News Heat Trend
Project Overview
Immunefi is a bug bounty platform focused on Web3 and smart contract security. They provide hosting, consultation, bug triaging, and program management services to blockchain and smart contract projects.
Immunefi CEO warns PHP vulnerability could leave websites exploitable for weeks.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."
Mainnet could accept invalid proofs as Succinct's SP1 discloses high-severity vulnerability
a high-severity reliability vulnerability has been disclosed in Succinct's zero-knowledge proof system SP1. The vulnerability was disclosed on October 11 via GitHub advisory GHSA-p7v2-jjv3-8p8f, affecting SP1 native Rust verifier versions 6.0.0 through 6.8.0, potentially allowing the mainnet Prover Network to accept invalid proofs: a malicious prover could submit a proof of invalid execution, and the network verifiers would still accept it. The cause of the vulnerability is that the verifier only reads the data's label (declared dimension) and does not verify whether the actual number of stored elements equals the product of the dimensions; an attacker could forge the label to make an invalid proof pass. Groth16 and Plonk checks that use fixed-shape wrap proofs are unaffected, and the on-chain Solidity verifier is also secure. Succinct released fix version 6.8.1 on September 24, which has been deployed to mainnet; this version adds deserialization length validation. The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users who run the native Rust verifier themselves and accept untrusted proofs need to upgrade to 6.8.1.
Polygon Releases Bor v2.10.3, Fixing Two Parallel Block Execution Denial-of-Service Vulnerabilities
Polygon Labs has announced the official release of Bor v2.10.3, which fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. Both issues were reported through the Immunefi bug bounty program.In addition, the new version includes multiple security and stability improvements, such as transaction filtering, RPC execution concurrency limits, and pending transaction cleanup. The team stated that the affected versions are Bor v2.10.1 and v2.10.2, where BlockSTM V2 is enabled by default, and that no exploitation of these vulnerabilities has been detected on the mainnet or the Amoy testnet. This upgrade does not involve a hard fork, and nodes can upgrade gradually as needed.
Base Vault Suffers ~$6M Exploit, Still Holds $31.7M in Assets
Odaily reports: Gonçalo Magalhães, Head of Security at Immunefi, stated that an unnamed Base vault suffered an approximately $6 million exploit, while still holding around $31.7 million in assets at the time of the incident. According to a briefing, the attacker used a Safe multisig wallet to add a malicious contract to the vault's lending whitelist, then withdrew 1,783 aBaswstETH and swapped it for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães noted that while whitelisted addresses may appear secure, approved addresses can withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team had publicly claimed responsibility or disclosed remediation measures.
The crypto industry lost approximately $110 million due to hacker attacks in July
According to The Block, latest data from Immunefi shows that the crypto industry lost approximately $110 million due to hacker attacks in July 2026. During the same period, the platform paid researchers $2.32 million for confirmed vulnerability reports, and the number of confirmed and paid bug bounty reports increased by 18% month-over-month.
The number of hacker attacks hit an all-time high, with crypto projects losing approximately $972 million in the first half of 2026.
an Immunefi report shows that in the first half of 2026, crypto projects suffered cumulative losses of approximately $972 million from 207 hacker attacks. The number of attacks reached a record high, but total losses remained under $1 billion and were less than half the scale of losses in the first half of 2025. The report notes that DeFi attack losses have dropped by 74% from their peak of $2.62 billion in 2022, falling to approximately $680.3 million, with the median single-loss amount declining by 75% over the same period. Furthermore, the source of risk is shifting from purely smart contract vulnerabilities towards infrastructure failures, private key leaks, cross-chain configuration errors, and weaknesses in privileged access.
Immunefi CEO warns PHP vulnerability could leave websites exploitable for weeks.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."
Mainnet could accept invalid proofs as Succinct's SP1 discloses high-severity vulnerability
a high-severity reliability vulnerability has been disclosed in Succinct's zero-knowledge proof system SP1. The vulnerability was disclosed on October 11 via GitHub advisory GHSA-p7v2-jjv3-8p8f, affecting SP1 native Rust verifier versions 6.0.0 through 6.8.0, potentially allowing the mainnet Prover Network to accept invalid proofs: a malicious prover could submit a proof of invalid execution, and the network verifiers would still accept it. The cause of the vulnerability is that the verifier only reads the data's label (declared dimension) and does not verify whether the actual number of stored elements equals the product of the dimensions; an attacker could forge the label to make an invalid proof pass. Groth16 and Plonk checks that use fixed-shape wrap proofs are unaffected, and the on-chain Solidity verifier is also secure. Succinct released fix version 6.8.1 on September 24, which has been deployed to mainnet; this version adds deserialization length validation. The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users who run the native Rust verifier themselves and accept untrusted proofs need to upgrade to 6.8.1.
Polygon Releases Bor v2.10.3, Fixing Two Parallel Block Execution Denial-of-Service Vulnerabilities
Polygon Labs has announced the official release of Bor v2.10.3, which fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. Both issues were reported through the Immunefi bug bounty program.In addition, the new version includes multiple security and stability improvements, such as transaction filtering, RPC execution concurrency limits, and pending transaction cleanup. The team stated that the affected versions are Bor v2.10.1 and v2.10.2, where BlockSTM V2 is enabled by default, and that no exploitation of these vulnerabilities has been detected on the mainnet or the Amoy testnet. This upgrade does not involve a hard fork, and nodes can upgrade gradually as needed.
Immunefi: DeFi Attack Losses Down 74% from 2022 Peak, AI Accelerates Security Arms Race
Web3 security company Immunefi's latest "2026 Ecosystem Vulnerability Audit Report" shows that losses from DeFi protocol hacks have fallen 74% from a peak of $2.62 billion in 2022 to approximately $680.3 million in 2025.The report notes that the median loss per individual attack has also significantly decreased, from $6 million in 2022 to $1.5 million in 2025, reflecting an overall improvement in security standards. Meanwhile, the share of bridge exploits in total DeFi losses has dropped sharply from 73% in 2022 to 3% in 2025, and the proportion of flash loan attacks has fallen from 54% to less than 1%.The proportion of risks at the infrastructure level (such as private key leaks and database attacks) also decreased from 30.7% in 2022 to 10.3% in 2025. Immunefi stated that this reflects continuous optimization in oracle design, reentrancy attack protection, and access control standards, making the DeFi ecosystem "generally becoming safer."However, the report also notes that losses slightly rebounded to $680.3 million in 2025, primarily due to increased complexity in multi-chain systems and a few high-severity incidents. At the same time, the number of independent security incidents continues to rise, indicating the attack surface is still expanding. (The Block)
AaveLabs: Updates Bug Bounty Program, Core Aave V3 Maximum Reward Raised to $5 Million
that, according to official sources, AaveLabs has proposed restructuring the Aave DAO bug bounty framework into multiple specific subsystem programs, operating on the Immunefi, Sherlock, and Cantina platforms respectively. Core Aave V3, Core Aave V2, GHO, and non-liquidity protocol infrastructure will be covered by Immunefi; Aave V4 and the Aave App Stack will be covered by Sherlock; and Aave V3 on Aptos will be covered by Cantina.The proposal suggests adjusting the bounty scale for each system. The maximum reward for critical vulnerabilities in Core Aave V3 is $5 million, while the maximum reward for critical vulnerabilities in Aave V4 is $2.5 million. Additionally, the funding source for the Aave V3 bug bounty on Aptos will be transferred from Aave Labs to the Aave DAO. This ARFC proposal has currently been passed.
USDT0 Reveals Security Architecture Details: Implements 3/3 Verification Mechanism and Launches $6 Million Bug Bounty Program
following the Kelp security incident, Tether's asset interoperability protocol USDT0 has disclosed details of its protocol security architecture. It stated that the system currently utilizes a proprietary DVN (Decentralized Verification Network) with message veto authority, and requires 3 independent validators, operating on different codebases, to reach a 3/3 consensus before cross-chain messages can be settled. The current verification nodes include the USDT0 proprietary DVN, LayerZero, and Canary, with future plans to expand to 4/4 and 5/5 verification mechanisms.USDT0 also stated that all multi-signature transactions must undergo multiple reviews by internal teams, external security teams, and auditing firms before signatures are submitted. The relevant contracts have been audited by firms such as Guardian and OpenZeppelin, and a $6 million bug bounty program has been launched on Immunefi.
Related news
Immunefi CEO warns PHP vulnerability could leave websites exploitable for weeks.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."
Mainnet could accept invalid proofs as Succinct's SP1 discloses high-severity vulnerability
a high-severity reliability vulnerability has been disclosed in Succinct's zero-knowledge proof system SP1. The vulnerability was disclosed on October 11 via GitHub advisory GHSA-p7v2-jjv3-8p8f, affecting SP1 native Rust verifier versions 6.0.0 through 6.8.0, potentially allowing the mainnet Prover Network to accept invalid proofs: a malicious prover could submit a proof of invalid execution, and the network verifiers would still accept it. The cause of the vulnerability is that the verifier only reads the data's label (declared dimension) and does not verify whether the actual number of stored elements equals the product of the dimensions; an attacker could forge the label to make an invalid proof pass. Groth16 and Plonk checks that use fixed-shape wrap proofs are unaffected, and the on-chain Solidity verifier is also secure. Succinct released fix version 6.8.1 on September 24, which has been deployed to mainnet; this version adds deserialization length validation. The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users who run the native Rust verifier themselves and accept untrusted proofs need to upgrade to 6.8.1.
Polygon Releases Bor v2.10.3, Fixing Two Parallel Block Execution Denial-of-Service Vulnerabilities
Polygon Labs has announced the official release of Bor v2.10.3, which fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. Both issues were reported through the Immunefi bug bounty program.In addition, the new version includes multiple security and stability improvements, such as transaction filtering, RPC execution concurrency limits, and pending transaction cleanup. The team stated that the affected versions are Bor v2.10.1 and v2.10.2, where BlockSTM V2 is enabled by default, and that no exploitation of these vulnerabilities has been detected on the mainnet or the Amoy testnet. This upgrade does not involve a hard fork, and nodes can upgrade gradually as needed.
Base Vault Suffers ~$6M Exploit, Still Holds $31.7M in Assets
Odaily reports: Gonçalo Magalhães, Head of Security at Immunefi, stated that an unnamed Base vault suffered an approximately $6 million exploit, while still holding around $31.7 million in assets at the time of the incident. According to a briefing, the attacker used a Safe multisig wallet to add a malicious contract to the vault's lending whitelist, then withdrew 1,783 aBaswstETH and swapped it for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães noted that while whitelisted addresses may appear secure, approved addresses can withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team had publicly claimed responsibility or disclosed remediation measures.
The crypto industry lost approximately $110 million due to hacker attacks in July
According to The Block, latest data from Immunefi shows that the crypto industry lost approximately $110 million due to hacker attacks in July 2026. During the same period, the platform paid researchers $2.32 million for confirmed vulnerability reports, and the number of confirmed and paid bug bounty reports increased by 18% month-over-month.
The number of hacker attacks hit an all-time high, with crypto projects losing approximately $972 million in the first half of 2026.
an Immunefi report shows that in the first half of 2026, crypto projects suffered cumulative losses of approximately $972 million from 207 hacker attacks. The number of attacks reached a record high, but total losses remained under $1 billion and were less than half the scale of losses in the first half of 2025. The report notes that DeFi attack losses have dropped by 74% from their peak of $2.62 billion in 2022, falling to approximately $680.3 million, with the median single-loss amount declining by 75% over the same period. Furthermore, the source of risk is shifting from purely smart contract vulnerabilities towards infrastructure failures, private key leaks, cross-chain configuration errors, and weaknesses in privileged access.