News linked to both this project and an event.
This incident involves the recoverability of private keys for eight emSign G3 intermediate CAs under eMudhra. eMudhra acknowledged that a script error led to the generation of weak keys, and the relevant intermediate certificates were revoked following reports received on October 17. However, a security advisory from Teku notes that Java does not check certificate revocation status by default, meaning affected runtimes still require manual patching.
SlowMist monitoring reveals that LiteLLM has once again been targeted by a supply chain attack. The malicious version [email protected] affects PyPI packages and Docker images, including floating tags such as latest and main-stable. This malware executes automatically upon Python startup, stealing sensitive data such as cloud service credentials, AI API keys, and SSH private keys, and enables remote code execution. The affected versions have currently been removed or replaced. SlowMist advises users to avoid using version 1.107.0, rebuild affected environments with clean images, rotate potentially exposed credentials, and pin the version to 1.106.2.
Bitcoin News posted on X that BTCPay Server has updated its optional WooCommerce/WordPress deployment through its Docker installer in response to a recently disclosed severe PHP vulnerability. Users running WooCommerce through BTCPay Server should update immediately by simply clicking "Update" within BTCPay Server.
Bitcoin News posted on X that BTCPay Server has released version 2.4.5, strengthening Lightning and LNURL security and improving invoice generation performance. This version makes Tor optional in Docker deployments, limits the scope of public Lightning API exposure, and removes multiple deprecated or unmaintained integrations. All server administrators are advised to update, and operators relying on Tor or affected integrations should first review deployment changes. The Plugin Builder, which was previously suspended due to a server breach, has reopened, with build tasks now running in temporary isolated sandboxes, and new security controls including build output verification, administrator audit logs, new account and build notifications.
Odaily News: Bitcoin News posted on X platform that Core Lightning version 26.06.7 has been released, fixing multiple vulnerabilities that were responsibly disclosed over the past three weeks. Recently, there has been an increase in AI-generated security reports targeting open-source Bitcoin projects. Specific vulnerability details will be kept confidential for two weeks to allow node operators to complete upgrades before technical details and source code are published. Developers warned that immediately disclosing the fixes could allow attackers to reverse-engineer the vulnerabilities and attack nodes that have not yet been updated. All Core Lightning node operators should upgrade immediately. Docker images are not yet available, and developers have explicitly warned users not to wait for the Docker image.
Bitcoin payment processing service BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software. Attackers exploited a severe vulnerability to obtain credentials and transfer funds. The number of affected operators and the total amount stolen have not yet been disclosed. This restriction affects external wallets such as Zeus that connect via BTCPay Server domains or Tor onion addresses in Docker deployments, but Lightning Network payments can still continue. BTCPay Server stated that remote access functionality will be restored once security is confirmed. BTCPay Server 2.4.2 will install LND 0.21.1 and automatically regenerate macaroon credentials during standard installation. Foundation and Citadel21 have respectively disclosed that funds from their Lightning Network nodes were swept. Foundation stated that hot wallets were not affected, and the specific amounts of losses have not been disclosed.
Odaily News: NVIDIA has officially released Video Codec SDK 13.1, offering developers multiple video encoding and decoding upgrades, including AV1 layered reference mode, zero-copy transcoding architecture, precise frame-level search, enhanced hardware decode statistics, and a new Docker development environment, further improving performance and efficiency in AI video processing, streaming, and large-scale content distribution scenarios. On the decoding front, SDK 13.1 adds per-macroblock decode statistics for H.264/H.265 without requiring additional CPU parsing overhead.NVIDIA stated that as demand for high-quality video streaming, generative AI video tools, remote collaboration, and large-scale content distribution continues to grow, Video Codec SDK 13.1 will help developers build more efficient, lower-latency, and more scalable video processing pipelines.
According to the official OpenClaw GitHub release notes, OpenClaw released version v2026.4.25 on April 27. This update covers multiple core modules—including speech, plugins, observability, and browser automation—with the following key highlights: • TTS Overhaul: Added support for six new voice service providers—Azure Speech, Xiaomi MiMo, ElevenLabs v3, Inworld, Volcengine (Volcano Engine), and local CLI—and introduced chat-session-level automatic TTS control, TTS persona binding, and cross-Agent/account-level override configurations. • Plugin Registry Optimization: Migrated plugin startup and installation paths to a cold-persistent registry, reducing full-manifest scanning and improving determinism for plugin updates, fixes, and discovery. • OpenTelemetry Expansion: Extended coverage across the full observability pipeline—including model invocations, token usage, tool loops, Harness execution, process execution, message delivery, context assembly, and memory pressure metrics. • Browser Automation Enhancements: Added iframe-aware role snapshots, CDP readiness tuning, one-click headless startup, and deeper browser diagnostic probes. • Installation Stability Improvements: Fixed installation and update issues across Windows, macOS, Linux, and Docker platforms.