DEV Community: Abdullah Balouch

8 Tips For Google Colab Notebooks To Take Advantage Of Their Free-of-charge 12GB-RAM GPU.

Abdullah Balouch — Sat, 31 Oct 2026 14:27:51 +0000

David Ibáñez

Apr 12 '19

8 Tips For Google Colab Notebooks To Take Advantage Of Their Free-of-charge 12GB-RAM GPU.

#machinelearning #beginners #yolo #darknet

6 min read

Darknet Educational Forum Update

Abdullah Balouch — Sat, 31 Oct 2026 14:25:33 +0000

THE CIA

The CIA’s onion site allows users to securely report threats or suspicious activity, especially in regions where online surveillance is common. Its presence on the dark web also supports intelligence gathering and helps track cybercriminal activity.

Hidden WIKI

The Hidden Wiki is a longstanding directory of dark web sites and a common starting point for navigating onion services. Note that some Hidden Wiki links lead to unsafe content — be careful what you click and steer clear of scams and illegal activity.

ProPublica

hackthepalnte.co.uk

Muse Free Tokens

Abdullah Balouch — Sat, 31 Oct 2026 14:16:13 +0000

⚡️ Top up your Muse quota — up to 30B per account!

Join via my link and claim 1B Muse tokens FREE:

👉 https://t.me/DreamXMuseServerBot?start=ref_cmvu3y3ri01ckkxz7sc09qyft

How to use:

Open the link & hit Start
Join the 2 channels
Tap 🎁 Muse Free Token & send your Muse invite code
Tokens land in your account automatically

🎁 Invite your friends too — earn +1B for your first friend and +1B for every friend after that, up to 30B free!

Binance Hacked, Biggest Attack in the History

Abdullah Balouch — Fri, 30 Oct 2026 16:26:36 +0000

On the evening of October 29, 2026, billions of dollars in cryptocurrency began flowing out of wallets linked to Binance — the world's largest crypto exchange — into newly created addresses. On-chain trackers watched it happen in real time. By the next morning, estimates put the outflow at up to $5.8 billion. If confirmed stolen, that would make this the largest cryptocurrency heist in history, by a wide margin.

Binance says it is investigating a potential security issue and insists user funds are safe. Its founder, Changpeng Zhao, said on X that the incident "does look like a hack on Binance". The attack vector is unknown, the final total is unconfirmed, and the story is still developing. Here is what the on-chain evidence shows so far — and what is still rumor.

The short version
Up to ~$5.6–5.8 billion in crypto moved from Binance-linked hot wallets on October 29, per on-chain tracker estimates — not a confirmed stolen total
Tracker-estimated breakdown: ~$1.57B USDT, ~$1.45B BTC (18,270 BTC), ~$875M ETH, ~$823M USDC, ~$234M TRX, plus hundreds of millions in other tokens
$2.54 billion frozen so far: Tether froze $1.567B in USDT, Circle froze $800M+ in USDC (Binance-verified total)
Binance: investigating, user funds "completely safe", deposits and withdrawals suspended, full post-mortem promised
Would dwarf the previous record: the $1.5B Bybit hack of February 2025
How the money moved
The first alarm came from blockchain watchers tracking a Binance hot wallet labeled "Binance 14". According to transaction analysis shared by crypto journalist StarPlatinum, that wallet sent roughly $2.53 billion across 64 different tokens to a single new Ethereum address in one transaction — and 24 seconds later, a second Binance wallet sent another $174.4 million to the same address. A later update traced a third transfer of 780 million USDC, bringing the reported running total to about $3.48 billion from those wallets alone.

Blockchain intelligence platform Arkham Intelligence is tracking 55 addresses under the label "binance-hacker-1029", with combined holdings of roughly $5.78 billion. Etherscan has labeled the initial receiving address "Binance Hot Wallet Exploiter", tagging it as both an exploit and a heist address. Treat the distinction carefully: Arkham's figure is the value sitting in tracked wallets, not a confirmed amount stolen from Binance.

The freeze that slowed it down
What happened next is the part the industry got right. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT connected to the incident. Circle CEO Jeremy Allaire confirmed more than $800 million in USDC frozen, adding that Circle is coordinating with law enforcement. Binance later clarified that the verified total frozen stands at $2.54 billion — and said the figure may keep rising.

Freezes only work on assets still sitting in freezable stablecoins. On-chain posts report that before the freezes took effect, the exploiter used about $60 million in stolen USDT as collateral on Aave V3 to borrow roughly 19,800 ETH — assets that move beyond any issuer's freeze button. That detail is unconfirmed, but it illustrates the race every exchange heist becomes: convert to unfreezable assets before the issuers react.

What Binance and CZ actually said
Binance's public line has been consistent: its teams are aware of reports of a potential security issue and are actively investigating; user funds are completely safe; updates will come through official Binance channels once information is verified. The exchange also warned customers to beware of scams and to avoid unofficial links, messages, or requests for account information — standard advice that matters enormously during a heist, when phishing spikes.

Changpeng Zhao — Binance's founder, who no longer runs the company — was blunter on X: "It does look like a hack on Binance", thanking Tether and Circle for the quick freezes. He added that user funds are safe and that as a shareholder he expects all user funds to be fully compensated. Deposits and withdrawals were suspended while security checks run, and Binance has promised a full post-mortem.

What we still don't know
The honest list is long. Nobody has confirmed how the attacker got in — the attack vector is unknown. The totals are tracker estimates; investigators are still separating unauthorized transfers from internal movements and overlapping transactions. Early on-chain reports describe the triggering address being funded through the Tornado Cash mixer and linked to the Binance 14 wallet via EIP-7702 shortly before the drain — interesting leads, not conclusions.

There is also a confusing detail worth knowing: Binance had announced scheduled maintenance of its Ethereum wallets for October 28, the day before the drain. That is why the first giant transfers were not immediately treated as a heist — an internal reserve reshuffle was plausible until the pattern kept going. Confusion like that is exactly what buys an attacker time.

The market felt it instantly
Crypto markets do not wait for post-mortems. Bitcoin dropped about $2,000, falling below $79,000. Roughly $600 million in leveraged long positions were liquidated. About $80 billion vanished from the total crypto market capitalization in 15 minutes. BNB, Binance's own token, fell around 4.4% to roughly $712. Some of that has already bounced — but volatility will likely persist until withdrawals reopen and the post-mortem lands.

What to do right now
Don't move funds on rumors. Panic withdrawals during an incident are how people fall for fake "migration" and "verification" scams.
Use only official Binance channels. The exchange explicitly warned about unofficial links and messages asking for account information.
Expect phishing to spike. Every major exchange incident triggers waves of fake support emails, SMS messages and lookalike sites. Verify senders independently.
Check your own account security. Withdrawal allowlists, authenticator-based 2FA, and unique passwords are the basics that matter most this week.
Treat every figure as provisional. Tracker estimates, frozen totals and "largest ever" claims will all move as investigators finish tracing funds across chains.
Where things stand
If the highest estimates are confirmed as stolen, this becomes the largest cryptocurrency hack on record — nearly four times the $1.5 billion Bybit theft attributed to North Korean hackers in February 2025. The Wall Street Journal notes Binance maintains its SAFU emergency insurance fund, reported at roughly $1.2 billion, and CZ has said he expects users to be made whole.

For now, the verified facts are: billions moved, $2.54 billion frozen, an investigation open, and an attack vector nobody has named. Everything else — the final total, the method, the attribution — is still being traced on-chain. This is a developing story; check Binance's official announcement page and verified security outlets before treating any new figure as fact.

Key takeaways
On-chain trackers estimate up to $5.8B moved from Binance-linked hot wallets on October 29, 2026 — estimates, not a confirmed stolen total.
$2.54B frozen so far (Tether $1.567B USDT, Circle $800M+ USDC) — the fastest coordinated freeze response in crypto history.
Binance is investigating; CZ says it looks like a hack and expects users fully compensated; deposits and withdrawals suspended pending security checks.
Attack vector unknown; early on-chain leads (mixer funding, EIP-7702) are unconfirmed; scheduled October 28 wallet maintenance initially masked the drain.
Markets reacted instantly: BTC below $79K, ~$600M liquidations, ~$80B in market cap erased in 15 minutes, BNB down ~4.4%.
If confirmed, this is the largest crypto heist ever — nearly four times the $1.5B Bybit record from February 2025.
Sources and scope
Figures in this article follow on-chain tracker estimates reported by BleepingComputer, Arkham Intelligence, The Wall Street Journal, Reuters and Finbold on October 29–30, 2026. All totals are tracker estimates: Arkham's ~$5.78B is the value held across labeled wallets, not a confirmed stolen amount, and Binance has not confirmed the total or the attack vector. Freeze figures ($2.54B total, $1.567B USDT by Tether, $800M+ USDC by Circle) are as stated by the companies and Binance. CZ's statements are from his public X posts of October 29, 2026. This is a developing story and figures may be revised.

Binance Hack 2026: Up to $5.8B Drained From Hot Wallets — Largest Crypto Heist in History — Hack The Planet

Binance is investigating a suspected breach after on-chain trackers linked up to $5.8B in crypto moving from its hot wallets on Oct 29, 2026. Tether and Circle froze $2.54B. What is confirmed, what is still rumor, and what to do now.

hackthepalnte.co.uk

MUSE TOKEN UPDATED CODE

Abdullah Balouch — Fri, 30 Oct 2026 15:21:13 +0000

Take a look at Muse – your personal AI agent. Redeem my code in Settings within 48 hours of joining and we'll both get 1 billion Muse tokens.

Code: T8H5PO
https://muse.ai/join

PHP2Shell: Two Critical PHP Flaws Leave Millions of Servers Exposed

Abdullah Balouch — Thu, 22 Oct 2026 05:50:56 +0000

"Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 — allow unauthenticated remote code execution on millions of servers. Governments took national services offline, Cloudflare saw early attacks, and updating WordPress does not fix it. What happened, who is exposed, and what to do right now."

PHP quietly powers the back end of most of the web. W3Techs measures it on 69.3% of all websites whose server-side language can be identified. WordPress alone runs close to 40% of the web, and it sits on PHP — so do Magento, Drupal, Joomla, phpBB, WHMCS and MediaWiki. When a flaw turns up inside PHP itself, the blast radius is not one app. It is the foundation under millions of sites at once.

That is what happened this week. On Tuesday, October 20, word began spreading that two unpatched PHP vulnerabilities were about to be disclosed. Screenshots circulated, including one showing an exploit tool named PHP2Shell. Researchers at watchTowr examined the leaked material and confirmed the bugs were real and led to remote code execution. PHP had planned an orderly, scheduled fix. The leak forced an emergency release instead — shipped on Wednesday afternoon, slightly ahead of the planned 14:00 UTC slot.

The short version

CVE-2026-109618 and CVE-2026-109619 — both rated CVSS 9.2 (Critical)
Unauthenticated remote code execution: no password, no account, no user interaction
One scan flagged more than 22.6 million internet-facing PHP instances as potentially exposed
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — anything below is vulnerable
Flaw one: turning PHP's own safety valve against it
The first bug, CVE-2026-109618, lives in how PHP reacts when a request runs out of memory. Normally, hitting the memory limit triggers a controlled shutdown of that request. The problem is timing: parts of the request's memory can be reached before they are fully initialised, and if an allocation fails in exactly that window, the emergency exit path skips proper accounting. Cleanup then runs over data that was never valid — and a crafted request can steer that confusion into executing the attacker's code.

Forcing that out-of-memory moment turns out to be easy. PHP processes multipart/form-data request bodies — the format browsers use for file uploads — before any application code runs. A request that never declares a usable content length can slip past the post_max_size limit, and empty file fields do not count against the max_file_uploads cap even though PHP still builds internal records for each one. Stack enough of them together and memory runs dry on demand, at the precise spot where the bug sits.

Flaw two: a use-after-free in worker memory
The second bug, CVE-2026-109619, is a different failure with the same destination. A PHP worker process keeps state in memory between requests — error data, session data and similar. That state is supposed to be wiped before the memory is reused. A fatal error, including one triggered by the out-of-memory trick above, can skip the wipe. PHP then frees memory the worker still points to, and the next request to land on that worker reads a dangling pointer. With a carefully shaped heap, that use-after-free also ends in code execution with the web server's privileges.

PHP's own analysis proved the first bug end-to-end over HTTP on Apache with mod_php on default settings. PHP-FPM — the setup most managed hosts run — is considered susceptible to the first flaw, and for the second flaw the session route reached working code execution on both mod_php and FPM. There is no "safe" setup here. Both need the patch.

PHP2Shell infographic: two critical PHP flaws, CVSS 9.2, 22.6 million servers exposed
Why governments switched their own websites off

The clearest signal of how serious this was came from the Netherlands. DigiD, the national login service, put up a "temporarily unavailable" page. MijnOverheid went down with it, as did the websites of the Dutch parliament and the NCSC — the very agency responsible for warning the public. Finland's agencies pulled sites offline as a precaution, and in Germany, Freiburg University took its central websites, intranet, learning platform and student webmail offline at 10:39 on Wednesday morning.

None of these were confirmed break-ins. They were calculated decisions: better unreachable for a day than running a PHP build an unauthenticated stranger could take over. Security agencies across Europe, Australia, Japan and the UK issued the same advice — patch immediately, or take the application off the public internet until you can.

Updating WordPress does not fix this

This is the part that catches site owners out. The bug is not in WordPress, your theme or your plugins, so updating them changes nothing. The vulnerable code is in the PHP interpreter on the server underneath everything. The only question that matters is which PHP version your host runs, and whether they have updated it. If you are on shared hosting, the fix is entirely in your provider's hands — contact them today and ask directly whether they have applied the October 21 PHP security release.

Patched versions — check yours against this list
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Anything lower is exposed. PHP 8.1 and older no longer receive updates from the PHP project — one scan on October 20 counted roughly 884,000 internet-facing servers still on those branches. Minimal backports exist for 7.4, 8.0 and 8.1 for people who compile PHP from source, but if you are on an end-of-life branch, treat this as your sign to migrate. Note that PHP 8.2 itself reaches end of life on December 31, 2026.

What to do right now

Check the version your site actually runs. php -v shows the command-line build, which is not always the one serving your website. Check the web-facing one with a phpinfo page or php-fpm8.3 -v.
Update PHP to one of the patched releases above — or confirm your host already has.
Restart the service. Workers that are already running keep the old code in memory. Restart PHP-FPM or Apache after updating.
Do not trust the version number alone. Linux distributions often backport security fixes into packages that keep an older version string. Check the package changelog for the CVE numbers instead — apt changelog php8.3-cli on Debian/Ubuntu, rpm -q --changelog php on Red Hat systems.
Skip the config workarounds. Tweaks circulating online, such as disabling session upload progress, block only one attack path. They do not make an unpatched server safe. Only the patch closes the hole.
Where things stand
Cloudflare reported early attack attempts against PHP sites on Wednesday morning and pushed out firewall rules to blunt them; hosting companies reported the same pattern. As of October 21, however, there was no confirmed break-in attributed to these flaws — the Dutch NCSC said it had seen no active abuse, and neither CVE had yet appeared on the US government's known-exploited-vulnerabilities list. What is public is proof-of-concept code, and after a leak like this, mass scanning typically begins within hours.

So the window is now. If you run anything on PHP — a blog, a shop, a forum, a company site — the only thing that matters is whether your server was patched before someone came looking. Check your version today.

Read all the details here

PHP2Shell: Two Critical PHP Flaws Leave Millions of Servers Exposed — Hack The Planet

Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 — allow unauthenticated remote code execution on millions of servers. Governments took national services offline, Cloudflare saw early attacks, and updating WordPress does not fix it. What happened, who is exposed, and what to do right now.

hackthepalnte.co.uk

Dark Forums: Mining Database Dumps for Early Breach Warning

Abdullah Balouch — Wed, 21 Oct 2026 21:50:02 +0000

Dark Forums: Mining Database Dumps for Early Breach Warning

Between a data breach and the moment a victim learns about it, stolen information typically moves through clandestine marketplaces. Dark forums serve as the primary trading floors where database dumps, infostealer logs, and combolists change hands daily—often long before public disclosure occurs.

For defenders, this lag time represents a critical window of opportunity. If your domain appears in a listing today, you can proactively secure your perimeter before the inevitable wave of credential stuffing begins. Here is how to operationalize an early-warning system based on dark web intelligence.

What Dark Forums Tell Defenders

Dark forums function as clearinghouses for database dumps, logs from infostealers (such as RedLine, Lumma, and Raccoon), and large-scale combination lists. When your company's domain surfaces in a fresh dump or a stealer-log feed, it acts as an immediate signal that your organization's credentials are compromised and likely being prepared for unauthorized access to VPNs, email, and SaaS platforms.

For more Details visit\

Dark Forums: Mining Database Dumps for Early Breach Warning — Hack The Planet

Dark Forums trades in stealer logs, combolists, and database dumps. Monitored responsibly, it gives defenders early warning that corporate credentials are circulating.

hackthepalnte.co.uk

What Are CVEs? The Universal Name for Every Vulnerability

Abdullah Balouch — Wed, 21 Oct 2026 19:49:55 +0000

Originally published on Hack The Planet: https://hackthepalnte.co.uk/blog/what-are-cves.html

CVE-2021-44228. CVE-2023-23397. These codes appear in every breach headline — but what exactly is a CVE, who assigns it, and how do professionals use the system to decide what to patch first? A complete beginner-friendly guide.

A Universal Name for Every Vulnerability

Imagine every security flaw being described differently by every vendor, researcher, and news site: "the Exchange bug", "that Outlook thing", "the printer vulnerability". Coordinating a global response would be chaos. The CVE system exists to end that chaos.

CVE stands for Common Vulnerabilities and Exposures. A CVE is a unique identifier — a standardized name tag — assigned to a publicly known security vulnerability. When a professional anywhere in the world says "CVE-2021-44228", everyone can look up the exact same flaw (in that case, the Log4Shell vulnerability in Apache Log4j), in the same public records, with no ambiguity.

The program is overseen by the MITRE Corporation, sponsored by the U.S. Department of Homeland Security, and operated through a federation of CVE Numbering Authorities (CNAs) — vendors and research organizations (Microsoft, Google, Apple, and hundreds more) authorized to assign IDs for flaws in their own products or research.

Anatomy of a CVE ID

Every identifier follows the same format:

CVE - YYYY - NNNN
 |      |      |
 |      |      Sequence number (at least 4 digits, assigned in order)
 |      The year the ID was assigned (not necessarily the year of disclosure)
 "CVE" prefix

Real examples you have probably seen in headlines:

CVE-2021-44228 — Log4Shell: remote code execution in Apache Log4j, arguably the most severe flaw of its decade.
CVE-2017-0144 — EternalBlue: the SMBv1 flaw behind WannaCry and NotPetya.
CVE-2023-23397 — a Microsoft Outlook flaw that leaked password hashes when a malicious email was merely received.
CVE-2014-0160 — Heartbleed: the OpenSSL bug that exposed memory (and private keys) of much of the internet.

Notice that old, famous CVEs are still referenced constantly — the ID becomes the flaw's permanent name in reports, patches, and exploit databases.

CVSS: Scoring How Bad a Flaw Is

An ID tells you which flaw; the CVSS score (Common Vulnerability Scoring System) tells you how dangerous it is, on a 0.0–10.0 scale. Scores are computed from factors like: can it be exploited over the network or only locally? Does it need user interaction or valid credentials? What happens on success — full system compromise, data leak, or a crash?

CVSS Score	Severity	Typical Response
9.0 – 10.0	Critical	Patch or mitigate immediately — hours to days
7.0 – 8.9	High	Prioritized patching — within the week
4.0 – 6.9	Medium	Scheduled patching cycle
0.1 – 3.9	Low	Fix when convenient; monitor
0.0	None	No security impact

Professionals treat CVSS as a starting point, not a verdict: a 7.5 on an internet-facing server you own deserves faster action than a 9.8 in software you do not run.

The NVD and the Ecosystem Around an ID

After assignment, a CVE is enriched in the National Vulnerability Database (NVD), run by NIST, which adds the CVSS score, the list of affected products and versions (CPE names), and references to advisories and patches. Around that core sits an ecosystem professionals use daily:

Vendor advisories — the authoritative fix instructions from the product's maker.
CISA's KEV catalog — the Known Exploited Vulnerabilities list: CVEs confirmed to be exploited in the wild. If a flaw is in KEV, it jumps every patch queue.
Exploit databases and scanners — tools like Nessus, Nuclei, and Metasploit map checks and modules to CVE IDs, which is why scan reports speak fluent CVE.
EPSS scores — a probability estimate that a given CVE will be exploited in the next 30 days, used alongside CVSS for smarter prioritization.

A CVE's Lifecycle, End to End

Discovery — a researcher, vendor, or attacker finds the flaw.
Assignment — a CNA reserves and assigns the CVE ID, often before public disclosure.
Disclosure — the advisory publishes with the ID, description, and (ideally) a fix.
Enrichment — NVD analysis adds scores and affected-product data.
Exploitation timeline — scanners add checks; if attackers adopt it, the CVE lands in KEV and incident reports.
Remediation — organizations patch, verify with rescans, and close the ticket — all tracked by CVE ID.

Reserved-but-undisclosed IDs, disputed entries, and the occasional rejected CVE ("this was not actually a vulnerability") are normal parts of the system's housekeeping.

Why Learners Should Care

Fluency in CVE-land is a quiet career superpower. Job interviews assume you can read a vulnerability headline and reason about severity and exposure. SOC analysts triage scanner output written entirely in CVE IDs. Penetration testers chain them. And when the next Log4Shell lands, the people who understand the system — ID, score, KEV status, affected versions — are the ones who respond in hours while everyone else is still decoding the headline.

Start simple: pick one famous CVE per week, read its NVD entry and one technical write-up, and note the attack vector, the fix, and whether it reached the KEV list. In a few months you will read vulnerability news the way professionals do.

Key Takeaways

A CVE is a unique, permanent ID for a specific public vulnerability — the industry's shared language.
MITRE and a federation of CNAs assign IDs; the NVD enriches them with scores and affected products.
CVSS scores severity (0–10); CISA's KEV flags confirmed real-world exploitation — patch KEV first.
Scanners, advisories, and interviews all speak CVE — learning the system pays off immediately.