Binance brought financial exposure into sharp focus
Binance linked a reported $6.3 billion cryptocurrency theft to a compromised DevOps engineer’s laptop. Other reporting described substantial asset freezes. Analysts linked the theft to suspected North Korean TraderTraitor activity.
PHP2Shell put business-facing systems at risk
PHP2Shell prompted emergency patching across widely used web infrastructure. Later reports documented successful code execution and a government intrusion. Separate Brotli/Node2Shell exploitation reinforced the wider issue: vulnerable components can be embedded across applications, containers and appliances. Remediation depends on knowing where they run.
Supplier access became a route into customer systems
Microsoft attributed the ConnectWise campaign to Storm-0940 and reported attempts against more than 2,250 tenants, with successful access and persistence changes in some environments. A supplier fixing its own service may not remove access already established inside a customer’s systems.
Trusted software put connected secrets within reach
Separate LiteLLM and OVHcloud CLI compromises distributed credential-stealing software targeting developer, cloud and deployment secrets. Replacing a malicious release is only part of recovery: organizations must assess what it could access and revoke exposed credentials.
Certificate trust failures created lasting remediation work
Weak eMudhra intermediate keys prompted browser blocks and a planned exit from the global SSL/TLS business. Applications and devices with independent certificate bundles may need separate updates. Browser protection alone does not establish that every dependent service is safe.
Leadership priorities
- Know the exposure. Assign owners to critical runtimes, privileged endpoints, supplier integrations and embedded trust dependencies.
- Contain the authority. Limit developer and supplier privileges. Test rapid revocation of credentials, application tokens and sessions.
- Prove recovery. Validate removal of persistence and restoration of service; distinguish containment or frozen assets from completed recovery.
Want free, curated threat intelligence briefings tailored to your organisation? Request access to Lampara.