News linked to this event type.
Nina Rong (@nina_rong), Head of Growth at BNB Chain, posted that BNB Chain's technology stack does not use PHP and reminded users to remain vigilant. Previously, the National Security Agency's cybersecurity division NSA Cyber (@NSACyber) issued an advisory stating that all organizations using PHP to build systems should prepare for updates aimed at fixing two critical vulnerabilities. PHP is widely used in web applications, and such vulnerabilities can typically provide direct access to the server file system.
Vitalik Buterin (@VitalikButerin) posted on X that he did not predict defense would automatically outpace offense, but rather believes cybersecurity will ultimately reach an endgame favorable to defense, although the transition will be difficult. He pointed out that "good guys discovering vulnerabilities in deployed software before bad guys" does not constitute a defense-biased game. To truly shift the balance toward defense, deeper methodological changes are required, including formal verification and aggressively shrinking the trusted computing base (TCB), which are only just beginning. He also noted that this is a major reason for his support of slowing or pausing AI development, and urged dedicating over 1% of GDP to hardening cybersecurity, biosecurity, and the physical world.
According to Cointelegraph, the PHP Foundation admitted that a critical security vulnerability discovered as early as 2024 has yet to be patched due to flawed decision-making processes and understaffing within the security team, calling the delay a structural failure. The vulnerability could allow unauthenticated attackers to remotely execute code on affected servers. On August 11, security firm Calif and OpenAI independently reported the same issue, with Calif also demonstrating unconditional remote code execution, prompting the matter to be elevated to the highest security priority. PHP released emergency patches for two related critical vulnerabilities on Wednesday. Around the time of the patch release, government websites or services in the Netherlands, Finland, France, Germany, and Australia were temporarily taken offline, with the Netherlands shutting down its digital identity service. The Wikimedia Foundation also took some supporting services offline, causing disruptions to certain Wikipedia features. Japanese Prime Minister Sanae Takaichi called on website operators to install the patches as soon as possible. In the crypto sector, monitoring by SlowMist's MistEye service found that out of 1,488 evaluated domains, 793 showed direct PHP fingerprints. Cardano governance organization Intersect temporarily took its member portal offline. Both Coinbase and BitGo stated that their platforms were unaffected. Binance co-founder Changpeng Zhao advised users to exercise extreme caution when visiting websites over the next few days. PHP security team
Odaily reports: The PHP Foundation has stated that due to hesitant decision-making and insufficient resources, remediation work for a critical security vulnerability first discovered in 2024 stalled and restarted multiple times, and it characterized the delay as a "structural failure." PHP is a programming language widely used for websites and web applications.PHP has released emergency patches for two related critical vulnerabilities. Unauthenticated attackers could exploit the flaws to execute code on affected servers without logging in. Some government websites or online services in the Netherlands, Finland, France, Germany, and Australia were temporarily taken offline to prepare for patch installation.Security firm Calif and OpenAI separately reported the same underlying issue on August 11, and Calif also demonstrated unconditional remote code execution. Blockchain security firm SlowMist investigated PHP usage in the crypto industry and found direct PHP fingerprints on 793 of the 1,488 domains it assessed.Intersect has temporarily closed its Members Area, Coinbase said it has not found any affected PHP instances, and digital asset infrastructure company BitGo said its platform was not affected. Binance co-founder Changpeng Zhao reminded users to exercise heightened caution when visiting websites recently, and OpenAI has released a Codex skill for checking for vulnerable PHP versions. (Cointelegraph)
CZ (@cz_binance) posted on X that PHP recently disclosed two vulnerabilities (CVE-2026-109618 and CVE-2026-109619), affecting servers running applications like WordPress and Magento. The relevant patch was released on October 21, but vulnerability details were leaked prematurely, and active exploitation in the wild has been confirmed. CZ warned users that some website administrators may not have updated security patches promptly, making compromised sites potential entry points for credential theft or device attacks. Extreme caution is advised when visiting any website over the next few days. Previously, PHP was reported to have a critical security vulnerability, leading to mass outages of government websites across multiple European countries.
According to Consultation Paper GC26/7 published by the UK Financial Conduct Authority (FCA), the FCA launched a consultation on 21 October regarding non-Handbook guidance for decentralized finance (DeFi). The comment period closes on 18 November, with the final version planned for release in the first quarter of 2027. This guidance does not establish new regulatory requirements. It aims to clarify how existing rules under SYSC 15A (Operational Resilience), SYSC 6 (Compliance and Financial Crime), and the Money Laundering Regulations (MLRs) apply to regulated firms that use or access DeFi. The FCA stresses that regardless of whether an entity describes itself as "decentralized," authorization or exemption is required if it carries out regulated activities in the UK. The document reveals that from January to August 2026, decentralized exchanges accounted for approximately 14% to 19% of global crypto spot trading volume. In 2025, approximately 8% of UK crypto users acquired crypto assets through decentralized exchanges. According to industry data, cumulative losses from DeFi and cross-chain bridge hacks since 2016 have exceeded $12 billion.
cloud application deployment platform Railway has issued a security notice stating that on October 21 it detected abnormal activity in the system that stores customer environment variables. A preliminary investigation shows that unauthorized third parties may have accessed some encrypted environment variables and obtained the decrypted contents of some of them, involving sensitive information such as API keys, database credentials, and private image registry credentials.Railway stated that the incident may be related to a recent series of attacks targeting platform companies, with the attackers suspected of attempting to breach an AI inference service provider. The platform has notified relevant upstream service providers to proactively revoke keys.At present, preliminary analysis indicates that the scope of impact may be limited to some users, but Railway still recommends that all users immediately rotate the environment variables, API keys, and private image registry credentials stored on the platform, and check relevant service logs for abnormal activity.Railway has suspended all deployments, and new version releases are temporarily unavailable. The platform said it will directly notify affected customers by email after confirming the affected accounts and will continue to disclose investigation progress.
Bitcoin News posted on X that BTCPay Server has updated its optional WooCommerce/WordPress deployment through its Docker installer in response to a recently disclosed severe PHP vulnerability. Users running WooCommerce through BTCPay Server should update immediately by simply clicking "Update" within BTCPay Server.
Odaily reports: PHP has issued a security advisory regarding two previously disclosed critical remote code execution (RCE) vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Attackers may exploit these vulnerabilities to execute malicious code without authentication, and PHP officially strongly recommends that all users upgrade immediately.These vulnerabilities affect PHP environments that handle web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Among these, Apache mod_php poses a particularly prominent risk, as attacks can be triggered before application code runs.Official patched versions have been released: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users still running PHP 8.1 or earlier should contact their distribution or long-term support (LTS) vendor to confirm patch availability, or upgrade to a supported version. Officials emphasize that temporary mitigation measures cannot fully eliminate the risk—installing security updates immediately is the only complete way to address the vulnerabilities.
Odaily reports: According to White House officials, U.S. President Trump plans to highlight his administration's efforts to combat scams carried out by overseas criminal organizations using cryptocurrency at a cybercrime event held at the White House. Transnational criminal syndicates are said to have stolen funds from American citizens through romance scams, phishing, ransomware attacks, and other means. U.S. law enforcement agencies have frozen approximately $833 million in crypto assets linked to overseas fraud and, under a Department of Homeland Security task force operation, seized 503 fraudulent cryptocurrency websites, while notifying nearly 9,000 U.S. citizens that they were being targeted by scams. As the U.S. congressional midterm elections approach, Trump and his administration's ties to the crypto industry are also drawing scrutiny over conflict-of-interest allegations. (CoinDesk)
Bitcoin News posted on X that the St. Louis Fed Economic Research website is currently displaying a maintenance notice. The site hosts the widely used FRED economic database. The website outage comes amid reports of a severe PHP security vulnerability, but the Federal Reserve has not yet confirmed whether the two are related.
The Polkadot Community Foundation issued a security warning on the Polkadot Forum stating that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the browser extension for the third-party wallet Fearless Wallet contain malicious code, which may transmit users' private keys to attacker-controlled servers when unlocking the wallet. The relevant code was added on February 19, 2025, via a code commit titled “TON ecosystem”, and was triggered intermittently from February 2025 to October 10, 2026.
Odaily reports: Blockchain security firm CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by Indian digital certificate authority eMudhra, crypto trading bots and exchange applications may still be exposed to related vulnerability risks, as browser remediation measures may not cover software that uses independent security systems.Peiyu Wang, Senior Director of Digital Asset Security at CertiK, noted that attackers could exploit compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or trick users into approving malicious transactions. However, such attacks would also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Crypto service operators should update their software and certificate trust stores, and confirm that their applications reject the affected certificates. (Cointelegraph)
According to The Washington Post, MAGA Inc., the primary Super PAC affiliated with U.S. President Trump, has spent $277 million to support Republican midterm election candidates, retaining approximately $164 million in funds as of last week. MAGA Inc. transferred $200 million to its affiliated Super PAC, No Going Back PAC, and $25 million to Safety & Affordability PAC; since September, it has also directly spent roughly $34 million on advertising to attack Democratic candidates, including Texas Senate candidate James Talarico.
Odaily reports: The French Ministry of Finance, the Autorité des Marchés Financiers (AMF), the Banque de France, and the Autorité de Contrôle Prudentiel et de Résolution (ACPR) have jointly proposed amendments to the EU's Markets in Crypto-Assets Regulation (MiCA), requiring crypto platforms to bear responsibility for certain customer losses when they proactively offer access to DeFi protocols without reviewing those protocols or ignoring known security risks.France proposes that platforms review relevant protocols before providing DeFi access, continuously monitor for vulnerabilities and suspicious activity, and support the certification of protocols and smart contracts. The relevant requirements would apply fully to significant crypto-asset service providers (CASPs), with proportionally adjusted obligations for smaller platforms.France also proposes transferring supervisory authority over significant CASPs from national regulators to the European Securities and Markets Authority (ESMA), and lowering the current EU threshold of 15 million daily active users. Additionally, France suggests re-examining the asset-referenced token (ART) category and adjusting the electronic money token (EMT) framework to cover multi-currency stablecoins. (Cointelegraph)
Indian digital certificate authority eMudhra had a flaw in its key setup script that caused it to use extremely weak values as private keys, resulting in the compromise and exposure of eight private keys. Attackers can exploit forged digital certificates to impersonate trusted websites and carry out man-in-the-middle attacks to steal or tamper with data.
According to Lookonchain monitoring, the Drift Protocol attacker who stole over $270 million has once again deposited 24,885 ETH, worth $61.3 million, into Tornado Cash, and currently still holds 56,569 ETH, worth $139.3 million.
According to monitoring by PeckShieldAlert, the address labeled as Drift Exploiter 1 is depositing a new batch of stolen funds into Tornado Cash. To date, it has cumulatively transferred in approximately 18,800 ETH, worth around $46 million.
According to on-chain investigator ZachXBT (@zachxbt), an institutional entity was reportedly targeted by a DPRK-linked group, SquidSquad, on BSC on October 8, with approximately $2.84 million stolen. On October 20, the attacker deposited 1111.2 ETH into Tornado Cash and withdrew the funds to three addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b, 0x35c72e26f6888b4cba8668c6cfa4143599680bfe, and 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848. Subsequently, the funds were bridged cross-chain via USDT0 from Ethereum to Tron and consolidated into TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux. Both consolidation addresses are linked to previously identified DPRK-affiliated addresses.
Odaily reports: Multiple tech companies have urgently blocked 8 intermediate certificates with security vulnerabilities issued by Indian digital certificate authority eMudhra Limited. Due to flaws in the private key generation process of the affected certificates, attackers could exploit forged certificates to impersonate legitimate websites and intercept, read, or tamper with user communications.Mozilla cryptography engineer Dennis Jackson stated in an incident report that after receiving the vulnerability report on October 17, Mozilla independently recovered the relevant private keys, confirming that the generation mechanism has serious flaws and is highly exploitable.Mozilla subsequently blocked the affected certificates in Firefox through OneCRL and released browser updates for desktop and Android on October 20. Cloudflare also updated protections for services including Cloudflare One, WARP client, and Cloudflare Tunnel on Tuesday. According to Mozilla's disclosure, Chrome blocked the relevant certificates on Saturday, Apple devices completed blocking on Monday, and Microsoft platforms took corresponding measures on Tuesday. (Cointelegraph)