ility

The cryptographic security vulnerability of the Indian certificate authority eMudhra affects the Ethereum clients Teku and Besu. Researchers found that the private keys of 8 intermediate certificate authorities under eMudhra could potentially be deduced due to insufficient randomness, allowing attackers to forge certificates and trick unpatched software into trusting malicious services.Teku has released version 26.1.3, and Besu has released version 26.1.2, both of which have removed trust in the relevant certificates from their Docker images. If an attacker performs a man-in-the-middle attack, they could trick some validators into sending block fee rewards to the attacker's address; the risk may be higher under specific configurations using external signers. The Teku team stated that the default configuration of the Ethereum mainnet Teku node is not affected, and no action is required, with no reports of the vulnerability being exploited so far.For operators running Teku or Besu directly on the host without using Docker, simply updating the client may not be sufficient; they also need to manually update Java and its trusted certificate list. Operators still using the no longer maintained Java 26 will need to migrate to Java 25.

Federal Reserve Chairman Waller stated that we will achieve price stability without any excuses or conditions.

Federal Reserve Chairman Waller stated that our duty is to reduce inflation.

The market maintains a pricing of a 90% probability for the Federal Reserve to raise interest rates in December.

Researchers disclosed a zero-click vulnerability in the Telegram sticker feature at a security conference held in Tokyo, demonstrating that an attacker could execute code on iOS devices without any user interaction.However, Telegram disputed the risk assessment of the vulnerability.

Glassnode's latest report indicates that Bitcoin has fallen back below the range of $84,000 to $85,000, a range that has blocked price increases four times this year. The inflow of funds into the U.S. spot Bitcoin ETF has significantly cooled, with a net inflow of only about $67 million in the past two weeks; the major buy orders on Binance's spot order book have also shifted down to the range of $78,000 to $79,000, with a scale of about $42 million.Meanwhile, Bitcoin's one-month realized volatility has dropped to about 25%, returning to the levels seen in the summer of 2023; since August, the realized losses triggered by each round of decline have continued to narrow, indicating that selling pressure has eased.Glassnode believes that Bitcoin is currently in a range-bound state with weak demand and limited selling pressure, as the market is focusing on the Federal Reserve's interest rate decision. If the daily close re-establishes above $85,000, it may serve as an initial signal for further rebounds; if it falls below the average cost of active investors around $77,900, attention should be paid to the cost support for short-term holders near $75,800.

Stable officially announced that the Stable mainnet will be upgraded to v1.9.0 on October 31 at 17:00 (UTC+8), with a block height of 45,091,000.This upgrade mainly includes protocol security reinforcement and network resilience optimization, aiming to enhance the security, reliability, and operational stability of transaction processing and settlement, providing infrastructure support for on-chain payments, exchange settlements, and corporate financial asset management activities.

The Federal Reserve will announce its October interest rate decision at 2 AM Beijing time on the 29th. The market generally expects the federal funds rate target range to remain unchanged at 3.75%--4.00%, with a probability of maintaining the status quo at over 90%. The wording of the statement and whether Chair Waller's press conference will release more hawkish signals, as well as how this will affect the market's significantly priced probability of a 25 basis point rate hike in December, have become the focus of attention.Goldman Sachs, Citigroup, and Credit Agricole all expect a pause in October and a 25 basis point hike in December. Goldman Sachs stated that if rate hikes continue every other meeting through 2027, a hike in March may be considered, but the baseline forecast does not expect a hike in March. Citigroup mentioned that if the stock market continues to weaken, leading to a sharp tightening of financial conditions, the likelihood of a shift to rate cuts will significantly increase. Moody's believes there will not and should not be another rate hike this week. Nomura Securities expects no change in October and stated that while the Federal Reserve guides expectations for a pause, it retains flexibility for a rate hike in December.TD Securities expects no change in October and anticipates two more hikes in December and March. Huatai Securities expects no change in October, with two hawkish voters possibly casting dissenting votes, with the baseline scenario being one rate hike in December this year and two hikes next year. Morgan Stanley expects a 25 basis point hike in both December and March next year. Bank of New York Mellon expects rates to peak slightly above 4.5%. Bank of America believes there is ample reason to raise rates in October; if they remain unchanged, they will only retain one option for a future hike.

According to Catcher Predict monitoring, in the predicted market Polymarket for the event "Milwaukee Brewers vs. Tampa Bay Rays," the option "Tampa Bay Rays" in the sub-market "First 5 Innings Spread -1.5" experienced a drastic fluctuation in winning probability, dropping from 27.5% an hour ago to the current 12% (a fluctuation of 15.5%). Please note the impact of relevant breaking news.

According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that had been used in real attacks.Malicious servers can present users with forged transactions and induce them to sign transactions that pay the attacker's address when users attempt to accelerate transactions with a replacement fee (RBF); attackers do not need to obtain the user's private key. Electrum stated that it has received two related reports, one of which involved a user losing Bitcoin after increasing the transaction fee, and advised users to update to version 4.8.3.

Bitcoin security expert Jameson Lopp stated that cyber attacks are growing along an "exponential" path. He pointed out that the number of vulnerabilities discovered in the past two and a half months has increased exponentially, with attackers being the first to adopt unreviewed AI models, and security researchers "failing to get adequate rest."Lopp explained that Bitcoin Core has adjusted its security policies because AI can discover vulnerabilities through simple prompts; security measures need to shift from annual audits to real-time defenses and be embedded in the development process. He also analyzed a PHP remote code execution vulnerability, believing the actual impact to be less than expected.Additionally, Lopp mentioned that Google's estimate of 500,000 quantum bits involves the difference between physical quantum bits and logical quantum bits; if the quantum threat time window is less than ten years, the industry will be at a disadvantage. Currently, there are only a few hundred available quantum bits, and quantum upgrades will take years due to Taproot, consensus rules, and untested cryptography. About 30% of addresses have exposed public keys, and attackers will prioritize targeting these addresses; unpatchable hardware issues and "wrench attacks" have exceeded 700 cases.

According to Initia monitoring, a security fix has been drafted for the vulnerability discovered on October 23, and audits are currently being conducted with security partners.After the audit is completed, Initia will announce a specific plan detailing how to restore support for the affected assets and orderly restart the Initia L1 and Rollup networks. This process is expected to be completed in the coming days.

According to CoinDesk, a large number of AI-assisted vulnerability reports have flooded in, prompting the Solana validator client Firedancer team to require researchers to permanently destroy 1 SOL (approximately $100) for each submitted vulnerability report to curb spam reports. This fee is non-refundable, even if the report is invalid, out of scope, or a duplicate; reports that do not destroy SOL are ineligible for rewards.The $1 million audit competition from April 9 to May 9 attracted 162 researchers who submitted 809 reports, resulting in 127 unique security findings, with nearly half of the valid submissions being duplicates. Jump Crypto believes that almost all submissions involved AI agents in the discovery or writing process, with pending reports once piling up to 299.Meanwhile, Jump has raised the reward standards, with eligible findings able to receive double the standard bounty before November 20, and specific vulnerabilities for Alpenglow being three times, with critical findings up to $300,000.

According to CoinDesk, Ethereum developers have fixed a vulnerability in the Glamsterdam upgrade that could allow operators to withdraw ETH intended for new validators from the staking service. The fix changed the handling rules for validator deposits and was merged on Monday, after developers had rejected the modification a week earlier.Researcher avsetsin discovered that if an operator first registers as a builder with a specific public key, and the staking service subsequently deposits ETH using the same key to activate the validator, the draft rules would credit both deposits to the builder. Avsetsin stated that this is a conditional code discovery and not a confirmed real-time exploit; existing checks can prevent the attack, and there are currently no reports of losses. The new rules treat deposits as sorted by withdrawal receipts, ensuring that validator deposits still belong to the validators.Glamsterdam has been running on the Sepolia testnet, but the launch on the Hoodi testnet has been delayed, with a new date to be determined before the mainnet launch.

According to The Block, BlackRock Financial Management, BlackRock Japan, and Japan's financial group SBI Holdings, along with Startale Group, have signed a memorandum of understanding to explore connecting tokenized money market funds with the yen stablecoin JPYSC, and to study the related technological infrastructure, business models, distribution channels, and regulatory requirements.The four companies stated that the collaboration aims to promote interoperability between tokenized assets and stablecoins, and to open up cooperation opportunities for financial institutions and businesses in Japan and internationally. The collaboration is still in the exploratory stage, and a specific implementation timeline has not yet been announced.BlackRock launched the tokenized fund BUIDL in 2024, managing approximately $2.17 billion in assets at the time of the report. SBI Holdings will launch JPYSC with Startale in June 2026, issued by SBI Shinsei Trust Bank, with SBI VC Trade responsible for distribution.

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

The People's Bank of China Open Market Operations Office announced the establishment of a non-bank large redemption swap facility in the bond market, referred to as BNSF. The announcement stated that this move aims to implement a scientifically sound and robust monetary policy system and a comprehensive macro-prudential management system to maintain stability in the bond market. The relevant document is the People's Bank of China Open Market Operations Announcement [2026] No. 12.According to the announcement, in specific scenarios where asset management institutions face systemic liquidity risks and the bond market experiences systemic pressure, support will be provided to bank wealth management subsidiaries, public fund managers, or corresponding parent banks, securities parent companies, etc., to borrow central bank bills from the People's Bank of China for market repurchase financing, in order to purchase eligible bonds or product shares of public products that are being redeemed by their own company or asset management subsidiaries, and to pledge to the People's Bank of China. Participating institutions must continuously meet the requirements of prudent management in the financial market and maintain market discipline.