Skip to content

Digest · week 44 · October 26 – November 1, 2026

An admin's laptop, the kernel and certificates

Three events of the week and what they mean for infrastructure.

1. Binance: $6.3B via a DevOps engineer's laptop

On October 29, about $6.3 billion was drained from Binance hot wallets on ten blockchains in 20 minutes — the largest theft in crypto history (the previous record was Bybit, about $1.5 billion in 2025). According to Binance's preliminary findings, the attack began with the compromise of a DevOps engineer's laptop: through it the attacker reached a service container and sent unauthorized withdrawal transactions. TRM Labs attributes the attack to the North Korean group TraderTraitor. Almost $3 billion has been frozen, and Binance promises to cover the losses.

What this means for infrastructure. It wasn't the cryptography or the perimeter that got broken, but the workstation of a person with production access — just like with Bybit. The administrator's laptop is now the main target, and it has to be protected like a server: a hardware key instead of a password and TOTP, short-lived tokens instead of long-lived keys, production access through a bastion with session recording, and any action that moves money or data only with a second person's approval.

2. CVE-2026-98432: remote root via the Linux TCP stack

A use-after-free in the IPv4 TCP code, affecting kernels from 4.4 onward. An unauthenticated network attacker can gain root. CVSS is 9.8 per the kernel developers and Ubuntu, 8.1 per Red Hat, Oracle and SUSE. Debian, Oracle Linux, SUSE and Amazon Linux 2023 have already shipped fixes; Ubuntu 22.04–26.10 and RHEL 8–10 had no fixed kernel as of October 29. No exploitation in the wild. According to Anthropic, the exploit was built by their unreleased Claude model — remote root in about 50 minutes.

What this means for infrastructure. The window between a vulnerability's disclosure and a working exploit is shrinking: models find and exploit bugs faster than humans, and this is available to both sides. The winner is whoever treats kernel updates as routine rather than a project: an inventory of hosts with kernel versions, pre-agreed reboot windows, livepatch where a reboot is expensive. Until a fix is available, firewall off everything that doesn't need internet access (pro fix CVE-2026-98432 --dry-run on Ubuntu shows what is affected). Disabling MPTCP narrows the attack surface but does not protect you: the bug is in the shared IPv4 TCP code.

3. eMudhra exits the TLS market

On October 17, a researcher reported weak keys in eight eMudhra intermediate CAs — with those keys one could issue a certificate for any domain. Chrome, Firefox and Apple blocked these CAs, on October 27 Chrome stopped trusting the emSign ECC Root CA – G3 root, and the company is leaving the global TLS market. No forged certificates from these CAs were found in Certificate Transparency logs.

What this means for infrastructure. Trust in a certificate is decided by browsers and operating systems, and decided within hours. A certificate can become invalid through no fault of yours: the same week GoDaddy mass-revoked about 404 thousand certificates over non-compliance with its own policy. The conclusion is the same — reissuance must be automatic, via ACME, with a backup CA: since March 2026 a certificate lives no longer than 200 days anyway. And a separate trap on the Mac: curl, git and openssl verify certificates against /etc/ssl/cert.pem and don't see Apple's block — until macOS is updated, Apple advises removing emSign ECC Root CA – G3 from that file manually.

Sources