ICHI Global Five Minute Cyber Rundown
Binance reopened after the record theft and saw billions in net outflows, the Ivanti Connect Secure zero-day chain hits its federal deadline today, and a public Android SMS of Death exploit leaves Android 12 and 13 phones with no fix.
Listen to this episode
MP3, 2.2 MB · · the full transcript is below.
Show notes
ICHI Global Five Minute Cyber Rundown — Monday, November 2, 2026
The weekend's theme is second phases: Binance reopened and customers moved billions out, the Ivanti Connect Secure chain reaches a federal deadline today with a second upgrade required, and a public Android exploit leaves older phones with no fix at all.
Most important development — Binance reopening and outflows (new evidence since the weekly)
Binance restored withdrawals in phases on Sunday, November 1, after a roughly 45-hour suspension following the October 29 theft of about $6.3 billion. In the first 9.5 hours (06:00–15:30 UTC, November 1), Binance says it processed $4.649 billion in withdrawals against $1.01 billion in deposits — a net outflow of about $3.64 billion, about 2.1% of the $171 billion in assets in its October 28 proof-of-reserves snapshot. DefiLlama counted more than $6 billion leaving Binance-linked wallets over 24 hours (about 3.6% of reported assets); CoinDesk notes that measure can include transfers between Binance's own wallets, so the two figures are different measures, not a contradiction. Binance says it had replenished approximately 95% of affected assets by November 1 and that no customer will absorb losses. Its preliminary investigation points to a compromised engineer's laptop giving access to a service container, with no evidence found that private keys leaked — that is the exchange's preliminary account, not a confirmed final finding. The FBI attributed the theft to North Korea (TraderTraitor) on October 31, as covered in the weekly edition.
Ivanti Connect Secure chain — federal deadline today, November 2
Today is the CISA KEV deadline for CVE-2026-111357 (CVSS 8.8, missing authentication for a critical function / privilege escalation). Ivanti shipped fixes on October 29 for CVE-2026-111357 and CVE-2026-118527 (CVSS 4.3, predictable identifiers / file upload; KEV due November 13), completing the chain with the October 13 authentication bypass CVE-2026-104935. Volexity attributes exploitation since at least October 1–3 to previously unknown actor UTA0576, who chained all three for unauthenticated root code execution on a fully patched appliance, deployed no malware or web shell, re-exploited the device per command, worked in memory only, and tampered with logs — so Ivanti's Integrity Checker Tool reported no modifications and CISA warns it may miss this activity. Post-exploitation targeted credentials and Active Directory: LDAP queries for LAPS passwords and BitLocker recovery keys from the appliance's service account. Fixed builds: 25.1.1.3 and 22.8R2.6 — the October 13 builds (25.1.1.2 / 22.8R2.5) are NOT sufficient. Shadowserver tracks over 5,000 internet-exposed ICS instances, with no public count of how many are secured. Ivanti says exploitation affected a limited number of customers.
Android "SMS of Death" — CVE-2026-58882, public exploit, no fix for Android 12/13
Researcher Mark Blaszczyk (reported as Mark Blah in some coverage) published a working proof-of-concept for a zero-click remote denial-of-service flaw in Android's WAP Push handling (WapPushOverSms.decodeWapPdu): a malformed 8-byte WAP Push data SMS to port 2948 turns a header-length value into -2147483648, the negative allocation throws NegativeArraySizeException, and the com.android.phone process crashes — dropping calls, including emergency calls, and cutting cellular service. Messages are processed before reaching the inbox and are invisible to the user; carrier redelivery and stored-message reprocessing can repeat the crash, and about 20 messages pushed test phones into reboot loops (one Android 12 device rebooted into recovery roughly every 90 seconds and required a factory reset; an ADB removal method has been published). Google's fix ("Fix remote DoS in decodeWapPdu") shipped in the October 2026 security updates for Android 14–17; the flaw is not listed in Google's October bulletin. Android 12 and 13 received no fix and none has been released. This is denial of service only on published evidence — no data access is claimed.
Defensive implications
- Ivanti: upgrade to 25.1.1.3 / 22.8R2.6 today; treat a clean Integrity Checker result as inconclusive; hunt back to at least October 1 for welcome.cgi / X-DSCGI-PATH anomalies, log gaps, and unusual LDAP queries for LAPS/BitLocker data; rotate the appliance AD service account and any credentials it could reach.
- Android: install the October 2026 update or later on Android 14–17 devices (availability varies by maker/carrier); plan replacement for Android 12/13 devices, which have no patch path.
- Binance watchers: await Binance's promised updated proof of reserves and detailed post-mortem before treating recovery as complete; exchanges and DeFi services should continue blocking the FBI-published TraderTraitor wallet addresses.
Note: No ICHI index score is quoted in this episode — no verified published score was checked at production time. Model C scoring refinements remain under development and are not announced here.
Transcript
Akari: The daily cyber rundown, brought to you by ICHI.global. I'm Akari, and this is Monday, November second, twenty twenty-six. The weekend did not slow the threat picture down. An edge appliance flaw reaches its federal deadline today, the largest crypto theft on record moved into its costly second phase, and a public exploit can now crash an Android phone with a text the owner never sees.
Akari: The most important development is what happened after Binance reopened. The exchange restored withdrawals in phases on Sunday, November first, after a roughly forty-five hour suspension that followed the October twenty-ninth theft of about six point three billion dollars. In the first nine and a half hours, Binance says it processed four point six four nine billion dollars in withdrawals against one point zero one billion dollars in deposits, a net outflow of about three point six four billion dollars. One tracker, DefiLlama, counted more than six billion dollars leaving Binance linked wallets over twenty-four hours, and it notes that figure can include transfers between the exchange's own wallets, so treat the two numbers as different measures, not a contradiction. Binance says it had replenished about ninety-five percent of the affected assets by November first, and that no customer will absorb the losses. Its preliminary investigation points to a compromised engineer's laptop giving access to a service container. That is the exchange's account, not a confirmed final finding, and investigators say they have not found evidence that private keys leaked.
Akari: Now to the deadline in front of defenders today. Today, November second, is the federal deadline for one part of the Ivanti Connect Secure zero-day chain, C V E twenty twenty-six, one hundred eleven thousand, three hundred fifty-seven, rated eight point eight. Ivanti shipped fixes on October twenty-ninth for that flaw and for C V E twenty twenty-six, one hundred eighteen thousand, five hundred twenty-seven, which is due November thirteenth. Chained with an earlier authentication bypass, they gave an actor tracked as U T A zero five seven six unauthenticated root access, even on an appliance that was fully patched at the time. If you patched on October thirteenth and stopped there, you are not done. The fixed builds are twenty-five point one point one point three, and twenty-two point eight R two point six. More than five thousand internet exposed instances are still tracked by Shadowserver, with no public count of how many are secured. And a clean integrity check proves nothing here. The actor worked in memory, deployed no web shell, and tampered with logs, so hunt back to at least October first.
Akari: The other fresh flaw is on phones. A researcher has published a working exploit for the Android flaw nicknamed S M S of Death, C V E twenty twenty-six, fifty-eight thousand, eight hundred eighty-two. A tiny malformed W A P Push message, processed before it ever reaches the inbox, crashes the process that runs cellular functions. Calls drop, including emergency calls, and about twenty messages can push a phone into a reboot loop. Google fixed Android fourteen through seventeen in the October security updates. Android twelve and thirteen received no fix, and no fix for them has been released. This is a denial of service flaw. It crashes phones. It does not, on the evidence published, give an attacker access to the data on them.
Akari: So here is what to do. Ivanti owners, upgrade again today, then hunt. Look for unusual queries for L A P S passwords and BitLocker keys from the appliance's service account, and rotate credentials that account could reach. Android owners, install the October update or later if your phone runs Android fourteen or newer, and start planning replacements for phones still on twelve or thirteen. And for everyone watching Binance, wait for its promised updated proof of reserves and post-mortem before treating the recovery as complete.
Akari: That is the takeaway for Monday. The patch you applied may not be the patch that closes the chain, and the money moving after a breach tells its own story. For the underlying evidence behind today's stories, visit ICHI.global. I'm Akari, and I'll be back tomorrow with the next daily rundown.
Sources
- CoinDesk — Binance sees $6.1 billion leave after hack, but most of its crypto remains on the exchange www.coindesk.com
- The Business Standard (BBC/Reuters reporting) — Binance faces $3.64b net outflows after record $6.3b cyber heist www.tbsnews.net
- BleepingComputer — Ivanti patches two more Connect Secure zero-days chained in attacks www.bleepingcomputer.com
- SecurityWeek — Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain www.securityweek.com
- SOCRadar — Ivanti Connect Secure Zero-Day Chain Enables Root Access socradar.io
- gHacks — Android SMS of Death Exploit Goes Public, Leaving Android 12 and 13 Phones Without a Fix www.ghacks.net
- Tech Advisor — SMS of Death Exploits Android Vulnerability to Crash Victim's Phone www.techadvisor.com
Get ICHI Daily and ICHI Weekly by email
- ICHI Daily: one email on weekdays, after each new daily episode is published (no episode, no email).
- ICHI Weekly: one email on Sundays after 9 p.m. US Eastern time, once the new edition is published. If you choose both the weekly podcast and the written brief, they arrive together in that one email.
No new episode, no email. Every email links to the episode on ICHI; audio is never attached.
All ICHI Daily episodes · ICHI Briefs & Podcasts
ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.
ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology