# Today's Top Stories

Binance confirmed a security incident impacting approximately $6.3 billion in assets, with nearly $3 billion frozen on-chain. Tether and Circle separately froze over 1.567 billion USDT and 800 million USDC linked to the breach, respectively. If confirmed at full scale, this would rank among the largest cryptocurrency exchange hacks in history, with significant implications for exchange security posture and stablecoin issuer incident response capabilities.

Cisco released patches for a zero-day denial-of-service vulnerability (CVE-2026-76418, CVSS 8.6) in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that is being actively exploited in the wild. Unauthenticated remote attackers can trigger the flaw to crash SSL VPN services on affected firewall devices. This is the second Cisco firewall VPN zero-day exploited since August, making immediate patching critical for organizations relying on Cisco perimeter defenses.

Cisco Talos linked the exploitation of a Cisco SD-WAN zero-day and deployment of the KeyDrift malware — designed to exfiltrate SD-WAN encryption keys — to infrastructure overlapping with Volt Typhoon's 'Silent Train' network, a covert ephemeral proxy framework documented by Lumen. The malware targets Cisco Catalyst SD-WAN Controllers and stores stolen keys for later decryption of inter-site traffic. This attribution connects the campaign to Chinese state-sponsored critical infrastructure targeting operations.

Volt Typhoon has been operating a covert relay network dubbed 'Silent Train,' built on rapidly rotating chains of compromised devices used to mask zero-day attacks against high-value critical infrastructure targets. Lumen researchers documented the framework, which allows the group to conduct operations with minimal persistent infrastructure exposure. The technique significantly complicates attribution and blocking efforts, as indicators of compromise change frequently.

Palo Alto Networks warned of active exploitation of PHP2Shell vulnerabilities targeting publicly exposed management interfaces of its network devices. The PHP2Shell flaws are also being chained with a Linux kernel privilege escalation bug dubbed 'Fragnesia,' which CISA added to its Known Exploited Vulnerabilities catalog and directed federal agencies to patch. Security teams should immediately audit and restrict internet-facing management interfaces on Palo Alto appliances.

CISA added CVE-2026-41709, a low-severity VMware ESX logging bypass flaw, to its Known Exploited Vulnerabilities catalog after CrowdStrike revealed the China-nexus group 'Warp Panda' weaponized it as a zero-day against the U.S. legal sector. The vulnerability allows attackers with administrative privileges to perform operations without leaving an audit trail, effectively blinding forensic investigators. Its abuse by a state-sponsored actor despite a low CVSS score underscores the gap between severity ratings and real-world exploitation risk.

Researchers identified 319 malicious Chrome extensions with a combined 13.4 million reported installs that hijacked users' search queries by routing them through attacker-controlled tracking servers, generating advertising revenue via Bing and Yahoo. The campaign operated at scale while evading detection due to the extensions' legitimate-appearing functionality. Security teams managing enterprise browser environments should audit installed extensions against the identified IOCs.

A hacktivist group called 'Department of Peace' leaked a database containing personal and professional records on over 41,000 DHS employees, including undercover ICE agents and surveillance personnel, allegedly stolen from an Okta SSO system. The dataset was shared with journalist maia arson crimew and published by DDoSecrets, and a DHS contractor subsequently sought its removal. Exposure of undercover agent identities represents a serious operational security risk beyond typical PII breach impacts.

Security startup NebuSec disclosed a remote code execution flaw in Telegram for Android that allowed an attacker to execute code on a victim's device simply by having the victim answer a voice call, requiring only a standard Telegram account to exploit. The vulnerability affected all Telegram Android versions prior to 12.10.4, which was patched in late September 2026. The zero-interaction-during-call nature of the attack makes it particularly severe for high-risk users relying on Telegram for secure communications.

Cisco Talos detailed how threat actors exploited a critical vulnerability in Cisco Catalyst SD-WAN Controllers — patched in February — to deploy custom malware called KeyDrift, which is engineered to exfiltrate the encryption keys protecting inter-site SD-WAN traffic. The stolen keys would allow attackers to decrypt captured network traffic retroactively. Talos linked the attack infrastructure to Volt Typhoon's Silent Train relay network, suggesting Chinese state-sponsored involvement in targeting enterprise WAN encryption.