A flaw in online store software and a large crypto theft offer simple lessons for a safe Halloween at home, online and at parties.
AppWT Informative Multi-Lingual System
Today is Halloween. Many people will shop online, share photos and gather with friends. This week also brought news of a store software flaw that attackers are using, and a very large crypto theft that may have started with one laptop. Before tonight, update your devices, check your recent online orders and keep a close eye on any device you use for money.
Halloween today
Halloween is a holiday in the United States today. For many people, it is a night of costumes, candy and parties. It can also be a busy time for last-minute online shopping.
Here are a few calm, simple steps to keep your tech and your money safe today.
Shopping online for costumes and candy
Many websites use Drupal, and some use it for online stores. Drupal is a system people use to build and manage websites. One add-on for it is called Commerce Core. It runs the shopping cart and checkout. BleepingComputer reports that more than 42,000 websites use Commerce Core.
Drupal warned that this add-on has a serious flaw. The site does not check well enough who is allowed to do certain things. Drupal said attackers are already using the flaw. It also said the flaw "may financially impact the vendor." In plain terms, the store could lose money.
A government list of known attacks also includes a flaw in Adobe Commerce and Magento. The list is explained below. These are other tools for running online stores. That flaw could let an attacker run their own code on the store's system.
As a shopper, you usually cannot see what software a store uses. So focus on what you can check:
- Read your order emails. Make sure the items, prices and address are right.
- Check your card or bank statement this week for charges you do not know.
- If something looks wrong, contact the store using the address on its official website. Do not use a link in a message.
Drupal asked store owners to upgrade Commerce Core right away. It also asked them to review their orders for anything that looks odd. One note: the report lists version 3.3.13 both as affected and as the fixed version. Please check Drupal's own advisory to confirm the right version for your site.
A large crypto theft and a lesson about laptops
Binance is a large crypto exchange. It lost about $6.3 billion in cryptocurrency, according to Help Net Security. Other counts in the same report differ a little. One firm counted about $6.36 billion. Another put the total a little higher.
Binance said its first look suggests the attack may have started with a compromised laptop. That laptop belonged to an engineer. Binance also said:
- It found no sign that its wallet private keys leaked.
- Close to $3 billion has been frozen with help from partners.
- It said it will cover all losses, and user funds are safe.
- Withdrawals were paused. They were expected to resume within 48 hours.
One research firm said early signs on part of the attack suggested phishing. Phishing means a fake message that tricks someone into giving access. Two research firms linked the attack to a group from North Korea.
The lesson for everyone else is simple. One device can be the door to a lot of money. At a busy party, that matters.
- Lock your phone and laptop with a PIN, password or fingerprint.
- Do not leave devices open and alone while guests are around.
- Do not approve a login or payment request that you did not start.
Why updates matter before tonight
CISA is a United States agency that tracks online threats. It keeps a list of known exploited flaws. These are weak spots that attackers are already using. CISA added 10 flaws to that list in the 7 days up to October 29.
The new entries include the Linux kernel, PHP and Google Brotli. They also include the store software I mentioned above. Most of these run on servers and business systems, not on your phone. Still, they show how often fixes come out. They also show how fast attackers move.
Before you head out or welcome guests, take five minutes. Install any waiting updates on your phone, laptop and home devices. Restart them if they ask.
What to do now
- Update your phone, laptop and other devices today.
- Check your recent online orders and your card statement.
- Lock your devices, and keep them with you at gatherings.
- Ignore requests to log in or pay that you did not start.
- If you run an online store, apply the latest fixes and review your orders.
Enjoy the costumes and the candy. A few small steps today can keep the night fun and calm.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Drupal warns of critical Commerce Core flaw exploited in attacks, BleepingComputer, 2026-10-30
- Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record, Help Net Security, 2026-10-30
- CISA Known Exploited Vulnerabilities: 10 added in the 7 days to 2026-10-29, CISA, 2026-10-29
Tags
Frequently Asked Questions
What is wrong with Drupal Commerce Core?
Drupal says the add-on does not check well enough who can do certain things on a store site. Attackers are already using this flaw. It may cause the store to lose money.
Should shoppers worry about this store flaw?
You cannot see what software a store uses, so check what you can. Review your order emails and your card statement. Contact the store through its official website if something looks wrong.
How did the Binance theft happen?
Binance said its first look suggests it may have started with an engineer's compromised laptop. It found no sign that its wallet private keys leaked.
Is money held at Binance safe?
Binance said user funds are safe and that it will cover all losses. It said withdrawals were paused and expected to resume within 48 hours.
What is the CISA known exploited list?
It is a list of software flaws that attackers are already using. A United States agency keeps it. CISA added 10 flaws to it in the 7 days up to October 29.
Enjoyed this article?
Share it with your network
