PHP2Shell flaws and a $6.3 billion Binance theft dominate the week

1. PHP2Shell flaws force emergency patching

Two critical flaws in PHP, known as PHP2Shell, dominated security coverage this week. PHP is said to run on about 70% of web-facing servers. CISA now confirms that the flaws are under active attack. Website owners were told to patch immediately or take their sites offline, and government sites across Europe went dark on 21 October as operators rushed to patch. Researchers at Dream said suspected Chinese attackers chained a custom exploit called PHP2Shell with a Linux kernel privilege-escalation flaw to gain root control of 25 servers. A UK-based penetration tester, Jaydip Modhwadia, won a $2,000 Bitcoin prize for achieving remote code execution against a live website. Separately, Microsoft released an emergency update for .NET to fix a critical Brotli buffer-overflow flaw nicknamed HTTP2Shell, and Node.js, Google and the Python packaging ecosystem also issued fixes. The Register ran an opinion column arguing that the episode shows vulnerability disclosure must change. Some organizations took sites offline until fixes were ready.

Read the stories: Security brief: 5 vulnerabilities to know today; Security brief: 3 vulnerabilities to know today; Security brief: 4 vulnerabilities to know today

2. Binance reports a theft of about $6.3 billion

Binance, the world's largest cryptocurrency exchange, said a security incident on Thursday cost about $6.3 billion. Onchain data had first shown suspicious outflows of $5.8 billion from its hot wallets, and the exchange paused deposits and withdrawals. Binance pledged to cover all customer losses from its SAFU emergency fund and company money. TRM Labs attributed the theft to TraderTraitor, a North Korean hacking unit. Binance said a follow-up investigation found more points of breach beyond a compromised engineer's laptop, which it had earlier named as a likely way in. If the figure holds, it would be the largest crypto theft on record, roughly four times the $1.5 billion Bybit theft of February 2025, which the FBI also attributed to TraderTraitor. The scale matters because Binance is the largest exchange by trading volume and the loss would exceed any previous crypto theft. Polymarket, a prediction-market platform, also briefly halted trading on 29 October after users reported unauthorized withdrawals.

Read the stories: Binance to Cover All Losses from ~$6.3B Hack, Possibly Largest Crypto Theft; TRM Labs Links ~$6.36B Binance Hack to North Korea-Based TraderTraitor; Binance Probes Security Issue as $5.8B in Suspicious Outflows Prompts Tether,

3. OpenAI claims its models refuted a major computing hypothesis

OpenAI released solutions to three long-standing math problems that it says its AI models produced. They are a proof of the local smoothing conjecture in every dimension, a disproof of the Exponential Time Hypothesis, and a proof that certain four-dimensional quantum field theories, including Quantum Chromodynamics, exist mathematically. The Exponential Time Hypothesis holds that the Boolean satisfiability problem cannot be solved much faster than by trying possibilities in the worst case. It was first published in 1999 by UC San Diego computer scientists Russell Impagliazzo and Ramamohan Paturi. It underpins hundreds of papers in graph theory, computational biology and databases, and has been built into many scientific papers over the past decade. The refutation was described as a surprise. The results are claims made by OpenAI, and it is not yet known whether outside mathematicians have confirmed them. Separately, OpenAI said it has greatly expanded the system it uses to watch its most capable models for misaligned behavior.

Read the stories: Frontier AI Labs Claim Their Models Refuted the Exponential Time Hypothesis; Working with academic communities to build scientific understanding; How We Detect Frontier AI Model Misalignment

What to watch next week

The Federal Election Commission took its electronic filing system offline after what it called an attempt by a bad actor to breach its systems, a week before the 3 November midterm elections. It is not yet known when filing will resume. Binance has not said how its investigation will conclude, and the attribution by TRM Labs to TraderTraitor is not yet confirmed. Senators Ron Wyden and Adam Schiff say a secret court ruling is being withheld while officials press Congress to renew Section 702.

Methodology and sources

• Oesnada