[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fptNOXIUjZzAz83LbhUY0kHcj1YZwjHyM4ajMpynxCvU":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b3bfcd65-018c-45f0-9094-69dd65dd34a7","Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability","week-in-review-binance-hit-by-6-3-billion-theft-impact-of-brotli-vulnerability-52aac2","Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r\u002Fopensource bans AI projects, and solo devs go down with them Moderators of r\u002Fopensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for AI.” Moderator Wolvereness announced the rules in a post over the weekend. AI slop is piling up highest on the biggest open-source projects The … More → The post Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability appeared first on Help Net Security.","This week's security news roundup includes Reddit's r\u002Fopensource banning AI projects, a Microsoft Authenticator vulnerability allowing unauthorized access, and a campaign called Gheist that steals GitHub tokens to exfiltrate secrets. Additionally, stolen staff logins are facilitating attacks across K-12 school districts, and CISA has updated its open-source tools for checking cloud security baselines.","Week in review covers r\u002Fopensource AI ban, Microsoft Authenticator flaw, GitHub token theft, and K-12 school breaches.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F01\u002Fweek-in-review-binance-hit-by-6-3-billion-theft-impact-of-brotli-vulnerability\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2023\u002F12\u002F01112502\u002Fcybersecurity_week_in_review1.jpg","2026-11-01T09:00:00+00:00","2026-11-01T10:00:22.377438+00:00",7,[17,20,23,26,28,30],{"name":18,"type":19},"Microsoft Authenticator","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"AI","technology",{"name":27,"type":19},"GitHub",{"name":29,"type":19},"npm",{"name":31,"type":22},"CISA","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56],{"type":57,"value":58,"context":59},"malware","Gheist","Campaign name for stolen GitHub token exploitation",[21,31,18],{"controls":62,"vendors":148},[63,91,119],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,83],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":77,"vendor_name":21,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":92,"name":93,"problem":94,"products":95},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[96,103,111],{"vendor_slug":97,"vendor_name":27,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[149,152,154],{"slug":97,"name":27,"logo_path":98,"roles":150},[151],"affected",{"slug":77,"name":21,"logo_path":78,"roles":153},[151],{"slug":155,"name":156,"logo_path":157,"roles":158},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[159],"reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"stolen-credentials-token-theft-and-authenticator-flaws-expose-organizations-across-sectors","Stolen Credentials, Token Theft, and Authenticator Flaws Expose Organizations Across Sectors","This week's incidents share a common thread: attackers are exploiting weak or compromised authentication mechanisms to gain unauthorized access. The Gheist campaign specifically targeted GitHub tokens to exfiltrate secrets, while stolen staff logins are enabling attacks on K-12 school districts — demonstrating that credential theft remains one of the most effective attack vectors. A vulnerability in Microsoft Authenticator further undermined trust in MFA solutions that many organizations rely on as a last line of defense. These incidents matter because once credentials are compromised, attackers can move laterally, exfiltrate sensitive data, and cause significant damage before detection. Organizations must treat credential hygiene and access governance as continuous operational priorities, not one-time configurations.",[165,166,167,168,169,170,171],"CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":173,"MITRE ATT&CK T1566: Phishing":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"CIS Control 6: Access Control Management":176,"CIS Control 14: Security Awareness and Skills Training":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":179},"Attacks on K-12 school districts via stolen credentials and the broader credential theft campaign underscore NIS2's requirement for incident handling and access control measures to protect essential and important entities.","The Gheist campaign and stolen staff credentials are consistent with phishing-based initial access techniques; understanding this tactic helps defenders prioritize email filtering, awareness training, and credential monitoring controls.","The Microsoft Authenticator vulnerability allowing unauthorized access requires timely patching; SI-2 mandates that organizations identify, report, and remediate software flaws within defined timeframes.","Stolen staff logins and unauthorized Authenticator access both stem from insufficient access controls; CIS Control 6 mandates least-privilege access, MFA enforcement, and regular credential reviews that would have reduced attacker footholds.","K-12 staff credential theft and token exfiltration campaigns succeed partly due to low security literacy; structured awareness training on phishing and credential hygiene directly addresses this gap.","The Microsoft Authenticator flaw represents an unmanaged technical vulnerability in a widely trusted security tool; A.8.8 requires organizations to systematically track and remediate such vulnerabilities before they are exploited.","The Microsoft Authenticator vulnerability and stolen login incidents highlight failures in identity assurance; this framework function requires robust authentication mechanisms and continuous validation of access policies."]