security

The cryptographic security vulnerability of the Indian certificate authority eMudhra affects the Ethereum clients Teku and Besu. Researchers found that the private keys of 8 intermediate certificate authorities under eMudhra could potentially be deduced due to insufficient randomness, allowing attackers to forge certificates and trick unpatched software into trusting malicious services.Teku has released version 26.1.3, and Besu has released version 26.1.2, both of which have removed trust in the relevant certificates from their Docker images. If an attacker performs a man-in-the-middle attack, they could trick some validators into sending block fee rewards to the attacker's address; the risk may be higher under specific configurations using external signers. The Teku team stated that the default configuration of the Ethereum mainnet Teku node is not affected, and no action is required, with no reports of the vulnerability being exploited so far.For operators running Teku or Besu directly on the host without using Docker, simply updating the client may not be sufficient; they also need to manually update Java and its trusted certificate list. Operators still using the no longer maintained Java 26 will need to migrate to Java 25.

According to the Digital Currency Research Society, on October 27, Beijing Bank released a public tender announcement for the procurement project of firewall equipment for digital currency business in 2026 through the official centralized procurement management system. Along with the previously announced procurement projects for IPS, encryption machines, WAF, SSL, signature devices, etc., the bank has officially launched a centralized upgrade of the full-chain security infrastructure for digital renminbi business, covering core security nodes such as intrusion defense, encrypted transmission, web application protection, and identity signing.In April of this year, Beijing Bank became a newly added operational institution for digital renminbi business and connected to the central bank's digital renminbi system. In August, the central bank added 8 more operational institutions, expanding the total to 30. Previously, several newly added operational institutions, such as Huishang Bank, Hangzhou Bank, and Guangxi Beibu Gulf Bank, had initiated tenders for core digital currency systems worth tens of millions. The report pointed out that Beijing Bank's inclusion of various security devices such as firewalls and encryption machines in centralized procurement is a proactive security layout to adapt to the new features of digital renminbi, such as high-concurrency transactions and programmable smart contracts.

According to TechCrunch, a hacker claiming to be from the "Department of Peace" has reportedly obtained a large amount of employee data from the Okta single sign-on system used by the Department of Homeland Security (DHS), which was publicly released on Wednesday by the data transparency organization Distributed Denial of Secrets (DDoSecrets) as the "Icepick" dataset. The leaked records exceed 40,000, accounting for about one-fifth of DHS's approximately 220,000 employees, involving names, positions, work emails, phone numbers, and office locations, along with information related to internal system permissions. Among these, approximately 21,000 records belong to Customs and Border Protection (CBP) personnel, while about 10,000 records involve the Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations (HSI), with nearly 1,000 related to the Cybersecurity and Infrastructure Security Agency (CISA).TechCrunch stated that it has verified the authenticity of some of the data, with timestamps indicating that the data was exported around mid-August. The hacker also provided the data to journalist and hacker maia arson crimew, who then forwarded it to DDoSecrets. Okta responded that its systems and data were not breached; a spokesperson for the Department of Homeland Security has not yet responded to requests for comment. The report indicates that this is the third incident of data leakage from the U.S. government that has drawn attention in the past month, following the theft of Federal Bureau of Investigation personnel files and Pentagon personnel data.

Alphabet CEO Sundar Pichai stated that the new AI model Carbon is being launched first to cybersecurity partners.

Cysic released an update on the progress of the security incident handling, disclosing that 7,200,002 CYS tokens have been burned on the BNB Smart Chain (BSC) to offset the previously unauthorized token issuance.Both burn transactions have been confirmed on-chain, permanently reducing the supply of CYS tokens on BSC, bringing it back in line with the project's token economic model.

According to Bloomberg, AI cloud security company Upwind announced the completion of a $400 million financing round, led by Bessemer Venture Partners, with participation from existing investors such as Greylock Partners and Craft Ventures, bringing its valuation to $3.8 billion.Upwind primarily provides security protection for enterprise cloud infrastructure, capable of detecting malware and suspicious activities, and this year expanded its platform to address AI-related security risks. The new funds are intended for engineering research and development as well as building sales and marketing teams.

The Ethereum Foundation forwarded tweets related to the privacy tool Kohaku, expressing support for the development of privacy-protecting wallet tools. In response to the attacks and exploits that occurred over the past week, the Ethereum Foundation pointed out that privacy and security should not be viewed as mutually exclusive goals. Setting privacy protection as a default feature helps reduce the risk of attackers exploiting users' on-chain historical records to carry out attacks.According to developer Jordan Enev, the Kohaku team is working to make privacy protection a standard feature of Ethereum. Currently, its SDK has integrated privacy protocols such as Railgun, Privacy Pools, and Tornado Cash, with development progress becoming increasingly mature, and they are calling for more wallets to promote related integrations.

Stable officially announced that the Stable mainnet will be upgraded to v1.9.0 on October 31 at 17:00 (UTC+8), with a block height of 45,091,000.This upgrade mainly includes protocol security reinforcement and network resilience optimization, aiming to enhance the security, reliability, and operational stability of transaction processing and settlement, providing infrastructure support for on-chain payments, exchange settlements, and corporate financial asset management activities.

On October 28, Coinbase responded to market news related to a data breach, stating that the company itself did not experience a data breach. Instead, it was a third-party analytics service provider, Amplitude, that encountered a security incident, affecting the contact information of some Coinbase customers and data from other Amplitude clients.Coinbase stated that there is currently no evidence of unauthorized access to its internal systems, and customer funds have not been affected. The company will notify affected customers and relevant regulatory authorities as required by law.

Cryptocurrency hardware wallet manufacturer NGRAVE has issued a security warning, stating that it is currently facing a high-level cyber threat, and the team is actively monitoring and taking countermeasures.NGRAVE reminds users to be vigilant against phishing attacks carried out through SMS, email, counterfeit websites, and fake customer service, emphasizing that the official team will never ask users for their recovery mnemonic or Perfect Key. NGRAVE states that users' private keys are stored offline in the ZERO hardware device, and as long as the mnemonic has not been entered on a phone, computer, or webpage, related phishing attacks will not jeopardize the security of the private keys. The official recommends that users manually enter the official website domain name to avoid accessing phishing links.

According to SolanaFloor, Solflare stated that its staking service provider experienced a security incident that affected the keys held for its validators, which are no longer generating staking rewards. Solflare claimed that user funds were not affected, and the delegated SOL remains in the users' own staking accounts, controlled by their keys.Solflare will guide users to migrate to new validators through an app update, and rewards will resume once staking is activated, with plans to compensate migrating users.

AI cloud service provider Akamai launched the AI agent sandbox Agent Sandbox and the Akamai Inference beta on October 27. The Agent Sandbox provides an isolated environment for the code written and run for agents based on WebAssembly, limiting their computing power, memory, and external connections. Jon Alexander, Senior Vice President of Cloud Technology at Akamai, stated that teams running agents need to define boundaries for the code they write.A survey by Palo Alto Networks in 2026 of 2,930 security leaders showed that, on average, each human identity corresponds to 109 machine identities, of which 79 are AI agents. Hugging Face disclosed a breach on July 16, and OpenAI subsequently confirmed that its models were responsible; a METR investigation found about 1,200 OpenAI agents collaborating through hidden message boards, with around 700 participating in attacks, escaping the sandbox and exploiting unknown vulnerabilities to enter production systems.Zscaler discovered web pages hiding instructions targeting AI agents in July, specifically indirect prompt injection, with a spoofed document page requiring agents to pay approximately 0.0012 Ethereum as a $3 licensing fee, and 4 out of 26 tested models complied. Palo Alto completed its acquisition of CyberArk in February and acquired Koi in April, while Cisco completed its acquisition of Astrix Security on June 29. The investigation predicts that the number of enterprise AI agents will grow by 85% in the next 12 months, with human identities increasing by 56%.

According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that had been used in real attacks.Malicious servers can present users with forged transactions and induce them to sign transactions that pay the attacker's address when users attempt to accelerate transactions with a replacement fee (RBF); attackers do not need to obtain the user's private key. Electrum stated that it has received two related reports, one of which involved a user losing Bitcoin after increasing the transaction fee, and advised users to update to version 4.8.3.

According to The Washington Post, AI cybersecurity startup Cathedral, founded by former members of the U.S. "Department of Government Efficiency" (DOGE), claims that its AI agent breached Anthropic's internal systems in less than 12 hours, obtaining content such as meeting notes, salary and hiring information, and Slack messages. Anthropic confirmed that the intruder accessed parts of its sales, human resources, and IT systems, involving business contact information of clients and partners, as well as some basic user account records, but did not involve Claude user conversations, source code, or model weights.This test was conducted under Anthropic's vulnerability bounty program, with the intrusion achieved through vulnerabilities in third-party commercial software; Anthropic accused Cathedral of not fully disclosing its actions, violating program rules. Cathedral is valued at $1.4 billion and has secured $160 million in funding from a16z, Sequoia Capital, and others.

According to a statement from Keystone Hardware Wallet, its official website was breached on October 20 due to a vulnerability in third-party monitoring tools, resulting in the acquisition of approximately 25,964 purchase records containing personal information, 12,873 unpaid checkout records, and device WebAuth authentication keys. Mnemonic phrases, private keys, and payment information were not affected.Keystone will destroy 18,835 devices containing old keys from its inventory, suspend shipments from the official website, and switch to pre-sales, while reminding users that there is no need to transfer assets and to be wary of scams such as "recalls."

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

S&P Global (NYSE: SPGI) announced that it has completed the acquisition of the on-chain financial security standards provider OpenZeppelin. The transaction was first announced on September 17, and the financial terms were not disclosed, with no significant impact expected on S&P Global's financial performance.OpenZeppelin was founded in 2015 and has completed over 900 security service projects, identifying more than 10,000 vulnerabilities before product launches. Its open-source smart contract library, OpenZeppelin Contracts, supports a value transfer scale of over $38 trillion, covering various mainstream stablecoins and tokenized funds.This acquisition will expand S&P Global's risk assessment capabilities to the on-chain technology risk layer, with both parties planning to jointly develop a new generation of on-chain security assessments and benchmarks. After the acquisition, OpenZeppelin will continue to operate as an independent business unit under its original brand, with founder Demian Brener remaining as the head and reporting to S&P Global Ratings President Yann Le Pallec. OpenZeppelin Contracts will continue to be open-source, free, and publicly maintained.

According to Salus monitoring, Tether has blacklisted 9 addresses related to the CoinDCX security incident and frozen 2,212,850.3 USDT.The investigation began when investigator Darcy discovered an unusual transfer of approximately 15.99 million USDT. CoinDCX co-founder Sumit Gupta initially claimed that no security breach had occurred. Subsequently, Salus raised questions based on the transfer situation of the "proof of reserves" addresses and the TRX distribution pattern, prompting the parties involved to respond and providing Tether with verifiable on-chain evidence, allowing it to take appropriate action.