Issue 01 · One laptop, $6.3 billion

Start here

Your 30-second briefing

Finance & crypto

About $6.3B was taken from Binance after one engineer's laptop was compromised.

Healthcare

UNM Health, a US trauma centre, unplugged its computers within 40 minutes of a breach.

Critical infrastructure

Hackers stole encryption keys from Cisco SD-WAN gear, and Volt Typhoon hit US utilities.

Public sector

Attackers pulled data on 750,000 people from Moldova's government e-services.

Ijaz's take

The pattern for me this week: attackers went after things we trust to act on our behalf. An engineer's laptop, a network controller, a package update, a government lookup service. We spend a lot proving who someone is at login, and far less asking what our own systems will do once they trust something. That's the gap I'd look at first.

Confirmed incidentFinance & cryptoLogins & access

One laptop, $6.3 billion

Affected: Binance (crypto exchange) and its customers · 17 hot wallets · losses covered by Binance

About $6.3B left Binance's hot wallets, the crypto kept online for quick payouts. A DevOps engineer's laptop was used to reach a service container and push withdrawals. No private-key leak was found.

ThuUnauthorised withdrawals start draining hot wallets.
FriTheft stops after about 4 hours. Withdrawals frozen.
FriAbout $2.7B frozen. TRM Labs blames North Korea's TraderTraitor.
FriBinance says it will cover losses, with withdrawals back in 45 hours.

Most security money goes into protecting keys. Far less goes into who, or what, may ask for a payment, and from which device. Protecting the key is half the job. The other half is who can ask it to sign.

If you lead a team

Ask which systems can move money or data on their own, and whether a single laptop is enough to trigger them. Insist on a second, separate approval for large payouts.

If you run the tech

No standing production access from engineer laptops: just-in-time elevation, privileged-access workstations, velocity limits and out-of-band multi-party approval on signing services.

What it means here (GCC)

VARA-licensed exchanges and CBUAE-regulated payment firms run similar hot-wallet and automated-payout setups. Expect questions on who can approve a payout, and from which device.

Ask your team or provider

Can one laptop trigger a payment or data export? Who approves large automated payouts, and from where? How fast would we notice?

Next frontier: attackers are moving from stealing keys to abusing the automation around them: signing services, build pipelines, payment engines.

Sources: Euronews · TNGlobal · CoinDesk

By the numbers

The week in four figures

$6.3bnestimated taken from Binance's hot wallets in under four hoursEuronews (Binance figures)

40 minfrom UNM Health spotting a breach to telling staff to unplugHelp Net Security

750kpeople whose ID numbers were linked to data taken from Moldova's online servicesThe Record

26.4klive passwords and access keys found in public code on GiteeMongoDB research blog

Jargon buster

Hot wallet: crypto kept online for fast payouts. Convenient, but reachable.
Management plane: the consoles that run a network. Own them, own the network.
Supply-chain attack: poisoning software you trust, so it arrives via a normal install.

The rest of the week

Three more stories

Confirmed incidentHealthcareLogins & access

A hospital pulled the plug in 40 minutes

Ambulances diverted, surgeries cancelled, claims still unverified. Affected: UNM Health (University of New Mexico Hospitals, US), patients and staff. Claimed by BYOD.

What: The state's only Level 1 trauma centre unplugged soon after a breach on 26 Oct. BYOD claims its identity tenant. UNM says core systems are safe.
Leaders: Decide who can order a shutdown, and rehearse a day on paper.
Tech: Tier identity admin roles (PIM, phishing-resistant MFA) and alert on new federation or app consent.
Here: GCC hospitals face the same call, and DoH Abu Dhabi expects tested continuity plans.

Sources: Help Net Security · Infosecurity Magazine

Actively exploitedCritical infrastructureNetwork

Patched isn't the same as clean

State-backed crews are going after the boxes that run the network. Affected: Cisco SD-WAN and ASA/FTD customers, space, defence and policy targets, US utilities and telecom.

What: Talos tied KeyDrift malware, which copies SD-WAN encryption keys, to CVE-2026-20127. Lumen exposed Volt Typhoon's relay network.
Leaders: After a critical network device is patched, ask for evidence it's clean.
Tech: Upgrade, lock management ports, hunt Talos indicators, rebuild if in doubt.
Here: Run Cisco SD-WAN or ASA in the region? Patch, then hunt. Geo-blocking won't save you.

Source: The Hacker News (Cisco Talos, Lumen research)

Confirmed incidentPublic sectorPersonal data

750,000 people, no login needed

Attackers used government services that never asked who was calling. Affected: Government of Moldova, 82 e-services checked, about 750,000 citizens.

What: Over five days, attackers sent about 11 million requests through Moldova's unauthenticated online services and linked systems. 82 services were checked and the vulnerable ones taken offline.
Leaders: List every public service that returns personal data without a login, and ask who watches request volumes.
Tech: Require auth on data-returning APIs, rate-limit and alert on bulk queries, and test cross-system data paths.
Here: GCC governments run many joined-up e-services. Any lookup API that skips login deserves the same review.

Next frontier: "convenience" APIs that skip logins are the new open front door. Expect regulators to ask for an inventory of them.

Source: The Record (Recorded Future News)

Quick hits

Six things in one minute

Certificates. eMudhra (emSign): eight certificate-authority keys could be worked out from public data. Browsers blocked them, but apps with built-in trust lists need rebuilding. The Hacker News
Linux servers. Ubuntu and Red Hat: an old Linux TCP flaw (CVE-2026-98432) got an AI-built remote-root exploit in testing. Fixes still pending. The Hacker News · Cyber Kendra
Web & apps. Node.js, Envoy, Istio, Bun and .NET: a Brotli flaw (CVE-2026-111497) with public exploit code. Patch, or block compressed request bodies. CIS MS-ISAC
AI tools. LiteLLM 1.107.0 shipped with credential-stealing malware after its release pipeline was hijacked. BleepingComputer
Cloud tools. OVHcloud CLI: five GitHub releases were swapped for secret-stealing builds via a hijacked developer account. BleepingComputer
Secrets. Gitee (China's largest code host): 26,400 live keys found, including Alibaba Cloud, OpenAI and DeepSeek. MongoDB research blog

New rules, new tools

What changed, what's worth a look

Framework · NIST

NIST IR 8547: post-quantum roadmap

A roadmap to retire encryption that quantum computers could break, with full US federal migration by 2035. Relevant to anyone using US-aligned vendors and products.

Try it: list the systems that encrypt data or use certificates; ask your top five vendors for their post-quantum plan; flag data that must stay secret for 10 years (health, finance, IP).

Tool · public preview

GitHub npm package firewall

Blocks risky JavaScript packages at install time, including brand-new versions and new install scripts. Socket, Snyk and JFrog cover more languages; GitHub's is built in but npm-only. Pricing not announced.

Try it: pick one team's pipeline on GitHub Enterprise Cloud, point its npm installs at the firewall, set a 3–7 day cooldown, run a week and review what got blocked.

Your weekend playlist

Press play

Four picks, about three hours in total, all cyber podcasts.

66MINRisky Business #857: AI FUD intensifiesPatrick Gray with Alex Stamos. The week's supply-chain mess, including LiteLLM. Best for tech teams. 80MINDarknet Diaries #181: RickyJack Rhysider. How a phone hacker picked targets and broke in. Gripping for everyone. 27MINBetween Two Nerds: Why frontier lab security will always suckTom Uren and The Grugq. Security culture at AI labs. Great for leaders vetting AI vendors. 8MINRisky Bulletin: Brotli RCE is wrecking what's left of the internetA quick catch-up on the Brotli flaw. Tech.

Rabbit holes

What to research next

Payment-request controls

Companies guard the keys that sign payments, but rarely limit which people and systems may ask for one. This is about mapping and capping those requesters.

Why now: Binance's keys were safe. A hijacked laptop made the request.
Ask: Which of our systems will pay or export whatever a trusted service asks?
Try: Map one payment flow and mark every step a single approval can trigger.

Proving a network device is clean

After a patch, confirming no attacker code is left on a firewall, VPN or SD-WAN box, using logs, file hashes and integrity checks.

Why now: Cisco warns upgrades may not remove implants.
Ask: What evidence would convince us a firewall is clean?
Try: For one firewall, list the logs and integrity checks you can collect today.

Package cooldowns

Making builds wait a few days before installing brand-new versions of open-source packages, so poisoned releases are caught first.

Why now: Poisoned LiteLLM and OVHcloud releases were caught within days.
Ask: Could our builds wait 3–7 days for new versions?
Try: Run one team log-only for a week and count what a 3-day wait delays.

Monday checklist

Five things for Monday morning

LeadersAsk which systems can move money or data with a single approval.
LeadersConfirm who can order a shutdown, and when you last rehearsed it.
LeadersAsk key software suppliers how they protect their release process.
TechPatch Brotli in Node.js, Envoy and Istio, or block compressed request bodies.
TechAfter patching Cisco SD-WAN or ASA, hunt for implants and lock down management ports.

Pick a side

Where do you land?

You spot a live breach mid-morning on a busy weekday, as UNM Health did. What's your first move?

Pull the plug fast

Disconnect at the first sign of a breach, even if operations stop.

Keep running, contain quietly

Isolate what's hit and keep services going while you investigate.

And this week's question: if one laptop in your company were compromised tomorrow, what's the most it could move? Money, data or systems? Tell me on LinkedIn. The best comments make next week's issue.

Curated by Ijaz · Views my own, not my employer's.

← All issues PDF edition

One laptop. $6.3 billion gone.