Weekly Signal

Azure's edge falls over, and a record crypto heist

contact@cto.lu (Anouar Adlani) — Mon, 02 Nov 2026 07:00:00 GMT

A bad config took down Azure Front Door for hours. CISA flagged three exploited bugs on dev and VPN infrastructure. The FBI tied a 6.3 billion dollar Binance theft to North Korea. Anthropic filed to go public.

Patch now: GitLab (CVE-2026-97229, CVSS 10.0), Cisco ASA/FTD (CVE-2026-76418), and a three-bug Ivanti Connect Secure chain are all exploited and on CISA's KEV list.
Azure Front Door went down globally on 29 October after an invalid config crashed the data plane. Single-vendor edge is a single point of failure.
The FBI tied a 6.3 billion dollar Binance theft to North Korea, traced to a compromised DevOps laptop and run in about 20 minutes.
Anthropic filed to go public (Nasdaq: ANT) on 16.3 billion dollars of first-half revenue. Mistral open-sourced its 1-trillion-parameter Large 4.
Microsoft offered buyouts to about 60,000 staff, a quarter of its workforce. DoorDash agreed to buy Instacart for about 17 billion dollars.

PHP's emergency patch and a broken certificate authority

contact@cto.lu (Anouar Adlani) — Mon, 26 Oct 2026 07:00:00 GMT

Two unauthenticated RCE flaws hit PHP with exploits already circulating. A certificate authority's signing keys turned out to be small integers. A backdoored LiteLLM package and a Railway breach put secrets at risk, and the EU AI Act got its first binding standard.

Patch PHP now. CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2) are unauthenticated RCE, worst on mod_php, with exploits circulating. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Eight eMudhra intermediate CA keys were cracked, so anyone could forge certificates for any domain. The certs chain to roots trusted by Mozilla, Microsoft, Apple and Chrome.
Supply chain: a backdoored LiteLLM 1.107.0 hit PyPI and a Railway breach exposed customer environment variables. Rotate credentials on affected hosts.
A New Mexico court ordered Meta to pay 25 billion dollars in the Cambridge Analytica case. Meta will appeal.
The EU AI Act got its first harmonised standard (EN 18286:2026), giving high-risk AI providers a concrete path to presumption of conformity.

The largest Patch Tuesday ever, and fridges set on fire

contact@cto.lu (Anouar Adlani) — Mon, 19 Oct 2026 07:00:00 GMT

Microsoft fixed more than 1,400 flaws in one month, including an exploited zero-day. A cyberattack pushed supermarket refrigeration into defrost mode across France. An AI coding tool leaked stored provider API keys, and Anthropic explained why it left Git.

Microsoft's October Patch Tuesday fixed more than 1,400 vulnerabilities, including CVE-2026-96951, a Windows Shell bypass exploited in the wild. Prioritise that and a pre-disclosed .NET bypass.
A cyberattack set refrigeration at up to 700 French supermarkets into defrost mode overnight, with some units reaching high temperatures, fires and water damage. OT controllers are now a physical-damage target.
A breach at the OpenCode Console exposed stored OpenAI, Anthropic and Google API keys for about 1.4 percent of users. Rotate provider keys and stop storing long-lived secrets in SaaS consoles.
Ledger confirmed hardware implants inside wallets sold through an unauthorized reseller, exfiltrating recovery seed phrases over LTE.
Anthropic replaced Git with a purpose-built source-control system after merge volume rose from 2,500 to 30,000 changes a day.

Denmark's population register breached, Uber fined 825 million

contact@cto.lu (Anouar Adlani) — Mon, 12 Oct 2026 07:00:00 GMT

A trusted third party ran millions of queries against Denmark's central population register, exposing most of the country. A Dutch regulator issued one of the largest GDPR fines yet over automated driver deactivation. Cloudflare bought Deno, and a one-click Telegram flaw surfaced.

Attackers abused a company's legitimate access to Denmark's CPR register to run about 14 million searches, exposing data on roughly 8.8 million people. One reported account used the password 123456.
The Dutch DPA fined Uber 824,990,000 euros for unlawful automated decision-making that deactivated driver accounts without adequate information. Uber is appealing.
Cloudflare acquired Deno. Deno Deploy shuts down in six months and paid users are moved to Cloudflare Workers. Plan migrations now.
Patch Telegram Desktop to 7.2.9 or later: CVE-2026-107181 allows one-click account takeover.
Claude Haiku 5.5 dropped the small-model price to 0.10 dollars per million input tokens, about 75 percent cheaper than Haiku 4.5.

Three exploited edge bugs, and an app crash the status page missed

contact@cto.lu (Anouar Adlani) — Mon, 05 Oct 2026 07:00:00 GMT

Apple, Cisco and Fortinet all had actively exploited flaws added to CISA's catalog in one week. A Firebase SDK crashed apps worldwide while the vendor's status page stayed green. Anthropic shipped a stronger mid-tier model at the same price, and a German lab released a sovereign open model.

Three actively exploited flaws hit CISA's KEV list: Apple CoreGraphics (CVE-2026-86950), Cisco Catalyst SD-WAN Manager (CVE-2026-76504, CVSS 9.8) and Fortinet FortiMail (CVE-2026-104286, CVSS 9.8).
A Firebase analytics SDK crashed iOS apps on launch while Google's status dashboards stayed green, because they track server health, not client-side SDK crashes.
Claude Sonnet 5.5 shipped at unchanged pricing (2 and 10 dollars per million tokens) with a large jump on agentic coding benchmarks.
Aleph Alpha released Kolibri, an Apache-2.0 open-weight model built in the EU and positioned for GDPR and AI Act constraints.
Debian shipped an unusually large kernel security update (DSA-6528-1). Schedule the patch and reboot.