Help Net Security weekly roundup: Binance $6.3B theft, Brotli CVE-2026-111497, Volt Typhoon, Oracle EBS exploitation, Gheist campaign
This Help Net Security weekly roundup (week ending November 1, 2026) summarizes dozens of unrelated stories. The headline items are a reported $6.3 billion cryptocurrency theft from Binance, described as possibly the largest crypto heist on record, and the impact of the Brotli out-of-bounds write flaw CVE-2026-111497 (Node2Shell / Broccoli2Shell / Brotli2Shell), which reaches well beyond Node.js after Node.js disclosed it on October 21, 2026. The Brotli item is only a short pointer and adds no new technical facts.
Entenda a falha
A vulnerabilidade
The roundup covers two CVEs. CVE-2026-101767 is the most severe: a CVSS 9.8 flaw in the Application Object Library of Oracle E-Business Suite 12.2.3 to 12.2.15. It is reachable over HTTP with no authentication, and exploitation attempts have begun. CVE-2026-111497 is a remotely exploitable out-of-bounds write in Brotli, Google's compression library, nicknamed Node2Shell, Broccoli2Shell and Brotli2Shell. It reaches well beyond Node.js. The roundup gives no affected or fixed versions for Brotli, and no fixed Oracle version. It only says to apply the patches.
Como funciona
The sources do not describe the internal mechanism of either flaw. For Oracle EBS, the only detail is that an unauthenticated HTTP request can reach a vulnerable component in Application Object Library. For Brotli, the flaw is an out-of-bounds write, which means data is written outside the intended memory buffer while the library handles input. The roundup says nothing more about the exact step where it goes wrong.
Por que é vulnerável
For Brotli, the class of bug is an out-of-bounds write, a memory-safety error where a write goes past the end of a buffer. The roundup gives no root cause for the Oracle flaw beyond the missing authentication on an HTTP-reachable component. It also does not say why either bug went unnoticed or what the fixes change.
Como foi descoberta
Node.js publicly disclosed the Brotli flaw on October 21, 2026, and it then drew wide attention because of how many products use the library. The roundup does not say who found it or how it was reported. For Oracle EBS CVE-2026-101767, the roundup says only that exploitation attempts have begun and that an Oracle patch exists, and it does not say who found the flaw.
Explicação gerada por IA a partir da matéria e dos artigos, em 01/11/2026 22:37.
Detalhes técnicos
- Binance: about $6.3B stolen; the company found no evidence of a wallet private key leak and plans a technical post-mortem.
- Oracle EBS CVE-2026-101767: CVSS 9.8, unauthenticated HTTP flaw in Application Object Library (12.2.3 to 12.2.15); exploitation attempts have begun.
- Volt Typhoon: uses a rotating relay network ("Silent Train") per Lumen's Black Lotus Labs.
- Gheist: Wiz Research recovered over 13,500 planted branches from 850+ compromised GitHub accounts; the tool uses stolen tokens to plant workflows that print repository secrets into logs.
- China-nexus actors: reportedly exploited a VMware ESX zero-day and chained PHP2Shell with the "Fragnesia" Linux kernel bug; Cisco confirmed attackers crashing its firewalls with a newly disclosed flaw.
- Other items: a Microsoft Authenticator Android flaw (Enclave), a poisoned Claude Code extension with an SSH backdoor (Phorion), Yoba malware in fake ChatGPT/Claude GitHub projects (Check Point), fake IT help desk and Teams social engineering (Cisco Talos, Arctic Wolf), Tailscale SSH fixes, and a Huntress report on compromised camera management software.
- Breaches: UNM Health Sciences Center, University of Copenhagen (525,000 people), So-net (2.58 million), AfD (345,000 emails), DHS staff records (41,000), DreamHost.
Remediação
- Update Microsoft Authenticator on Android.
- Apply the Oracle EBS patch for CVE-2026-101767.
- Apply Node.js, Brotli and Tailscale fixes.
Linha do tempo
-
Help Net Security weekly roundup: Binance $6.3B theft, Brotli CVE-2026-111497, Volt Typhoon, Oracle EBS exploitation, Gheist campaign
ler a análise desta fonte ocultar
This Help Net Security weekly roundup (week ending November 1, 2026) summarizes dozens of unrelated stories. The headline items are a reported $6.3 billion cryptocurrency theft from Binance, described as possibly the largest crypto heist on record, and the impact of the Brotli out-of-bounds write flaw CVE-2026-111497 (Node2Shell / Broccoli2Shell / Brotli2Shell), which reaches well beyond Node.js after Node.js disclosed it on October 21, 2026. The Brotli item is only a short pointer and adds no new technical facts.
Technical Details
- Binance: about $6.3B stolen; the company found no evidence of a wallet private key leak and plans a technical post-mortem.
- Oracle EBS CVE-2026-101767: CVSS 9.8, unauthenticated HTTP flaw in Application Object Library (12.2.3 to 12.2.15); exploitation attempts have begun.
- Volt Typhoon: uses a rotating relay network ("Silent Train") per Lumen's Black Lotus Labs.
- Gheist: Wiz Research recovered over 13,500 planted branches from 850+ compromised GitHub accounts; the tool uses stolen tokens to plant workflows that print repository secrets into logs.
- China-nexus actors: reportedly exploited a VMware ESX zero-day and chained PHP2Shell with the "Fragnesia" Linux kernel bug; Cisco confirmed attackers crashing its firewalls with a newly disclosed flaw.
- Other items: a Microsoft Authenticator Android flaw (Enclave), a poisoned Claude Code extension with an SSH backdoor (Phorion), Yoba malware in fake ChatGPT/Claude GitHub projects (Check Point), fake IT help desk and Teams social engineering (Cisco Talos, Arctic Wolf), Tailscale SSH fixes, and a Huntress report on compromised camera management software.
- Breaches: UNM Health Sciences Center, University of Copenhagen (525,000 people), So-net (2.58 million), AfD (345,000 emails), DHS staff records (41,000), DreamHost.
Remediation
- Update Microsoft Authenticator on Android.
- Apply the Oracle EBS patch for CVE-2026-101767.
- Apply Node.js, Brotli and Tailscale fixes.