News linked to this event type.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."
According to a statement from Keystone Hardware Wallet (@KeystoneWallet), its official website was compromised on October 20 by attackers exploiting a vulnerability in third-party monitoring tools. Approximately 25,964 purchase records containing personal information, 12,873 unpaid checkout records, and device WebAuth authentication keys were accessed. Mnemonic phrases, private keys, and payment information remain unaffected. Keystone will destroy 18,835 devices containing the old keys in its inventory, suspend shipments from its official website, and transition to a pre-order system. The company also reminded users that there is no need to transfer their assets and warned them to remain vigilant against scams, including fraudulent "recall" campaigns.
According to PRNewswire, S&P Global (NYSE: SPGI) announced on October 26 that it has completed its acquisition of OpenZeppelin, a provider of on-chain financial security standards. The transaction was first announced on September 17, with financial terms undisclosed, and is not expected to have a material impact on S&P Global’s financial results. Founded in 2015, OpenZeppelin has completed over 900 security service engagements and identified more than 10,000 vulnerabilities before product launches. Its open-source smart contract library, OpenZeppelin Contracts, supports value transfers exceeding $38 trillion, encompassing various mainstream stablecoins and tokenized funds. This acquisition will expand S&P Global’s risk assessment capabilities into the on-chain technology risk layer, and both parties plan to jointly develop a new generation of on-chain security assessments and benchmarks. After the acquisition, OpenZeppelin will continue to operate as an independent business unit under its original brand, with founder Demian Brener staying on as head, reporting to Yann Le Pallec, President of S&P Global Ratings. OpenZeppelin Contracts will remain open-source, free, and publicly maintained.
As reported by CoinDesk, Indian cryptocurrency exchange CoinDCX has confirmed a loss of $16 million. The incident occurred because its sweeping process failed to withdraw customer deposits from wallets compromised in a July 2025 hack. The exchange stated it would absorb the loss itself and confirmed that active users' funds remain secure.
According to a post by Bloom Trading, in response to recent wallet asset theft incidents, the platform stated it will fully compensate nine affected users (49 wallets in total) for all financial losses, and will transfer the compensation funds directly into new secure wallets designated by the users, without the need to establish a special compensation fund.
According to announcements from Upbit and Bithumb, both Korean cryptocurrency exchanges have designated Initia (INIT) as a trading alert asset due to unexplained or unresolved security incidents, such as hacks impacting related wallets or distributed ledgers, which could lead to user asset losses. Currently, deposit and withdrawal services for INIT on both exchanges have been suspended. Upbit stated that upon resumption, withdrawals will be prioritized, with deposit services to be announced separately.
Odaily reports: According to Onchain Lens monitoring, Bloomtrading users have reported wallet asset theft, with approximately $954,000 in funds transferred to a suspected theft address. A hacker stole 9,408 SOL from 49 victims through a theft wallet, and the final amount may be higher. The largest single theft was 1,636 SOL, worth approximately $166,000. Users are reminded to disconnect immediately and transfer funds to a new wallet.
ai16z founder Shaw further introduced the Pump.fun smart contract reverse engineering plan on X, stating that the goal is not to develop a contract with similar functionality, but to restore a version that is completely identical to the original contract at the byte level, including the vulnerabilities and flaws in the original code. He called on developers to participate in the reverse engineering with AI tools and continuously submit code contributions via GitHub.Shaw pointed out that closed-source smart contracts are detrimental to security audits, and stated that over the past year, fund losses caused by serious security vulnerabilities in closed-source contracts exceeded $40 million. He believes that promoting open-source contracts helps developers and AI discover and report potential vulnerabilities.In addition, Shaw also plans to use tokens previously repurchased with Meme coin fee revenue as bounty rewards, distributing them to contributors participating in the reverse engineering.Previously, ai16z founder Shaw posted on X stating that 90% of the Pump.fun contract reverse engineering work had been completed, with full completion expected that evening, and said, "Open source everything, or you will be forced to open source."
Odaily reports: Vitalik posted on X platform that he believes it is acceptable for Kimi 3.1 to intentionally exclude high-end offensive cyber capabilities from its training data. Compared to treating users differently based on identity, treating them differently based on use case is far less problematic; society needs time to prepare, harden systems, review old code, and formally verify new code before a full-scale wave of powerful cyberattacks arrives. Vitalik also stated that if the first major wave of AI risk is not properly addressed, society could move toward a scenario of highly restricted models, widespread KYC and surveillance, where users might be divided into different tiers based on credentials and nationality, receiving different levels of model access.
Odaily News: As of October 21, 43 price manipulation attacks have been recorded in the DeFi sector in 2026, surpassing the previous all-time annual high of 27 set in 2022. Total related losses amount to approximately $199 million, lower than the loss scale in some years, with the Tectonic case accounting for about $125 million. Of the remaining 42 incidents, 32 involved individual losses of less than $1 million.
Bitcoin News posted on X that researchers claim Tailscale has a critical vulnerability: users with approved access permissions can exploit its built-in SSH to gain root access on devices, and the attack may also spread to other devices on the network. Users running nodes with Tailscale should disable Tailscale SSH and update promptly once a patch is released. Tailscale has not yet responded.
according to SlowMist monitoring, the decentralized trading platform Yapeswap suffered an attack with losses of approximately $21,900. The root cause was that the WorkersUnion governance quorum was zero, allowing the attacker to pass a proposal with only about 0.000055% of voting power, transferring the feeToSetter permission of YapeFactory to themselves. The attacker then installed a malicious Registry, causing latestVault() to return fake vaults while vaults() still listed the real vaults. YapePair counted the misappropriated deposits as farming assets but did not obtain redeemable shares.
CoinDCX has issued an announcement stating that it detected anomalous system activity on October 21, and subsequent investigation confirmed that the anomalous activity affected legacy wallet infrastructure that had been deprecated following the July 2025 security incident. CoinDCX stated that due to a malfunction in the automated fund sweeping service that lasted for a period of time, some user deposits mistakenly sent to old addresses were not transferred in a timely manner, ultimately resulting in a loss of 15.99 million USDT, with the related losses borne by the company.CoinDCX emphasized that existing wallets and trading systems were unaffected, user funds remain securely held in isolated cold wallets, and trading, deposit, and withdrawal services all continue to operate normally.
According to monitoring by Salus, Tether has blacklisted nine addresses linked to the CoinDCX security incident and frozen approximately 2.2129 million USDT. The investigation was triggered by an anomalous transfer, and subsequent on-chain evidence prompted Tether to implement the freeze.
Hardware wallet maker Keystone disclosed a security incident on its official website after a third party accessed some customers' names, contact information, shipping addresses, and order details. The company stated that the compromised data does not include bank card information, seed phrases, private keys, or wallet passwords, and advised users to remain vigilant against subsequent scams.
Odaily reports: According to Bitcoin News monitoring, Electrum has disclosed a high-risk security vulnerability in which malicious servers can trick users into sending Bitcoin to an attacker's address when users increase transaction fees. The attacker intercepts broadcast transactions and replaces them in the wallet history with a forged transaction that redirects funds to an address controlled by the attacker. If users increase fees via Replace-by-Fee (RBF), Electrum may sign the malicious transaction. Electrum confirmed receiving two related incident reports, with one user losing funds. The attacker also generated addresses with the same last four characters as the intended recipient addresses. The vulnerability affects versions prior to 4.8.3 and has been fixed in version 4.8.3. Electrum reminds users to update immediately and to verify all recipient addresses and amounts before signing transactions.
As of now, three attack transactions have enabled the attacker to acquire approximately 4.85 million USDT and around 550,000 X, with roughly 12.2 million X still remaining in the Freezer. Blockaid states that the attack is ongoing.
The Electrum project officially announced the release of version 4.8.3, stating that it patches a critical security vulnerability and urging all users to upgrade. Details regarding the vulnerability will be disclosed at a later time. The GitHub changelog marks 4.8.3 as a security update, released on October 23. The official Electrum website advises users to download the software exclusively from their official site and verify the GPG digital signature to confirm the installer’s source and integrity.
a high-severity reliability vulnerability has been disclosed in Succinct's zero-knowledge proof system SP1. The vulnerability was disclosed on October 11 via GitHub advisory GHSA-p7v2-jjv3-8p8f, affecting SP1 native Rust verifier versions 6.0.0 through 6.8.0, potentially allowing the mainnet Prover Network to accept invalid proofs: a malicious prover could submit a proof of invalid execution, and the network verifiers would still accept it. The cause of the vulnerability is that the verifier only reads the data's label (declared dimension) and does not verify whether the actual number of stored elements equals the product of the dimensions; an attacker could forge the label to make an invalid proof pass. Groth16 and Plonk checks that use fixed-shape wrap proofs are unaffected, and the on-chain Solidity verifier is also secure. Succinct released fix version 6.8.1 on September 24, which has been deployed to mainnet; this version adds deserialization length validation. The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users who run the native Rust verifier themselves and accept untrusted proofs need to upgrade to 6.8.1.
Initia stated that on October 23 at 22:59 (UTC+8), an attacker exploited a vulnerability in the Initia MoveVM script cache to bypass security checks and forge MoveVM state, crediting themselves with WETH, iUSD, and USDC that had no actual backing. The total supply of the relevant tokens has not changed, INIT was not minted additionally, and the total supply is unaffected.