News linked to this event type.
SlowMist has issued a security alert stating that PHP released a security advisory on October 20, disclosing two critical security vulnerabilities that could lead to remote code execution (RCE), tracked as CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2. Currently, PHP officials have not yet released a fix patch, and the specific affected versions and exploitation conditions remain to be confirmed.According to available information, PHP officials plan to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). SlowMist recommends that relevant organizations promptly check the PHP versions in their servers and business systems, with particular attention to PHP services exposed to the public internet, and upgrade in a timely manner once the patch is released; systems that cannot be upgraded immediately should restrict access sources and take isolation measures when necessary.
according to a post by SlowMist CISO @im23pds, the extortion/disclosure group FulcrumSec has publicly claimed to have continuously stolen approximately 10.6 TB of data from PingCAP's managed database service TiDB Cloud, and has released about 200GB of first-stage samples.On the same day, PingCAP issued a statement acknowledging that "some internal operational data" was accessed without authorization, but emphasized that no product vulnerabilities were involved and that the security of customer databases and business data would not be affected. Companies such as Bitget and Baidu have previously collaborated with this data company.
According to The Defiant, data from Blockaid shows that between January and August 2026, the 60 cryptocurrency attack incidents it tracked involved approximately $1.18 billion, with victims recovering a total of about $9.8 million, accounting for less than 1%. The report indicates that all frozen or returned funds were secured through on-chain governance or validator actions, while blacklist mechanisms by stablecoin issuers recovered zero funds across these 60 incidents.
Bitcoin News posted on X that 8 TLS certificates issued by India's eMudhra were found to have extremely weak private keys, which attackers could exploit to impersonate virtually any website. Major browsers have blocked the affected certificates, but millions of servers, Linux systems, and internet-connected devices may still require updates. A cryptography expert warned that the scale of this cleanup effort could exceed the 2014 Heartbleed vulnerability. No malicious exploitation has been confirmed yet.
Odaily reports: Layer-1 blockchain Qubic has restarted its network and initiated a fund recovery process. Previously, attackers exploited a wallet seed vulnerability to drain approximately $1.4 million in QU tokens from 1,404 accounts; network validators Computors have approved a recovery plan, and affected users can submit claims until May 1, 2027.Qubic's block explorer shows the network resumed processing ticks at 20:00 on October 19, surpassing the previously paused progress of 85,371,949. The vulnerability affects wallet seeds generated by certain Apple devices and browsers. Qubic recommends creating new wallets using version 4.26.4 or above and transferring funds as soon as possible. (Cointelegraph)
According to Odaily, digital hardware wallet manufacturer NGRAVE disclosed on October 19 that attackers hijacked a third-party notification service used by its LIQUID companion app and sent fake security alerts to users, resulting in approximately 70 wallet addresses being stolen for about $2.56 million across 4 blockchains. Among the losses, Bitcoin accounted for approximately $1.77 million, XRP approximately $454,000, Ethereum assets approximately $316,000, and Stellar approximately $18,000.The attackers lured users into clicking on counterfeit websites and entering their 24-word recovery phrases or Perfect Keys, after which automated scripts transferred the assets within minutes. NGRAVE stated that the ZERO hardware wallet and private keys were not directly compromised, and that victims voluntarily handed over their recovery credentials during the phishing process.The unauthorized access may have begun on October 11. After obtaining one access key, the attackers acquired a key with broader permissions and sent fake notifications on October 17. NGRAVE detected the anomaly approximately 1 minute after the notifications appeared, but the first wallet had already been drained 6 minutes later, and the notification system was shut down that evening.NGRAVE's CEO stated that the company failed to fulfill the most basic security responsibilities of a crypto security company, and said that the affected keys have been replaced, with two-person approval, domain restrictions, and emergency shutdown mechanisms added. The company also reminded affected users to create new wallets and contact the support team, noting that some device information, wallet activity, IP addresses, and approximate locations may have been exposed. (Bitcoin.com News)
Odaily reports: Crypto researcher Stacy Muur has compiled a list of 82 digital asset projects and protocols said to have shut down in 2026, including Balancer, Radiant Capital, Neon EVM, Step Finance, and others, spanning DeFi, blockchain infrastructure, and Web3 gaming.The shutdowns were driven by declining revenue, exhausted funding, and security incidents. Earlier this year, Bitcoin's price briefly fell below $60,000, retreating from an all-time high of over $126,000 in October 2025, adding financial pressure on projects.When Ethereum Layer 2 network Blast announced its shutdown, it stated that the project had no "credible path to economic viability." Step Finance shut down following a major treasury exploit, while Radiant Capital announced the end of operations after failing to recover from a 2024 exploit.An August study by DeFiLlama showed that 100 crypto projects had announced shutdowns in 2026, 40 of which occurred in the preceding 90 days; the most common reason was product-market mismatch, followed by exhausted funding, insufficient revenue, and pivots to other products. The projects involved raised a combined total of approximately $1 billion and generated $250 million in cumulative fees, with 9 individual projects each raising over $50 million. (Cointelegraph)
Odaily reports: Cryptocurrency trading platform OKX launched its Shield account protection program in the United States on October 20, with eligible users able to receive up to $500,000 in coverage. The program covers certain unauthorized account takeovers caused by phishing, malware, and SIM-swap attacks, and users must enable passkeys and other security settings.Former New York Governor Andrew Cuomo said his interest in cryptocurrency began in 2011, and he currently serves on OKX's board of directors and co-chairs the company's joint venture with Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange. He supports OKX's push to tokenize US stocks and said some companies remain on the sidelines.Andrew Cuomo expects that the CLARITY Act will not receive a vote before the 2026 midterm elections, with the next opportunity possibly in January next year. He said the US Congress should reduce partisan strife and establish clearer federal rules for the digital asset market; companies such as Microsoft and Google parent Alphabet are currently cautious about tokenized stocks. (Bitcoin.com News)
Odaily Report: According to monitoring by on-chain analyst Yu Jin, the hacker who stole $285 million in assets from Drift Protocol in early April transferred 25,710 ETH, worth $61.24 million, through Tornado 3 hours ago. In early April, the hacker exchanged the stolen assets into 131,564 ETH at an average price of $2,154, and in July transferred 24,400 ETH through Tornado; the address currently still holds 81,454 ETH, worth $194 million.
On-chain investigator ZachXBT stated that FreedomXMR (FXMR), a centralized money laundering service that appeared on Hyperliquid Core (HL Core) in August 2026, had over 87% of its incoming funds directly linked to illegal activities. A review of historical inflows exceeding $10,000 revealed that over $20 million could be directly traced to ransomware, security exploits, malware, and social engineering incidents, involving multiple theft cases such as the DCENT Wallet, Fetch.ai, Axelar, and Gamdom.
Xie Jiayin, Head of Greater China at Bitget, stated in a post that an investigation confirmed hackers breached and accessed data from the TiDB Cloud database product under PingCAP. Bitget had previously collaborated with the company alongside partners such as Baidu. He clarified that Bitget only stored some public trade log data in the database (i.e., data visible to all users in the trading channel) and had discontinued using the service more than two months ago. The incident did not involve any user data, and no sensitive information such as passwords was leaked.
The hacker group FULCRUMSEC has publicly disclosed a cyberattack targeting the TiDB Cloud managed platform operated by distributed database provider PingCAP. Over the past two months, attackers exploited leaked cloud credentials from its codebase to continuously infiltrate systems, cumulatively exfiltrating 10.6 TB of core data and publicly releasing over 200 GB of data packs in the initial phase. Exposed records indicate that affected entities include blockchain-related companies such as Bitget, Pionex, DigiPlus, NFTscan, and Chainbase, as well as prominent multinational corporations including Booking.com, Shopee, and Capcom.
The SlowMist security team discovered during an analysis of the Qubic wallet that it uses the same non-cryptographically secure random number data stream (Math.random()) for both generating the account seed and producing the dejaVu identifier values disclosed in network packet headers, potentially allowing private keys to be recovered through network observation.
According to Onchain Lens monitoring, the Drift Protocol attacker has become active again after 2 months, sending at least 13,400 ETH worth approximately $32 million to Tornado Cash, possibly to obscure the fund trail. The attacker still holds $225 million in assets across tracked wallets, including 93,965 ETH worth $224 million; 477,375 USDY worth approximately $549,000; and 1.33 SOL worth $138.
Cysic has issued a service status update stating that the Cosmos explorer is temporarily unavailable, Cysic mainnet operations are unaffected, and explorer access is being restored as quickly as possible. Following the recent security incident, the cross-chain bridge remains paused. Funds related to pending cross-chain transactions remain safely held in the cross-chain bridge contract, and the relevant transactions will be processed once the cross-chain bridge is secure again.
Odaily reports: Blockchain security research firm Asymmetric Research has disclosed that Solana's on-chain governance program svmgov previously had a vulnerability: when validators did not participate in voting, independent votes submitted in advance by their delegators might not be counted in the final results. The vulnerability was reported to the Solana Foundation on July 10 and was fixed on mainnet on August 3, earlier than the governance vote on August 24. Based on on-chain data calculations, Asymmetric Research estimates that if the vulnerability had not been fixed, the approval rate of the SGP-0002 proposal, which aims to accelerate the decline in SOL inflation, could have dropped from the actual 67.00% to 66.65%, below the 66.67% passage threshold. The vulnerability was fixed before the vote and did not actually change the proposal's outcome.
The Aztec Rollup attacker deposited 1,255.8 ETH, worth approximately $3 million, into Tornado Cash.
Papertrade（@papertrade_xyz）团队 blurr 和 jez 在 X 平台发布的公告，Papertrade 将升级合约，暂无计划开放 PAPER 链下转让。团队称，若代币可转让，外部永续合约市场就可以做空"资金池偿付能力"，操纵攻击的目标额将从资金池规模升至"资金池加做空敞口"。例如，资金池为 1000 万美元时，成本 1500 万美元的攻击原本不可行，但若同时持有 1000 万美元 PAPER 空头，攻击就有利可图。 在费用方面，此前系统采用 0.2bps 的死区费用，新方案分为"交易时段"和"非交易时段"两种模式，仅影响开仓后价格变动在 6bps（0.06%）内（非交易时段为 10bps，即 0.1%）平仓的仓位，超出阈值的交易费用不变。团队称，按上线以来的数据回溯，此举对机器人策略盈利的影响约为对普通交易者的 15 倍，调整后有望放宽未平仓合约（OI）上限。 在代币经济方面，此后每损失 1 美元，将铸造固定比例的 PAPER 供应量，约为每损失 100 万美元铸造 0.1%。破产及临近破产时的铸造机制，将由固定的每 1 美元损失铸造 100 枚，改为随时间增
Odaily reports: Papertrade founder Jez posted on X in response to the controversy over the non-transferability of the PAPER token, stating that the team was aware of certain unresolved technical issues before the protocol launched, including potential attack risks posed by the perpetual contract market, but had originally expected more time to find solutions.Jez noted that the team had previously estimated that a large perpetual contract market might take about 6 months to launch, but the relevant market progressed much faster than expected, forcing the team to make a decision before finding an effective solution. To safeguard the protocol's long-term healthy development, PAPER has currently been set to a non-transferable status.He emphasized that PAPER represents users' rights to the protocol's revenue, and its long-term value depends on whether Papertrade itself can continue to attract traders, rather than whether the token can be freely traded. The team is unwilling to restrict the protocol's business growth in order to support PAPER perpetual contract trading.In response to community concerns that the rule change harms the interests of early users, Jez stated that the adjustment was not a hasty decision but a risk management choice made by the team based on actual operating data from the first week since the protocol launched, and that the team will continue to adjust protocol parameters in the future to ensure long-term sustainability.
SlowMist has released an analysis report on the DarkSword trojan's backend and iOS attack chain. According to the report, after the relevant exploit code was publicly disclosed in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed coming online in late September. SlowMist traced the related online infrastructure, linked its management panel to a public GitHub repository, and analyzed the exploit code, delivery chain, and post-compromise exploitation capabilities. The report shows that the attack framework integrates exploit, device and data collection, data exfiltration, and crypto wallet fund consolidation functions. It can target keychains, files, messages, and crypto wallet data, and has the ability to decrypt wallet data and consolidate funds. Although the toolkit claims support for iOS 13 and later, code analysis shows that its actually effective exploitation window is concentrated in iOS 18.6 to 18.7.2 and iOS 26.0 to 26.1. The public exploit components have been integrated into a deployable attack framework. SlowMist advises users to update their iOS systems promptly and avoid clicking untrusted links; opening malicious pages in the Safari browser may also trigger the exploit. If a device has visited a suspicious landing page, users should treat their mnemonic phrase and private key as compromised, use a clean device that has never visited the page to create a new wallet and transfer assets, and check for abnormal transactions and token approvals across chains, revoking unnecessary approvals.