The attacks that aren't a 0-day or a CVE: the breaches, the heists and the money trails. What happened, what it cost and what's still unknown, with sources for all of it.
The largest crypto theft on record, about four times the old record, most of it gone in about 20 minutes. Investigators point to North Korea, and nobody has yet explained how the attacker got in.
Remote code execution through the Brotli decoder bundled with Node.js.
Unauthenticated remote code execution in the PHP engine itself.