xpos

Researchers disclosed a zero-click vulnerability in the Telegram sticker feature at a security conference held in Tokyo, demonstrating that an attacker could execute code on iOS devices without any user interaction.However, Telegram disputed the risk assessment of the vulnerability.

Goldman Sachs' latest research shows that over the past three weeks, semiconductor stock exposure has been able to explain about 54% of the return performance differences between different asset classes, while oil price exposure accounts for only 2%. As the influence of AI trading continues to expand, technology stocks are becoming an important factor driving global market risk appetite and asset performance differentiation.Goldman Sachs pointed out that recent investor risk appetite has been highly synchronized with the relative performance of large technology stocks. Last week, concerns about AI investment returns, financing costs, and capital expenditures intensified, leading to a sell-off in technology stocks and corporate bonds, with Goldman Sachs' risk appetite indicator falling to its lowest level since April 2025. The South Korean stock market has become a typical case of this impact, with the KOSPI rising 3.1% on Tuesday, and SK Hynix and Samsung Electronics increasing by 5.2% and 4.2%, respectively.Due to the high weight of semiconductor stocks in the Korea Composite Stock Price Index, changes in global AI investment expectations directly affect local market performance. Goldman Sachs emphasized that the 54% and 2% figures reflect a statistical relationship within a specific time window and do not imply that AI factors long-term determine global market fluctuations; the impact of high oil prices on inflation, monetary policy, and asset pricing cannot be ignored. Major technology companies such as Microsoft, Google, and Amazon are about to announce their earnings reports, and the market will focus on whether AI demand can continue to grow and whether massive capital expenditures can be converted into actual profits.

Cryptocurrency hardware wallet manufacturer Keystone disclosed that its website experienced a security breach, allowing unauthorized third parties to access customer names, contact information, shipping addresses, and order details. Keystone stated that it has blocked access, fixed the vulnerability, and launched an investigation, while also notifying affected customers, but did not disclose the number of individuals impacted.Security researcher Taylor Monahan warned that the leaked shipping addresses could expose customers to targeted scams and personal attacks. Keystone stated in 2023 that it would shorten the retention period for customer data to 180 days, but some customers reported receiving breach notifications more than two years after purchasing their devices.

Succinct's zero-knowledge proof system SP1 has revealed a high-severity reliability vulnerability. This vulnerability was disclosed through GitHub announcement GHSA-p7v2-jjv3-8p8f, affecting SP1's native Rust verifier versions 6.0 to 6.8.0, allowing the mainnet Prover Network to potentially accept invalid proofs: malicious provers can submit proofs of invalid executions, and the network verifiers will still accept them.The cause of the vulnerability is that the verifier only reads the labels of the data (declaration dimensions) without verifying whether the actual number of stored elements equals the product of the dimensions, allowing attackers to forge labels to pass invalid proofs. The Groth16 and Plonk checks using fixed-shape wrap proofs are unaffected, and the on-chain Solidity checker is also safe. Succinct released the fixed version 6.8.1 on September 24, which has been deployed to the mainnet; this version adds deserialization length checks.The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users running the native Rust verifier and accepting untrusted provers need to upgrade to 6.8.1.

The tokenized Pre-IPO platform OpenStocks has launched on the BNB Chain, offering tokenized economic exposure products for four private companies, including Anthropic (oANTHROPIC), Figure AI (oFIGUREAI), Neuralink (oNEURALINK), and Anduril (oANDURIL). These products are BEP-20 tokens on the BNB Chain mainnet, supporting 24/7 trading with no minimum amount restrictions. Transactions settle on-chain within seconds, using a self-custody model where users trade by connecting their own BNB Chain wallets, and OpenStocks does not act as a custodian.The platform clearly states that these tokens provide only economic exposure to the private stock prices of the companies and do not represent equity, granting holders no ownership, voting rights, dividend rights, or information rights, and OpenStocks has no affiliation with the aforementioned companies. The token prices are set by the on-chain DEX liquidity pools, with PancakeSwap Infinity as the primary trading venue. Tokens are traded against USDT, and the price users pay depends on the quotes in the pool at the time of transaction. The trading page simultaneously displays the latest on-chain token price and the reference price of the underlying company, as well as the implied company valuation based on that price.The platform is not open to individuals within the United States, U.S. citizens, and other ineligible persons, with Singapore being a prohibited jurisdiction. OpenStocks states that it is not a broker-dealer, investment advisor, exchange, transfer agent, or custodian, does not provide investment advice, and has no affiliation with the companies involved.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

According to the Science and Technology Innovation Board Daily, during the sixth RISC-V China Summit, ZTE Microelectronics' subsidiary, Lirui Micro, unveiled the high-performance RISC-V CPU chip, Mount Everest 200, designed for intelligent computing centers. Lirui Micro stated that Mount Everest 200 is the industry's first RISC-V CPU chip aimed at intelligent computing center scenarios, with detailed product specifications to be officially released by the end of this year.Mount Everest 200 focuses on three major scenarios: Agent clusters, inference super-node Hosts, and enterprise-level intelligent computing hybrid inference. It natively supports RISC-V AI instruction acceleration and is optimized for KV Cache and long-context large model inference. This chip integrates various acceleration engines, including Matrix, Vector, compression, and encryption, supports high-speed interconnect interfaces such as DDR5, PCIe, and CXL, and can adapt to RISC-V native AI and GPU acceleration card MoE large model hybrid inference solutions.

Matt Cole, the CEO of Bitcoin Treasury Company Strive, stated on the X platform that the long-term trend of currency depreciation will continue to drive the appreciation of scarce assets. Bitcoin, as digital gold, is still in its early stages of development, and as the market matures, its long-term performance is expected to surpass that of gold.Cole pointed out that over the past 55 years, gold has had a compound annual growth rate that exceeded the growth rate of the U.S. M2 money supply during multiple periods. Specifically, since 1970, the rates have been 9% and 6.7%, respectively; since the global financial crisis, they have been 9.5% and 6.3%; and since the COVID-19 pandemic, they have been 18.3% and 6.5%. Cole believes that as the debt crisis continues to worsen, the long-term outperformance of scarce assets relative to the dollar may further expand.For Strive, the key to outperforming Bitcoin lies in maintaining a high Bitcoin exposure multiplier and sufficient liquidity, rather than simply reducing financing costs. He emphasized that establishing and maintaining high Bitcoin exposure while avoiding financial risks is extremely challenging, and the market currently underestimates Strive's competitive advantages in Bitcoin exposure amplification and liquidity management. Its core investment philosophy is to reduce dollar exposure in the long term and increase Bitcoin allocation.

Documents disclosed by the U.S. Securities and Exchange Commission (SEC) indicate that the investment advisory firm Unique Wealth has submitted a 13F-HR report to the SEC, showing that it holds approximately $10.4 million in Bitcoin-related positions.The 13F-HR is a quarterly holdings report submitted by institutional investment managers to the SEC, used solely to disclose securities holdings that meet the reporting threshold, excluding directly held crypto assets. Therefore, the aforementioned positions typically represent Bitcoin exposure in the form of securities such as spot Bitcoin ETFs.

The Thailand Securities and Exchange Commission has completed the rule-making for Bitcoin ETFs, and the new regulations will take effect on October 16. Bitcoin has been included as a qualified asset in the first phase.According to the rules, the average net exposure of the relevant funds for each accounting year must reach at least 80% of the net asset value. The custodian must be licensed by the Thailand Securities and Exchange Commission, and fund shares can only be traded on the Thailand Stock Exchange. Securities companies are not allowed to provide margin financing. Thai mutual funds and private funds will be permitted to invest in locally listed cryptocurrency ETFs, but initially, the issuance and provision of depositary receipts related to overseas cryptocurrency ETFs are prohibited.

According to Hupzy, the current net exposure of hedge funds to the "Magnificent 7" in the U.S. stock market has risen to 22%, a record high, surpassing the peak of 21% on June 2024, and increasing by 7 percentage points since July of this year. In comparison, at the bottom of the bear market in 2022, this indicator was only 8%.The record-long positions reflect strong confidence from institutions in technology stocks, but it also means that trading may be overly crowded and does not necessarily indicate that the market will continue to rise. If the relevant investment logic changes, large-scale liquidations could trigger a sharp reversal and directly impact the perpetual contract market for the S&P 500 index; a decline in risk appetite may also further pressure Bitcoin.Additionally, the net exposure of hedge funds in the semiconductor sector is currently at 12%, slightly below the peak of 14% in June 2024, but significantly up from 2% at the beginning of 2025. Over the past three months, the increase in hedge fund exposure to the Magnificent 7 has been the largest since 2023.

Decentralised.co published a discussion on the path of stock tokenization, stating that the exposure to on-chain stocks held by traders and investors through tokenization and synthetic perpetual contracts has exceeded 6 billion dollars. The total market size of on-chain stock tokens is 3.21 billion dollars, with a 10% increase over the past 30 days; the open interest of perpetual contracts for stocks, indices, and ETFs on trade.xyz is 3.01 billion dollars, accounting for 94% of the total stock token market size.The process of stock tokenization is divided into four stages: initially, it is mostly offshore packaged certificates, followed by becoming collateral, then brokers tokenizing the shares that users already hold, and finally, the company registering the shares themselves on-chain. Most stock tokens are debt certificates that do not include voting rights or ownership of shares. Taking Robinhood as an example, after the related entity purchases shares and they are held by a custodian, it issues debt securities corresponding to one share to users, with dividends reinvested and stock splits adjusting the number of shares represented; if the issuer fails to perform, the securities agent will sell the shares and pay the holders, while the issuer can only maintain the price through arbitrage within a limited time frame.The market size of the top 100 tokenized stocks increased from 2.09 billion dollars to 3.03 billion dollars within 90 days, and the number of holding addresses grew from 417,000 to 4.21 million, with Binance and Robinhood contributing 86% of the new addresses. About 97.5% of the addresses hold less than 100 dollars, with exchanges and large wallets holding most of the value. The borrowing rates for collateralized loans against related stock tokens on Kamino, Jupiter Lend, and Ether.fi are approximately 4% to 5.75%.

BasedApp disclosed a data breach, with unauthorized parties accessing its internal operating system, exposing customer KYC data. The exposed items listed in the post include names, dates of birth, nationalities, addresses, passport or NRIC numbers, email addresses, phone numbers, and wallet addresses associated with the aforementioned identity information.The post also mentioned that someone gained administrator access to the BasedApp team's AI-agent backend through Google Quick Login, exposing the Telegram bot token, AI API key, OpenClaw gateway token, and OpenAI keys.

According to a report by Semafor, the New York Federal Reserve has begun visiting JPMorgan Chase, Wells Fargo, Barclays, and Morgan Stanley to review their loan situations and risk exposures related to private credit companies.This review partly stems from JPMorgan Chase's move in March to write down a significant amount of loans in its private credit portfolio, particularly loans to software companies threatened by artificial intelligence.

Arkham posted on the X platform that in February 2025, it identified over 1,000 addresses belonging to Kelsier Ventures (Hayden Davis) and published the complete collection for the first time.At that time, these addresses held nearly $300 million in crypto assets, primarily in LIBRA tokens; the current value has fallen to $2 million.

Michael Saylor, the founder of Bitcoin Treasury Company Strategy, posted on the X platform stating that Bitcoin can serve different types of investors. BTC provides direct ownership, MSTR offers leveraged Bitcoin exposure, while STRC provides income opportunities, and its 30-day price volatility is lower than all "Seven Giants" stocks.Michael Saylor added that digital capital is the foundation of digital equity and digital credit.

Bitcoin Magazine reported that the Chief Business Officer of the cryptocurrency exchange platform Coinbase stated that the company is working with advisors from six globally systemically important banks to increase exposure to Bitcoin.Coinbase Chief Business Officer: The company views this as an opportunity to expand the market and provide individuals with more ways to access Bitcoin. Globally systemically important banks are large banks identified by the Financial Stability Board that have a significant impact on the global financial system.

The Rollup founder Andy commented on the MetaMask infrastructure security incident, stating that, according to sources, unless significant negative news arises, there will be a small-scale withdrawal of staked ETH. It is recommended to take proactive measures for all re-staked ETH positions that have exposure to Lido.Andy expressed hope for a positive outcome, but he believes it may be wiser for the protocol and investors to actively respond. He mentioned that the current situation seems to be under control, but based on his recent communications with multiple parties, no one is clear about what exactly has happened.

The official ether.fi account posted on the X platform, stating that it has learned about a previous security incident related to Ethereum node operators. WEETH has no risk exposure and will not be affected. All funds are safe.Metamask announced earlier today that it is dealing with a security incident affecting some of Metamask's infrastructure. No direct threats to the MetaMask wallet have been identified at this time.As a precaution, Metamask is actively working with customers, partners, and security consultants to withdraw affected validators to maintain the security of Metamask's non-custodial staking business.