The GRC Brief · Issue 02 · 31 Oct 2026

4 breaches. 4 broken controls.

October's biggest incidents drawn as attack chains: how they got in, what failed, the damage, and the control that would have stopped it.

Pick a control in each incident to fill the bar.

Binance

Oct 29 · Crypto

~$6.3BBinance's estimate

Tap a step to see what happened.

Entry

Binance's initial investigation suggests a compromised DevOps engineer's laptop gave the attacker access to a service container. Binance says it found no evidence of a wallet private key leak.

Gap

The attacker submitted unauthorised withdrawals. Binance's co-CEO said Ethereum's EIP-7702 account delegation was used to take control of a hot wallet without going through normal approval procedures, and that more points of breach were found.

Impact

Binance estimates the impact at about $6.3B. Analytics firms count roughly $5.9B to $6.43B depending on how assets are valued. About $3B was frozen on-chain, and Binance says it will cover all losses.

Control

Privileged access only from hardened, dedicated admin devices. Signing and approval controls that no single system or credential can bypass. Limits and real-time alerts on hot-wallet outflows.

Binance puts the impact at about $6.3B (analysts count roughly $5.9B to $6.43B). About $3B was frozen. The investigation is ongoing.

GRC lesson

An admin's laptop is part of the privileged path, so protect it like one.

ISO/IEC 27001:2022 A.8.1, A.8.2 · NIST CSF 2.0 PR.AA

Which control would you pick first?

Practise in the PAM lab

PHP2Shell

Oct 20 to 26 · Patch now

Day 0exploited the day fixes shipped

Tap a step to see what happened.

Entry

PHP2Shell is two flaws in PHP itself that let an unauthenticated attacker run code on a server over an ordinary web request. Every PHP install serving web requests is affected until patched.

Gap

PHP released fixes on Oct 21 (8.5.12, 8.4.27, 8.3.36, 8.2.35). PHP 8.1 and older get no official release. CISA notes PHP is often embedded in other software, so teams may not know where it runs.

Impact

watchTowr saw exploitation in the wild from Oct 21. Researchers later confirmed remote code execution against an Apache mod_php server. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on Oct 26.

Control

Inventory every PHP install, including PHP bundled inside other products. Patch internet-facing systems first. Take unsupported versions offline until upgraded. Alert on PHP worker processes launching shells.

Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619). Fixes shipped Oct 21, attacks seen the same day, CISA KEV listing Oct 26.

GRC lesson

You can't patch what you don't know you run. Inventory comes before patching.

ISO/IEC 27001:2022 A.5.9, A.8.8 · NIST CSF 2.0 ID.AM, ID.RA

Which control would you pick first?

Practise in the Incident Response lab

Bitget

Sep 25 · Third-party

$387.5Mstolen

Tap a step to see what happened.

Entry

Investigators SlowMist and Mandiant found the attackers used a zero-day in a third-party security product. The earliest malicious activity in the logs dates to Aug 31.

Gap

A hidden script read a database password from an environment variable. Using an employee's identity on a second product, the attackers moved to the production wallet server.

Impact

A custom tool forged risk-control data so Bitget's normal approval process authorised the withdrawals. About $387.5M left across several blockchains on Sep 25.

Control

Treat security appliances as critical vendors with hardening and patch evidence. Keep secrets in a vault, not environment variables. Segment management tools from wallet systems. Hunt threats to cut dwell time.

Earliest activity traced to Aug 31, nearly four weeks before the theft. No private keys stolen; forged requests passed normal approvals.

GRC lesson

Security tools are suppliers with privileged reach. Tier and segment them like any critical vendor.

ISO/IEC 27001:2022 A.5.19, A.5.17, A.8.22 · NIST CSF 2.0 GV.SC

Which control would you pick first?

Practise in the Vendor Risk lab

ConnectWise Cloud Backup

Oct 13 to 16 · Third-party

162+tenants with unauthorised sign-ins

Tap a step to see what happened.

Entry

An attacker used a compromised vendor-held credential of the ConnectWise Cloud Backup app (formerly SkyKick) to get Microsoft Graph tokens in customer Microsoft 365 tenants.

Gap

The credential sat in the vendor's own tenant and worked in every tenant that had consented to the app. Customers' MFA and password resets didn't help.

Impact

Unauthorised sign-ins were confirmed in at least 162 tenants. In one, a related app gave itself Global Administrator, and new app secrets were added for persistence. Some directory reads may not appear in audit logs.

Control

Review consented third-party apps and their permissions regularly. Give vendor apps least privilege. Alert on new app secrets and self-assigned admin roles. Contract for breach notice and vendor credential rotation.

Unauthorised sign-ins confirmed in at least 162 Microsoft 365 tenants. In one, a related app gave itself Global Administrator.

GRC lesson

A consented third-party app is a supplier holding a key to your tenant.

ISO/IEC 27001:2022 A.5.19, A.5.22, A.8.2 · NIST CSF 2.0 GV.SC, PR.AA

Which control would you pick first?

Practise in the Vendor Risk lab GRC tip of the week

Practise this, free

PAM labVaulting, rotation, just-in-time approvals, session recording Incident Response labA ransomware tabletop: classify, contain, reset, verify backups Vendor Risk labTiering, questionnaires, SOC 2 exceptions and CUECs

Sources

Every fact on this page comes from these reports, checked on 31 Oct 2026. Figures may change as investigations continue.