News linked to both this project and an event.
According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."
a high-severity reliability vulnerability has been disclosed in Succinct's zero-knowledge proof system SP1. The vulnerability was disclosed on October 11 via GitHub advisory GHSA-p7v2-jjv3-8p8f, affecting SP1 native Rust verifier versions 6.0.0 through 6.8.0, potentially allowing the mainnet Prover Network to accept invalid proofs: a malicious prover could submit a proof of invalid execution, and the network verifiers would still accept it. The cause of the vulnerability is that the verifier only reads the data's label (declared dimension) and does not verify whether the actual number of stored elements equals the product of the dimensions; an attacker could forge the label to make an invalid proof pass. Groth16 and Plonk checks that use fixed-shape wrap proofs are unaffected, and the on-chain Solidity verifier is also secure. Succinct released fix version 6.8.1 on September 24, which has been deployed to mainnet; this version adds deserialization length validation. The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users who run the native Rust verifier themselves and accept untrusted proofs need to upgrade to 6.8.1.
Polygon Labs has announced the official release of Bor v2.10.3, which fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution. Both issues were reported through the Immunefi bug bounty program.In addition, the new version includes multiple security and stability improvements, such as transaction filtering, RPC execution concurrency limits, and pending transaction cleanup. The team stated that the affected versions are Bor v2.10.1 and v2.10.2, where BlockSTM V2 is enabled by default, and that no exploitation of these vulnerabilities has been detected on the mainnet or the Amoy testnet. This upgrade does not involve a hard fork, and nodes can upgrade gradually as needed.
Web3 security company Immunefi's latest "2026 Ecosystem Vulnerability Audit Report" shows that losses from DeFi protocol hacks have fallen 74% from a peak of $2.62 billion in 2022 to approximately $680.3 million in 2025.The report notes that the median loss per individual attack has also significantly decreased, from $6 million in 2022 to $1.5 million in 2025, reflecting an overall improvement in security standards. Meanwhile, the share of bridge exploits in total DeFi losses has dropped sharply from 73% in 2022 to 3% in 2025, and the proportion of flash loan attacks has fallen from 54% to less than 1%.The proportion of risks at the infrastructure level (such as private key leaks and database attacks) also decreased from 30.7% in 2022 to 10.3% in 2025. Immunefi stated that this reflects continuous optimization in oracle design, reentrancy attack protection, and access control standards, making the DeFi ecosystem "generally becoming safer."However, the report also notes that losses slightly rebounded to $680.3 million in 2025, primarily due to increased complexity in multi-chain systems and a few high-severity incidents. At the same time, the number of independent security incidents continues to rise, indicating the attack surface is still expanding. (The Block)
that, according to official sources, AaveLabs has proposed restructuring the Aave DAO bug bounty framework into multiple specific subsystem programs, operating on the Immunefi, Sherlock, and Cantina platforms respectively. Core Aave V3, Core Aave V2, GHO, and non-liquidity protocol infrastructure will be covered by Immunefi; Aave V4 and the Aave App Stack will be covered by Sherlock; and Aave V3 on Aptos will be covered by Cantina.The proposal suggests adjusting the bounty scale for each system. The maximum reward for critical vulnerabilities in Core Aave V3 is $5 million, while the maximum reward for critical vulnerabilities in Aave V4 is $2.5 million. Additionally, the funding source for the Aave V3 bug bounty on Aptos will be transferred from Aave Labs to the Aave DAO. This ARFC proposal has currently been passed.
following the Kelp security incident, Tether's asset interoperability protocol USDT0 has disclosed details of its protocol security architecture. It stated that the system currently utilizes a proprietary DVN (Decentralized Verification Network) with message veto authority, and requires 3 independent validators, operating on different codebases, to reach a 3/3 consensus before cross-chain messages can be settled. The current verification nodes include the USDT0 proprietary DVN, LayerZero, and Canary, with future plans to expand to 4/4 and 5/5 verification mechanisms.USDT0 also stated that all multi-signature transactions must undergo multiple reviews by internal teams, external security teams, and auditing firms before signatures are submitted. The relevant contracts have been audited by firms such as Guardian and OpenZeppelin, and a $6 million bug bounty program has been launched on Immunefi.