access

Allium CEO and Co-founder Ethan Chan stated that Allium discovered a security incident on October 25, involving unauthorized access to some of its systems. Allium immediately took measures to limit access and protect the systems, has directly notified affected customers, and continues to provide updates and support.Allium has engaged an independent cybersecurity firm to assist with the response and investigation, focusing on strengthening security controls such as authentication and monitoring. After the investigation is completed, it plans to share a summary of the findings and response measures. Allium stated that its core platform, including Allium App, Explorer, and Explorer APIs, has been restored, although some features remain temporarily unavailable during the recovery period, with the latest availability and updates published on the status page. Ethan Chan expressed apologies for the disruption caused by the incident and stated that maintaining customer trust requires clear communication and ongoing follow-up.

According to market news, FoundationHQ stated that attackers sent over 23,000 phishing emails after exploiting leaked API keys and accessing customer data, including addresses and phone numbers.

According to official news, the cryptocurrency company Ripple announced a partnership with Coinbase to expand the access of RLUSD in the U.S. market.RLUSD will be launched on Coinbase Prime, Coinbase Exchange, and the retail application, supporting 1:1 conversion with U.S. dollars and dollar-pegged stablecoins, and plans to support collateral features on Coinbase Global Exchange.

IBM (IBM.N) and NVIDIA (NVDA.O) will bind AI entity identity with runtime access control.

According to Bitcoin News, researchers claim that Tailscale has a serious vulnerability, where users with approved access can exploit its built-in SSH to gain root access to devices, and the attack may spread to other devices on the network.Users running nodes with Tailscale should disable Tailscale SSH and update promptly after the patch is released. Tailscale has not yet responded.

OpenAI announced that to prevent AI models from breaching security limits, it has required the most advanced models to be trained in environments where direct access to the live internet is not possible. Previously, an internal research model had gained limited internet access through a network configuration vulnerability, prompting the company to suspend training.After security rectifications, OpenAI resumed training on October 1, but still restricts internet access.

Tether-supported Utexo has now opened early access to Utexo Mint, allowing professional operators to test the cross-chain version of USDT on the Bitcoin Signet (Bitcoin testnet), with the official launch date set for November 28.In the Bitcoin Signet sandbox environment, operators can test minting, privacy transfers, and redemption functions. Utexo will also provide related tools for managing cross-network liquidity and facilitating exchanges between fiat currency and the Utexo cross-chain version of USDT. According to previous news, Tether-supported Utexo plans to issue USDT on the Bitcoin network this month, supporting privacy transfers and direct exchanges with BTC.

Market news reports that SpaceX is negotiating to connect 80,000 cellular sites to build a new network.

The Bitcoin ecosystem USDT issuer Utexo announced the early access to Utexo Mint, aimed at professional operators ready to support and provide USDT on Bitcoin, with the public launch scheduled for November 28. Utexo stated that existing partners are preparing for the launch, and it is currently open for access to exchanges, wallets, market makers, OTC desks, trading companies, and other professional operators interested in supporting USDT on Bitcoin.Utexo Mint is a dedicated platform for verified operators to mint and redeem USDT on Bitcoin. In the sandbox environment, operators can test the operation of USDT based on RGB, including minting, confidential transfers, and redemptions, to validate transaction processes and complete integration before the launch. Utexo will also provide tools for managing USDT liquidity across supported networks and for fiat to USDT exchanges. Utexo Mint is not owned or operated by Tether, and USDT on Bitcoin is supported by USDT through Tether's USDT0 protocol.USDT was first launched on Bitcoin in 2014, and this return will bring stablecoin liquidity to the ecosystem and expand scenarios such as trading and BTC collateralized lending. Utexo stated that USDT on Bitcoin is launched by Utexo rather than Tether, designed with privacy features, and USDT on RGB avoids address reuse. In terms of compliance, Utexo claims it will monitor all sourced USDT, check AML scores, and monitor RGB-side risks, while collaborating with Crystal Intelligence for AML efforts. The launch will occur in two phases: on November 28, USDT will be publicly available on the Bitcoin network through RGB, accessible via partner wallets and exchanges; the second phase is planned for the first quarter of 2027 to expand USDT to the Lightning Network for payments.

According to Cointelegraph, Coinbase's European policy director Katie Harries wrote that the proposed cryptocurrency asset regulatory rules by the UK's Financial Conduct Authority (FCA) may require regulated platforms to execute customer orders only on trading venues authorized by the FCA, thereby restricting users' access to decentralized finance (DeFi) protocols through compliant platforms.Since decentralized protocols typically do not have entities that can apply for regulatory authorization, the relevant rules may lead to regulated platforms being unable to provide DeFi access services, effectively creating a ban. The related cryptocurrency regulatory system is expected to be implemented starting October 25, 2027.

Several large banks in the United States have discovered unauthorized AI agents accessing customer accounts, with some agents attempting to perform independent operations. Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, and other banks are racing to curb the risks posed by these agents.Morgan Stanley has begun to block third-party agents from accessing accounts, while JPMorgan Chase, Bank of America, and Citigroup are also restricting access.

According to an official announcement from Railway, the cloud deployment platform Railway detected abnormal activity in the system that stores customer environment variables. Preliminary investigations indicate that an unauthorized third party may have accessed encrypted environment variables and obtained decrypted content from some of those variables, which may include API keys, database credentials, and image repository credentials.Railway believes this incident is part of a recent series of attacks targeting platform companies, aimed at infiltrating AI inference service providers, and has notified upstream service providers to proactively revoke keys. Currently, Railway has suspended all deployments and recommends that all users immediately rotate the environment variables, API keys, and private repository credentials stored on the platform, and check relevant service logs.

According to market news, the ransomware/disclosure organization FulcrumSec publicly claimed to have continuously stolen about 10.6 TB of data from PingCAP's managed database service TiDB Cloud and released about 200 GB of the first phase sample.PingCAP issued a statement acknowledging that "some internal operational data" was accessed without authorization, but emphasized that it does not involve product vulnerabilities and will not affect the security of customer databases and business data. Companies such as Bitget and Baidu have collaborated with this data company.

NetEase UU Remote has publicly released a third-party app integration protocol on GitHub, allowing developers to add a remote control entry to their iOS and Android applications. For example, to add a "Connect to Work Computer" button for an AI programming assistant, when users click it for the first time, they will be redirected to UU Remote to select and bind their Windows or Mac. After that, they can directly initiate remote control with another click, without having to repeatedly search for the device.Remote control supports full screen and picture-in-picture modes, allowing users to operate their computers through a floating window while using other apps on their phones. After leaving home, users can check if Claude Code or Codex on their home Mac has completed tasks, and they can directly invoke remote control from third-party applications. Developers can obtain connection results in windowed mode to determine if the device is offline or if the connection has failed.What has been opened is a cross-app invocation protocol, not the source code of the remote control engine, nor an interface for AI to automatically operate computers. Third-party applications still need to call the installed UU Remote client, and the actual remote control is completed by NetEase. Currently, the controlled devices only support Windows and macOS, and the mobile side must use UU Remote version 4.42.0 or later.

On October 15, Anthropic announced that it has begun providing employee-like access to a team from the nonprofit organization METR for the purpose of evaluating its models and safety practices. The company stated that last month it committed to strengthening independent third-party evaluations and signed the White House "Superintelligence Agreement," which includes a commitment to collaborate with independent external auditors or evaluators. Over the past year, Anthropic has worked with METR to review several risk reports, and METR will publish its risk assessment results.Anthropic has equipped six METR employees with company hardware, office space, and access to internal tools and systems roughly equivalent to those of its own risk assessment team. With a few explicitly defined categories such as client data, attorney-client privileged information, and model architecture information, employees are encouraged to share information as they would with colleagues working on alignment risk. METR may publish analyses of risk levels, events, or practices, which Anthropic cannot veto, but can request the removal of pre-defined narrow category information; METR may publicly state the circumstances of redaction and indicate whether it believes the redaction is reasonable without disclosing the content that was redacted. This arrangement is limited to small teams working under enforceable agreements, and other METR employees are isolated from working with this team.Anthropic is also collaborating with SecureBio and Accenture on assessments and is in early discussions with other organizations, including Hugging Face. SecureBio is reviewing the chemical and biological weapons section of the August 2026 risk report, having previously completed and published a pilot review of the previous risk report.

Insiders revealed that the order to restrict Ukraine's access to the Star Shield system came from within the White House.

OpenCode announces a limited-time free access to DeepSeek V4.1 Flash. Users can select DeepSeek V4.1 Flash Free from the model list, with no charges for input and output tokens. The free version has a context limit of 200,000 tokens, while the paid version has a limit of 1,000,000 tokens, which is an 80% reduction, making it easier to encounter context limits when processing large code repositories or running a Coding Agent for extended periods.DeepSeek V4.1 Flash was integrated into OpenCode on September 10. On October 12, OpenCode will increase the usage quota for V4.1 Flash in the $10 Go package to a value of $80, and subsequently add an independent free tier. The official documentation confirms that this free access has a time limit, but the end date has not yet been announced, and states that the free tier service provider adheres to a zero data retention policy and will not use user content for model training.

According to the official blog of Avalanche, the Dubai International Financial Centre (DIFC) court has announced the adoption of Avalanche blockchain technology to provide globally verifiable digital authenticity certificates for its court orders and hearing records.The system binds encrypted hashes of documents to unique NFT certificates on the Avalanche C-Chain, allowing any institution to verify document authenticity within seconds without contacting the court, while the document content and confidential information are not stored on-chain, maintaining complete privacy.Avalanche's settlement speed is less than one second, and records are non-reversible. In addition, the Telecommunications and Digital Government Regulatory Authority (TDRA) of the UAE is also collaborating with Ava Labs to integrate Avalanche technology into the Digital Vault blockchain layer of the national digital identity platform UAE PASS, which serves over 12.5 million users, further promoting the construction of a credible verification system for government documents on-chain in the UAE.

According to Beating reports, Tencent announced a deep integration of WeChat Work and WorkBuddy. In the new version of WeChat Work 5.0.12, WorkBuddy enters the corporate address book, allowing employees to chat with it, assign tasks, or pull it into work groups just like they would with colleagues, for summarizing group chats, organizing meeting to-dos, drafting emails, and returning results directly upon completion.WorkBuddy 5.8.0 supports logging in with a WeChat Work account. Within the scope of corporate authorization, it can access 10 office capabilities including chat messages, documents, meetings, and WeChat Cloud. Employees do not need to repeatedly upload materials, as they can handle tasks by combining previous discussions and project files, with results saved to WeChat Cloud with one click. The WorkBuddy bot can also connect to WeChat Work's built-in AI assistant "DaYuan" to collaboratively handle more complex tasks.Administrators can assign WorkBuddy accounts, set data access permissions, and through the "Observability Center," which will begin public testing on October 13, view the points consumption of various departments, model usage, task duration, and track which specific execution steps encountered issues. The new interoperability features are open to certified WeChat Work enterprises and offer a limited free trial quota.