Cyberattack wave hits PHP, Node.js, Binance, LiteLLM
Binance reports multibillion-dollar wallet drain while PHP and Node.js vulnerabilities require patching.
40
Vendor
Coinbase
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenSep 22, 2026
- Last mentioned10d ago
Timeline
6 articles · newest firstBinance investigates suspicious transfers of up to $5.8 billion; Tether and Circle freeze stablecoins
No breach is confirmed; the funds' ownership and whether transfers were authorized remain unknown, and stablecoin freezes cannot recover Ether or Bitcoin.
95
x402 SDK flaws could drain agent balances or bypass payments
V12 says three critical issues were fixed on August 18; neither side has reported attacks, and audits still list no advisories.
64
Monetization Gateway beta: charge AI agents for consumption with HTTP 402
Cloudflare opened a closed beta of Monetization Gateway so sites can charge AI agents per request via HTTP 402.
50
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Cloudflareorganization · 3
- Coinbaseorganization · 3
- Health-ISACorganization · 2
- Microsoftorganization · 2
- Cloudflarevendor · 2
- Storm-2992threat actor · 2
- Binancevendor · 2
- EvilTokensmalware · 2
- SpyCloudorganization · 2
- Microsoftvendor · 2
- Railwayorganization · 2
- OpenAIorganization · 2
- x402product · 2
- Shadowserver Foundationorganization · 1
- Linux Foundationorganization · 1
- TRM Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.