps enterprises reduce risk by providing complete visibility and governance over every machine and AI agent identity, automating their lifecycle, controlling their access, and ensuring compliance at the speed business demands.

Trusted by global enterprises across financial services, healthcare, and technology, AppViewX is recognized as a leader in the IDC MarketScape for Certificate Lifecycle Management and KuppingerCole’s Non-Human Identity Management Leadership Compass. For more information, users can visit appviewx.com.

Contact

AppViewX Media
AppViewX
[email protected]

ADEX: AI Involved in 52% of Detected Ad Fraud Schemes – Shopping Agents Could be Next

Thu, 29 Oct 2026 13:02:49 +0000

LIMASSOL, Cyprus, October 27 2026 – AI played a significant role in 52% of Advertising fraud schemes identified by ADEX, a leading AI-powered traffic validation and anti-fraud ecosystem, between January and September 2026, according to the company’s new State of Ad Fraud 2026: ADEX Trust & Safety Report (PDF).

The findings are based on aggregated moderation data from eight advertising platforms using ADEX and cover 1.2 million campaigns and 4.9 million creatives.

Among AI-involved schemes, bots impersonating humans appeared in 64% fraud schemes, while cloned brands and fake endorsements featured in 53%. Deepfakes appeared in 11%. The categories overlap, as fraudulent schemes often tend to combine several AI-powered techniques.

The change AI brings about is fundamental though. A set of agents now stands in the place of a team of content makers, designers and developers. Fraud content today is super cheap to produce and even cheaper to scale. And ADEX expects the next shift to take it a few levels up: in 2027, fraudsters may increasingly target the AI agents that browse websites, compare products, and make purchases on behalf of regular people.

The same old scam gets a shiny new wrapper

A typical fake investment campaign of only a couple of years ago usually meant a hastily assembled landing page, maybe a celebrity photograph paired with a fabricated quote. Behind, there was a small team working potential victims through private messages.

Today, AI can produce a polished imitation of a legitimate news outlet or financial institution that would look almost flawless to the naked eye. A chatbot can then handle conversations around the clock, responding fluently in the victim’s language. The quality can be so good even people well-versed in AI may not see it’s fake right away.

“The scheme itself has not changed in years: borrow a trusted face, promise big returns, move the victim into a private chat. What AI changed is the finish. The page looks real, the video looks real, and the person in the chat never sleeps and never makes a typo,” said Sergey Martianov, Chief Product Officer at ADEX

According to the report, brand cloning and fake endorsements appear across investment and blockchain scams, as well as fraudulent e-commerce stores. Attackers also imitate familiar technology brands to distribute fake security alerts.

AI has also accelerated the cycle of replacing fraudulent advertising materials. ADEX researchers observed cases in which revised versions of rejected campaigns returned within hours, sometimes on the same day. The company does not report a standard turnaround time, as it varies considerably between schemes.

The next target could be the AI doing your shopping

Online users delegate more and more tasks to AI assistants. That’s why ADEX expects fraudsters to adapt their tactics to an emerging new audience: machines who we allow to make decisions for us.

An example of such attack is prompt injection, where malicious instructions are embedded in content an AI agent consumes while performing a legitimate task.

These instructions could appear in invisible page elements, metadata, product images, or text addressed directly to AI assistants. Attackers could also serve different content to human visitors and AI agentsAI agents, adapting cloaking techniques already used to evade advertising moderation.

ADEX emphasizes that this is a forecast rather than an attack category currently measured in its moderation data. However, prompt-injection techniques are already documented in security research, and the company has previously examined how AI agents can be manipulated into delivering malicious content.

“In 2027, the most valuable user on the web may not be a person at all. If an agent is doing the shopping, someone will try to scam the agent. The industry needs to start checking ads for what they say to machines, too,” Martianov explained.

When a bot is also a legitimate customer

The expected growth of AI shopping agents presents another challenge for advertisers and platforms: distinguishing legitimate automated activity from malicious bots.

An AI assistant that compares prices or buys something for a real customer is doing a legitimate job, even if no human ever touches the website.

So the question isn’t “bot or human?” ADEX suggests asking three things instead. Can the visitor prove who it is? Does it behave the way its stated task says it should? And do its sessions end in something real, like a purchase or a booking? Platforms should also watch for websites that show AI agents one page and people another.

For advertisers, the to-do list is short. Keep an eye out for your brand in other people’s ads. Check where your clicks actually end up. And ask your technology partners a simple question: how do you tell a good agent from bad automation?

With AI now on both sides of the ad transaction, two questions matter more and more: who, or what, is making the decision, and what told it to?

The full findings are available in State of Ad Fraud 2026: ADEX Trust & Safety Report (PDF).

About ADEX

ADEX is a global anti-fraud and traffic-quality platform within AdTech Holding. It analyzes billions of impressions, clicks, and conversions, protecting AdTech products and partners from malware-driven and invalid traffic attacks.

Methodology

The report analyzes aggregated moderation and verification data from eight advertising platforms using ADEX, covering January through September 2026. AI involvement is calculated across distinct fraud schemes, rather than individual campaigns or accounts. Categories may overlap.

EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft

Thu, 29 Oct 2026 15:20:58 +0000

Gal Weizman, a security researcher at cybersecurity company Forever Security, has identified a class of security flaws dubbed EMBRACE (EMbedded BRowser, trusted like a real one) in five AI coding tools.

Shared with Hackread.com ahead of its public release on October 29, the research identifies weaknesses in browser security controls integrated into Cursor, GitHub Copilot, OpenAI Codex, Visual Studio Code (VS Code) and Claude Desktop.

The potential reach is noteworthy, with Forever Security estimating that hundreds of millions of developers and users could be affected since VS Code has around 40 million developers and Codex has more than 5 million weekly users.

Three Ways Embedded Browsers Can Be Abused

Cursor: Code execution. A malicious web page can exploit a communication bridge between Cursor’s embedded browser and its AI assistant to inject hidden instructions into the command composer. In testing, the assistant was manipulated into running an installation command that launched Calculator on the host system. The command initially hit a sandbox restriction, but the agent disabled the restriction and retried. The outcome depended on the model’s behavior.

Forever Security’s Cursor demonstration launched Calculator through a malicious package installation, showing code execution on the host computer. Credit: Forever Security.

GitHub Copilot: Address-bar spoofing. In version 1.1.27, a malicious page could change the URL displayed in Copilot’s browser preview without navigating to the claimed destination. The address bar and AI agent could therefore report github.com/login while displaying a page hosted by an attacker, creating an opportunity for phishing.

Codex, VS Code and Claude Desktop: File theft. Researchers found that local HTML files opened in these applications could access files beyond their intended project boundaries. In VS Code and Claude Desktop, web workers could bypass directory checks enforced on the main page. Codex lacked the relevant restriction, allowing direct file access. They demonstrated reading and exfiltrating files, including SSH keys, developer tokens and private documents.

Files and output from Forever Security’s local-file access demonstration, including results labelled as Claude application data and history. Credit to Forever Security.

Disclosure Timeline and Patch Status

Forever Security reported the Cursor flaw on September 10; it was patched on October 1. GitHub independently fixed the Copilot issue in version 1.1.29 on October 13, after the flaw was identified on September 26.

Researchers reported the Codex issue to OpenAI on July 27 and the VS Code issue to Microsoft on September 10. According to Weizman, neither issue had been patched at the time of publication.

The findings show how embedded browsers can expose developer systems to code execution, local file theft and address-bar spoofing when security boundaries are not properly enforced.

Hackread.com has previously reported on related risks, including attacks that use hidden website instructions to manipulate AI assistants and browser extensions to inject prompts into AI interfaces.

Businesses should note that a single developer endpoint running an affected tool could expose accessible SSH keys, cloud credentials, developer tokens and source code, or allow code execution on the host, depending on the product involved.

Forever Security advises organizations to identify these tools across developer endpoints and review the security controls governing their embedded browsers.

Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen

Fri, 30 Oct 2026 02:02:38 +0000

The cryprocurrency exchange Binance is investigating a suspected hack after billions of dollars moved from wallets associated with the exchange on October 29, 2026. Outside investigators have estimated the suspicious transfers at up to $5.8 billion, a figure that would make this the largest cryptocurrency theft publicly reported if confirmed.

The exchange has not confirmed that amount as stolen but confirmed that it was investigating the incident and assured customers that their funds were “completely safe.” Meanwhile, cryptocurrency issuers began freezing assets linked to the suspicious activity.

Billions Moved Before Issuers Froze Assets

Blockchain investigators began examining large transfers involving several networks, with their estimates changing as additional transactions were identified.

Blockchain security company Blockaid said in a tweet it was investigating approximately $3.3 billion in suspicious outflows involving Ethereum, Arbitrum and Avalanche. Coinbase executive Conor Grogan placed the amount as high as $5.8 billion.

Those figures represent assessments made at different stages of the investigation. They should not be added together or treated as Binance’s final loss.

Binance said in an October 30 update that approximately $3 billion had been verified as frozen. The exchange is working with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. It reiterated that user funds are safe.

Freezing prevents affected tokens from being transferred under the issuer’s controls. It does not mean that the money has already been returned to Binance or establish how much the exchange will ultimately recover.

Update: The current verified total frozen amount is around $3 billion.

Our teams continue to work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.

We will only share confirmed figures and will… pic.twitter.com/e5RHM1VwOU
— Binance (@binance) October 30, 2026

How the Incident Unfolded

As investigators traced the transfers, Binance began issuing updates and stablecoin issuers froze funds. The timeline below follows those developments using Decrypt’s reporting and Unchained’s account of the announcements. The initial compromise may have occurred before the first recorded transfer.

Time	Reported development
20.24	An Ethereum transaction moved 167,464 ETH and multiple other tokens, according to Decrypt’s analysis.
21.01	Tether began freezing assets associated with the suspicious transfers.
21.04	Circle froze approximately $823 million in USDC.
21.15	Binance founder Changpeng Zhao (CZ) said the activity appeared to be a hack and that he expected customer funds to be covered.
21.16	Binance publicly acknowledged that it was investigating.
21.29	The exchange updated its statement to say user funds were completely safe.

All times are in GMT (UTC) on October 29, 2026.

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.
— Jeremy Allaire (@jerallaire) October 29, 2026

Researchers Examine a Signed Wallet Delegation

Investigators examining the Ethereum transfers identified a signed authorization shortly before the funds moved. The authorization used EIP-7702, an Ethereum feature that allows a wallet to delegate functions to smart-contract code.

Phylax Systems founder Odysseas Lamtzidi described how that delegation could allow code to execute through the affected wallet and authorize further transfers. Decrypt reported that the authorization appeared three minutes and 24 seconds before the initial Ethereum transaction.

1/4 EIP-7702 can turn the wallet itself into the sweeper.

A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed.

This is bad.https://t.co/GrvUiya16D pic.twitter.com/zONu8cwW63
— Odysseus | phylax.systems (@odysseas_eth) October 29, 2026

That finding could explain part of the transfer mechanism, but it does not explain how the required signature was obtained. The available reporting has not established whether an attacker stole signing credentials, compromised a signing system or persuaded someone to approve a malicious request. Nor does the use of EIP-7702 itself demonstrate a flaw in Ethereum.

No Attacker Has Been Publicly Identified

Binance had not publicly attributed the incident to a named group in the statements reviewed for this report. The initial entry point, the people responsible and the full extent of access remained unknown. However, the incident comes about a month after Bitget reported a hack and suspected involvement by North Korea’s Lazarus Group.

CZ, who said he does not manage Binance anymore, wrote on X⁠ that the activity looked like a hack. Speaking as a shareholder, he said he expected all user funds to be fully covered. That was his expectation, separate from the exchange’s investigation and its own customer assurances.

If the upper estimates are confirmed as stolen funds, the incident would exceed the approximately $1.5 billion Bybit theft in February 2025. However, the gross value moved, the amount frozen and the eventual unrecovered loss are different figures. None should be substituted for another while the investigation continues.

Binance.US separately said it was unaffected.

Binance Warns Customers About Unofficial Messages

Customers seeking information were directed to Binance’s official announcements. In its initial statement⁠, the exchange warned users about unofficial links, messages and requests for account information.

The unresolved questions now concern how the transfers were authorized, whether the attacker retains any access and how much of the moved cryptocurrency can be recovered. Binance’s assurance that customer funds are safe does not yet provide a final accounting of the incident.

HackRead

OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery

Contact

Summit Public Schools Breach Exposes 115 GB of Student and Staff Data

Personal Information and Historical School Records Exposed

PowerSchool, Clever and Salesforce Exports Included

Hacker Claims Access Through a Critical Vulnerability

Claims of Student Medical Data Remain Unverified

Waqas

From Rules to AI and Back

Rules-Based Era

Move to Machine Learning

False Positive Crisis

The Explainability Problem

Advances in Fraud Techniques

Evolution of Anti-Fraud Approaches Into Hybrid Systems

Behavioral Analytics

Conclusion

Alena Sidelnikova

Next-gen privacy protocols: WireGuard vs OpenVPN vs Shadowsocks

WireGuard keeps the tunnel deliberately small

OpenVPN still earns its place in enterprise networks

Shadowsocks solves a different security problem

Why obfuscation is becoming harder

WireGuard vs OpenVPN vs Shadowsocks

Choosing a protocol by the problem in front of you

The best protocol depends on what the network is fighting

Transferring Unused IPv4 Addresses in Asia Pacific: The Complete APNIC Playbook

Key Takeaways

Why APNIC Allows IPv4 Transfers

The Five Transfer Scenarios

What APNIC Requires From the Buyer

What APNIC Requires From the Seller

How a Transfer Runs in MyAPNIC

Working With a Registered Broker

What an APNIC Transfer Costs

Moving Space Between Regions

Due Diligence Before You Sign

Conclusion

FAQ

Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months

Paying for Access to Nefilim

Hive Attacks Included Healthcare Victims

Waqas

AppViewX Expands Quantum Trust Hub with Cryptographic Discovery, Posture Management, and Remediation

Contact

ADEX: AI Involved in 52% of Detected Ad Fraud Schemes – Shopping Agents Could be Next

The same old scam gets a shiny new wrapper

The next target could be the AI doing your shopping

When a bot is also a legitimate customer

About ADEX

Methodology

EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft

Three Ways Embedded Browsers Can Be Abused

Disclosure Timeline and Patch Status

Deeba Ahmed

Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen

Billions Moved Before Issuers Froze Assets

How the Incident Unfolded

Researchers Examine a Signed Wallet Delegation

No Attacker Has Been Publicly Identified

Binance Warns Customers About Unofficial Messages

Waqas