Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability

This week's roundup covers Binance's disclosure of a roughly $6.3 billion cryptocurrency theft, potentially the largest crypto heist ever recorded, with the exchange saying it found no evidence of leaked private keys and promising a full post-mortem. Another major story details CVE-2026-111497, a remotely exploitable out-of-bounds write bug in Google's Brotli compression library—nicknamed Node2Shell/Broccoli2Shell/Brotli2Shell—that affects far more software than just Node.js, where it was first disclosed on October 21, 2026. Also featured: active exploitation of patched Oracle E-Business Suite flaw CVE-2026-101767 (CVSS 9.8), a Microsoft Authenticator Android vulnerability enabling silent work-account takeover, Tailscale SSH fixes against lateral movement, and Chinese state actors Volt Typhoon and others abusing a VMware ESX zero-day alongside PHP2Shell and Fragnesia exploits. The digest rounds out with breaches at Sony's So-net, the University of Copenhagen, and Germany's AfD party, plus broader coverage of AI security governance, supply-chain risks, and new open-source security tooling.