Good morning!

Binance is reeling from a hack it values at roughly $6.3 billion, while researchers showed that answering a stranger's Telegram call was enough to run code. Two trusted devices, and what happens when the trust is misplaced.

Here are the 6 things you don't want to miss:

1. 💰 Binance says hackers made off with about $6.3 billion

Binance said Thursday that a hack caused about $6.3 billion in unauthorised withdrawals, making it the largest known crypto exchange breach. Its checks suggest a compromised engineer's laptop let attackers reach a service container and trigger the withdrawals, with no evidence any wallet private keys leaked. It said about $3 billion was frozen on-chain, with losses covered by its SAFU fund and company money. The company still sounds sure the laptop was the weak link. (Reuters)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 🔒 CISA confirms the GitLab flaw is being exploited

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Thursday, citing evidence of active exploitation. One is CVE-2026-97229, the GitLab CI/CD integer-overflow flaw rated 10.0 that was still just a patch on October 13 — the listing now confirms someone is using it. The other, CVE-2026-76418, is a Cisco ASA and Firepower SSL VPN denial-of-service bug. Being on the KEV list is the part that moves the patch. (CISA)

4. ⚖️ General Motors to pay $220 million over driver data sales

General Motors agreed to pay $220 million to settle allegations, made by a coalition of 36 attorneys general, that it sold drivers' behavior and location data to brokers and insurers without proper consent. According to attorneys general, the OnStar Smart Driver app wrongly told more than 370,000 drivers they were not enrolled while GM was collecting and selling their data. A Texas suit is pending. (Washington Attorney General)

5. 📱 A Telegram voice call could run code on your phone

A flaw in Telegram for Android could let an attacker with an ordinary account run code on a victim's phone once they answer a voice call, NebuSec disclosed Thursday. It affected versions 8.6.2 through 12.10.3, and Telegram fixed it in 12.10.4 in late September, before the report went out. NebuSec reproduced the code execution on ARM64 devices and has seen no evidence of real-world exploitation. The fix shipped before anyone had to ask for it. (The Hacker News)

6. 🏛️ Bankruptcy courts' noticing system is back; BAE says no data taken

BAE Systems restored the federal judiciary's Bankruptcy Noticing Center and told SecurityWeek that no data was extracted and no personal information was breached. The system that sends notices for all federal bankruptcy courts went down around October 9 and resumed service October 26. The follow-up to October 16's coverage: BAE still has not said what caused it or whether it was a cyberattack. (SecurityWeek)

Bonus. Threat Road Tip Of The Day

When an exchange or platform says losses are covered, check what "covered" means before you relax — reserve-style funds draw from a pool whose size and eligibility rules you did not read. Keep a screenshot of your balance and withdrawal settings now, so a claim later is backed by your own record.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.