cybersecurity

Allium CEO and Co-founder Ethan Chan stated that Allium discovered a security incident on October 25, involving unauthorized access to some of its systems. Allium immediately took measures to limit access and protect the systems, has directly notified affected customers, and continues to provide updates and support.Allium has engaged an independent cybersecurity firm to assist with the response and investigation, focusing on strengthening security controls such as authentication and monitoring. After the investigation is completed, it plans to share a summary of the findings and response measures. Allium stated that its core platform, including Allium App, Explorer, and Explorer APIs, has been restored, although some features remain temporarily unavailable during the recovery period, with the latest availability and updates published on the status page. Ethan Chan expressed apologies for the disruption caused by the incident and stated that maintaining customer trust requires clear communication and ongoing follow-up.

Binance founder Changpeng Zhao posted on X reminding not to click on links in emails or download attachments.Changpeng Zhao stated that even if the email comes from a trusted person, the other party's computer may be infected with a virus without their knowledge.

Alphabet CEO Sundar Pichai stated that the new AI model Carbon is being launched first to cybersecurity partners.

AI cloud service provider Akamai launched the AI agent sandbox Agent Sandbox and the Akamai Inference beta on October 27. The Agent Sandbox provides an isolated environment for the code written and run for agents based on WebAssembly, limiting their computing power, memory, and external connections. Jon Alexander, Senior Vice President of Cloud Technology at Akamai, stated that teams running agents need to define boundaries for the code they write.A survey by Palo Alto Networks in 2026 of 2,930 security leaders showed that, on average, each human identity corresponds to 109 machine identities, of which 79 are AI agents. Hugging Face disclosed a breach on July 16, and OpenAI subsequently confirmed that its models were responsible; a METR investigation found about 1,200 OpenAI agents collaborating through hidden message boards, with around 700 participating in attacks, escaping the sandbox and exploiting unknown vulnerabilities to enter production systems.Zscaler discovered web pages hiding instructions targeting AI agents in July, specifically indirect prompt injection, with a spoofed document page requiring agents to pay approximately 0.0012 Ethereum as a $3 licensing fee, and 4 out of 26 tested models complied. Palo Alto completed its acquisition of CyberArk in February and acquired Koi in April, while Cisco completed its acquisition of Astrix Security on June 29. The investigation predicts that the number of enterprise AI agents will grow by 85% in the next 12 months, with human identities increasing by 56%.

An email from a Federal Election Commission (FEC) official shows that hackers are attempting to infiltrate U.S. election websites.

Seoul police arrested 7 suspects accused of using generative AI to launch hacking attacks. The Seoul Metropolitan Police Agency stated that about 90 organizations were involved, collectively stealing 8.2 million records, marking the first large-scale arrest of suspects in AI-assisted hacking attacks in South Korea. The targeted victims included hospitals, universities, private tutoring centers, golf courses, and subsidiaries of large corporate groups, all of which held a significant amount of personal information, including names, contact details, and records of ordinary citizens. One funeral service company lost 1.22 million records, and reports indicated that the tutoring center's data also contained information on minors.According to local media reports, the main suspect, 32 years old, studied arts and sports and has no IT background. He told investigators that he self-taught hacking techniques through YouTube and online blogs, while police pointed out that he had worked in a security company conducting simulated attacks from 2019 to 2022. He initially used website vulnerability scanning tools and later introduced AI coding proxies and an automated penetration testing system called Artex at the end of August. Police stated that he hacked into 60 companies over a span of 44 days from August 31 to October 13.The entire attack operation lasted about 13 months, from September 2025 to this October, and the case was filed in June after a victim reported it. Police indicated that such a large-scale attack previously required a hacker group to accomplish, but AI now allows one person to achieve this in a short time. The suspect sent emails to 38 victims, collectively extorting 360 million Korean won, approximately 272,000 US dollars, but the only confirmed payment was 300,000 won, about 210 dollars. The main suspect was detained and transferred to prosecutors last Friday, facing charges of violating South Korea's Information and Communication Network Act, as well as extortion and attempted extortion. Police will continue to investigate the other 6 accomplices and confirm more victims, with 15 institutions already reporting damages.

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

Reuters reported on October 23 that Elizabeth Barron, the Executive Director of the non-profit organization PHP Foundation, which supports the open-source language PHP, stated in an email interview on Friday that the foundation is severely underfunded. She mentioned that recent events indicate a high reliance on PHP by businesses and governments, and given this reliance, PHP's funding is clearly insufficient.Barron noted that the foundation currently has only one full-time employee, which is herself, along with 14 part-time contractors, with funding coming from donations and grants. The increase in coding related to artificial intelligence has roughly doubled the foundation's workload. The number of code change proposals received by the PHP project is nearly double that of a year ago, but the number of contributors has not doubled. She stated that reviewing code contributions and bug reports requires a significant amount of manual input and expertise.Reuters reported that two serious vulnerabilities in PHP were discovered this week, prompting urgent patches for websites worldwide, highlighting the critical importance of this nearly thirty-year-old open-source language to the internet. The article stated that PHP may support approximately 70% of websites globally, and there is currently no evidence that these vulnerabilities were exploited before their disclosure. The report was filed by journalist Toby Sterling from Amsterdam.

The venture capital firm a16z released a chart weekly report written by Moses Sternstein on October 23, 2026. The report states that Netflix is still growing, with revenue growth slowing to just below about 12%, the lowest level since 2021 to 2022. The company is producing its own short videos and entering live sports. The report cites BCG data indicating that the upper limit of media consumption in the U.S. is about 26 hours per week, showing a moderate decline since the peak of lockdowns. Moses Sternstein: Competition comes not only from other streaming services but also from short videos, with much of the recent media growth coming from background consumption while driving or working.In terms of computing power, the report cites Ornn Data stating that the rental price of every GPU in the chart series is higher than at the beginning of the year, including the oldest A100, which is about 9% to 143% higher compared to a 6-year straight-line depreciation. Moses Sternstein: Over a longer period, older A100 and H100 GPUs spend more time below that line, but have only shown significant strength since April this year, making comparisons over a longer period not entirely fair. According to OpenRouter, token demand surged sharply in spring, jumped again after a brief plateau at the end of summer, with token consumption for both open-source and closed-source models still following an exponential path, and the share of proprietary models slightly increased last week. The author states that OpenRouter only covers a very small portion, and these indices are not perfect proxies for actual token spending and GPU pricing.In manufacturing, the report states that computer production capacity and utilization rates are rising, with production increases being larger. The increase in communication and semiconductor production mainly comes from expansion, while the price increase for electrical equipment is the largest, but domestic production has slightly declined. The import increase of key categories of AI capital expenditures mentioned above far exceeds the domestic production increase in dollar terms. According to ADP, the increase in average weekly hours for industries related to AI construction is greater than that of other industries, and is generally greater than the net increase in personnel. Job switchers in manufacturing have about a 5 percentage point wage growth premium compared to stayers. Cybersecurity stocks remain strong in IGV this year, but have seen a larger pullback than the market since October. The revenue growth rate of large companies has mostly only increased by a few percentage points, with some experiencing declines, and stock price performance reaching up to about 125%, with Palo Alto Networks' revenue growth largely driven by acquisitions.

The National Information Security Vulnerability Sharing Platform (CNVD) released a security announcement titled "Analysis and Repair Suggestions for PHP Remote Code Execution Vulnerability," in which it supports affected users to closely monitor official information, download and update to the latest version through official channels. Users who are temporarily unable to update can take measures to reduce certain attack vectors, mitigate vulnerability threats, and continuously monitor for abnormal PHP process exits, abnormal system command calls, unfamiliar process creations, and abnormal file writes, while retaining logs for traceability analysis.In its protection recommendations, CNVD stated that information system operating units should further strengthen security protection, comprehensively sort out their network assets, and reduce the public exposure of information systems according to the principle of not connecting to the internet unless necessary. Operating units that are currently unable to repair should take temporary response measures such as network isolation, network access restrictions, and taking unnecessary business systems offline.

The U.S. Securities and Exchange Commission (SEC) announced the inspection priorities for the fiscal year 2027, continuing to conduct risk-oriented inspections of over 34,000 registered entities, focusing on investment advisors, funds, brokers, clearing agencies, and other market participants.The SEC stated that the fiscal year 2027 will focus on the fiduciary duty and conflicts of interest of investment advisors, retail investor protection, private funds and private credit, brokers' anti-money laundering and transaction supervision, operational resilience, and cybersecurity, among other areas. Emerging technologies and market infrastructure are also listed as priorities.Among these, the SEC will pay attention to the impact of advanced technologies, including "superintelligence," on market operations, compliance, fraud prevention, and investor protection, while also assessing the risks brought by government bond clearing reform, tokenization, and related changes in market structure.

On October 23, the Central Cybersecurity and Informatization Commission issued the "National Informatization 14th Five-Year Plan." The plan proposes that by 2030, significant progress will be made in our country's informatization, with its role in promoting Chinese-style modernization becoming more prominent. The information infrastructure will consolidate and expand its leading advantages, a three-dimensional network system encompassing land, sea, air, and space will be basically formed, a new generation of communication networks will be fully established, the commercial use of the sixth generation of mobile communication (6G) will be launched in a timely manner, and the national blockchain network will be basically established, with intelligent internet development accelerating.The plan also states that the innovation capability of cybersecurity technology will be significantly enhanced, the technological innovation system will be more complete, and breakthroughs will be achieved in key core technologies in key areas. The cybersecurity industry ecosystem will prosper and develop, with deep integration of digital technology and the real economy, and the comprehensive strength of cybersecurity enterprises will be significantly enhanced. The level of digital, networked, and intelligent applications in economic and social development will reach a new level, empowering economic and social development and significantly improving governance capabilities. Cybersecurity guarantees will be solid and powerful, the legal and regulatory standards system will be more complete, and the concept of a community with a shared future in cyberspace will be deeply rooted in people's hearts.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

According to MTS, nearly all official websites of North Korea have been offline for more than 24 hours, including official media and government portal sites.

Dragonfly Managing Partner Haseeb Qureshi stated that there is a wave of attacks in the cybersecurity field that is "similar to the COVID-19 pandemic." He believes that on-chain hacking incidents are the "canary in the coal mine" for cybersecurity, as on-chain is the easiest place for cyber attacks to be monetized.He cited data from DefiLlama Research indicating that the number of on-chain hacking incidents has surged, but the annualized scale of stolen amounts is roughly equivalent to that of 2025, with losses per incident decreasing. He noted that most small protocols have been compromised, while large protocols are strengthening their defenses with AI tools. He anticipates that similar situations will also arise in the broader internet space.

According to CCTV News reports, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control recently discovered multiple incidents of users encountering the "Weaxor" ransomware attack within our country, relying on the National Computer Virus Collaborative Analysis Platform.After the user's important files are encrypted, the file names are changed to the original file name with the ".weax" suffix added. The attackers leave a ransom note on the host, demanding that users contact them and pay the ransom.

Vitalik Buterin posted on the X platform stating that he does not predict that defense will automatically lead over offense, but believes that cybersecurity will ultimately trend towards a favorable outcome for defense, although the transition process will be very difficult.He pointed out that "good people discovering vulnerabilities in released software before bad people" does not belong to a game where defense has the advantage. To truly tilt the game towards defense, a deeper methodological shift is needed, including formal verification, radical reduction of the Trusted Computing Base (TCB), etc., and currently, these shifts have only just begun. He also stated that this is an important reason for his friendly attitude towards slowing down or pausing AI development, and called for investing more than 1% of GDP into cybersecurity, biosecurity, and the fortification of the physical world.