vulnerabilities

Bitcoin Core has discovered 3 new vulnerabilities, one of which allows attackers to remotely crash nodes. This vulnerability can affect nodes running Windows, macOS, or BSD by exhausting memory, while Linux nodes are not affected by this attack.Another vulnerability can gradually deplete node memory, and the third may corrupt blockchain rollback data.

According to Bitcoin News, researchers claim that Tailscale has a serious vulnerability, where users with approved access can exploit its built-in SSH to gain root access to devices, and the attack may spread to other devices on the network.Users running nodes with Tailscale should disable Tailscale SSH and update promptly after the patch is released. Tailscale has not yet responded.

According to BlockSec monitoring, a suspicious transaction by X100 Global on Ethereum resulted in a loss of approximately 4.75 million USD, with the related attack stemming from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds to purchase X tokens, allocated the tokens to two controlled contracts, and then deposited them into the Freezer, thereby controlling 2 out of 3 senator seats in the same transaction, and subsequently immediately passed and executed a malicious treasury proposal.Specifically, the attacker first created and provided liquidity to the X-USDT trading pool on PancakeSwap V3, then used the obtained majority governance seats to approve the exchange of 400,000 X tokens into that trading pool, setting the minimum output amount to 0, ultimately receiving only about 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold part of the recovered X tokens through the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

According to monitoring by Olaoluwa Osuntokun, the Chief Technology Officer of Lightning Labs stated that due to the CVE-2026-111943 vulnerability, it is strongly recommended that all lnd, btcd, tapd, and litd users update their binaries or rebuild using Go 1.27.3.The vulnerability involves the compromise of a certificate authority, which may affect the security of the related software.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

According to The Defiant, THORChain announced that its v3.21 upgrade will fix the FIN contract vulnerability on Rujira and allow the previously paused application layer to restart. The network has set the upgrade target at block height 28,366,100, with an expected time around October 23. After the restart, trading, lending, borrowing, and automated trading on Rujira will resume. Rujira's products run through smart contracts within THORChain, rather than on an independent blockchain, and the application layer can pause these contracts without affecting the underlying layer of THORChain.According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a position. The team paused the application layer with the support of node operators, and only one position from the Rujira team itself was affected, with no loss of user funds. Rujira attributed the vulnerability to a flaw in the position transfer function, rather than the trading logic of the liquidity strategy. On September 27, Rujira stated that the fix is located at the underlying layer and has been scheduled for the v3.21 upgrade.Regarding the restart window, Rujira proposed a conditional grace period in its plan on October 15: if the application layer is ready to resume, any credit account position with a loan-to-value ratio above 100% and meeting liquidation conditions will request node operators to pause the credit account contract for an additional 24 hours, allowing borrowers to replenish collateral before liquidation resumes. Borrowers can replenish collateral through Rujira Borrow or by directly transferring assets to the credit account address. Rujira indicated on October 10 that positions still deemed unsafe after the grace period may be liquidated when the liquidator triggers the process.

Polygon Labs official announcement, Bor v2.1.3 is officially released to the public, previously distributed in private version form to validators and major infrastructure providers. This update fixes two medium-severity denial-of-service vulnerabilities in BlockSTM V2 parallel block execution, both submitted by security researchers through the Immunefi bug bounty program.Unbounded keccak256 cache issue: Attackers can fill hundreds of MiB of cache during the speculative execution phase by constructing specific transactions, leading to node memory exhaustion and delayed block production. The fix is to set a capacity limit on the shared cache. Repeated code hash calculation issue in parallel execution: A single transaction can cause the parallel processor to take about 11 seconds, severely affecting node activity. The fix is to cache code hash results on a per-transaction basis.In addition, this update also includes several internal hardening measures: the transaction pool address filtering adds interception for EIP-7702 SetCode authorization, RPC batch execution pool concurrency limit fixes, consistency fixes for reading balances across self-destruct boundaries in parallel execution, and an automatic cleanup mechanism for pending transactions (default 3 hours). The affected versions are Bor v2.1.1 and v2.1.2. v2.1.3 is a non-hard fork, and nodes can upgrade individually without coordination. No exploitation records of the two vulnerabilities have been found on the mainnet and testnet Amoy.

Papertrade's official response to the allegations of price manipulation and the existence of obvious loopholes in the protocol states: It has never been possible for small orders to have the same priority as large orders. If this were done, the front end would suffer from congestion due to junk trading, and the consequences would be much worse than the existing queuing mechanism.Under these constraints, we have designed the fair launch to be as inclusive as possible.Last night, the attempts to manipulate BTC/ETH on Hyperliquid BBO were not due to flaws in the mechanism that took six months to design. These situations had already been considered; it was only because the position limits were set very loosely in the early stages to cope with congestion that such occurrences were possible. If position limits were set during peak demand for launching, it would only exacerbate the slow experience, and the queuing mechanism itself, due to the uncertainty of opening/closing confirmation times, naturally provides protection against manipulation.As congestion eases, we have begun to tighten position limits on-chain and at the relay level. In such a system, manipulation attacks are always possible— the key is whether the attempt is economically viable. The official goal is to set parameters to a point where it is almost never profitable; even if successful, the tail risk is extremely high, and the expected value is negative.

ChainCatcher live report, at the OKX NOW Global Product and Ecosystem Conference (Singapore), Ethereum co-founder Vitalik Buterin stated that AI has demonstrated strong penetration and offensive and defensive capabilities, with cases emerging of breaking out of sandboxes, attacking websites, and discovering various software vulnerabilities and exploits. "Anything with vulnerabilities will eventually be discovered by AI; GPT-7, Claude 7, DeepSeek 7 will find it."At the same time, AI is also helping the Ethereum protocol discover bugs, implement complex cryptography, and perform formal verification at both the protocol and application layers. Vitalik believes that higher security levels will shift from "optional" to "mandatory," and the industry is in a fascinating yet challenging transitional period.

QCP Capital released the latest market analysis stating that BTC has broken through the previous trading range of $82,500 to $85,700 that lasted for a week, reaching a high of $86,913 during the day, the highest since September 23. It is currently trading around $85,900, up 14.6% from the low of $74,968 on September 15. QCP pointed out that during this round of increase, the annualized funding rate for perpetual contracts was only 5.4%, indicating that the market was mainly driven by spot funds rather than leveraged trading. QCP believes that this round of BTC's rise diverges from traditional macro market signals. In September, the yield on the 30-year U.S. Treasury bond rose to 5.62%, and the 10-year yield reached 5.29% at one point, while gold recorded its worst month of the year. Although rising real interest rates typically put pressure on gold and risk assets, BTC still rose.QCP believes that this market trend is more consistent with concentrated capital trading driven by institutional fund inflows, regulatory catalysts, and technical improvements, rather than purely a currency depreciation trading logic. Regarding institutional funds and regulatory factors, the U.S. Bitcoin spot ETF recorded net inflows of approximately $3.5 billion and $2.6 billion in August and September, respectively. QCP noted that the innovative exemption policy released by the U.S. SEC on September 17 provided a new regulatory catalyst for the market, but since the CLARITY Act failed to pass in the Senate earlier, market structure legislation may be delayed until 2027. Therefore, current regulatory support comes more from the administrative level, and long-term policy certainty remains limited.In the options market, yesterday's options trading nominal amount was approximately $2.5 billion, involving 54 transactions with a nominal amount exceeding $5 million each. Among them, one client sold in batches call options expiring on October 30 with a strike price of $90,000, totaling over 4,000 contracts with a nominal amount of $346 million; at the same time, they actively bought call options with the same strike price expiring on November 27. QCP believes that this operation reflects that some traders are rolling their positions from October to November to position for the U.S. midterm elections, quarterly Treasury refinancing, and market volatility around the December Federal Reserve meeting.On the macroeconomic front, the Federal Reserve will hold a monetary policy meeting from October 27 to 28. QCP stated that after Federal Reserve official Williams said there was no need to rush to adjust policies further, and with the August core PCE coming in below expectations, market expectations for maintaining interest rates in October have warmed. However, the market still expects an approximately 80% probability of a 25 basis point rate hike in December. The U.S. non-farm payroll report for September, to be released tonight, will be an important short-term test, with the market expecting an increase in non-farm payrolls of 84,000 to 93,000, an unemployment rate holding at 4.1%, and an average hourly wage year-on-year growth rate expected to be 3%.On the technical front, the support level of $82,500 has been tested three times in the past week, while $87,400 is the location of the September high and is a key resistance for BTC to further challenge $90,000. The implied volatility term structure in the options market is in a contango state, with a 7-day implied volatility of 30.3 and a 90-day implied volatility of 37.1; the 30-day risk reversal indicator is approximately -2.5 volatility points, indicating an increase in demand for short-term put protection. QCP believes that although BTC shows resilience in a macro environment of rising real interest rates, the market is still mainly driven by capital flows and position changes, and it cannot yet be considered that macro risks have been eliminated. U.S. employment data, Treasury supply, and the intensive policy events in the coming weeks may still trigger market volatility.

NEAR Protocol posted on platform X that Sal Ternullo, CEO of NEAR Treasury Company SVRN, has introduced a new proposal on the NEAR governance forum to reduce the maximum annual token issuance rate from 2.5% to 1.6% for a duration of 24 months, and to lower the staking yield from the current approximately 5.4% to about 3.5%.The proposal is currently seeking feedback from validators, House of Stake delegators, and NEAR community members, with a complete plan expected to be announced next week for voting.In response to the recent NEAR Intents security incident, NEAR Protocol further clarified that the blockchain network is operating normally, and the related incident was not caused by vulnerabilities in NEAR Protocol or the native token NEAR. The NEAR Protocol network continues to produce blocks and process transactions without any downtime.

According to Law360, the cryptocurrency asset theft case involving Uranium Finance has begun trial in the U.S. District Court for the Southern District of New York.Prosecutors allege that Maryland cybersecurity consultant Jonathan Spalletta exploited a vulnerability in the protocol's smart contract to launch an attack in 2021, during which approximately $53.3 million was transferred from 26 liquidity pools in a second attack, leading to the protocol ceasing operations. The statements related to this are allegations by the prosecution and not a conclusion of guilt.

Slow Fog's Yuxian posted on platform X, stating that systems prior to iOS version 27 are being exploited by certain black and gray market groups to steal encrypted wallets from iPhone users.It reminds users to promptly update their iPhone, iPad, Mac, and other devices to the latest version, to be cautious when installing apps from unknown sources, and to be careful when opening unknown links through Safari and in-app browsers.

According to Ark Invest Tracker, Ark Invest states that AI hacking attacks are affecting everything. The risks go far beyond Bitcoin, as AI makes software vulnerabilities easier to discover and exploit.Bitcoin and hardware wallets may be the first to be impacted, but social media, tax, and banking websites may also face the same threats. Trusting a big brand still means trusting that the company will not make mistakes as AI becomes increasingly powerful. ARK expects that large custodial institutions will also become targets, with AI potentially discovering and exploiting vulnerabilities at an unprecedented speed.

The Google Product Security Team has disclosed an internal AI agent called PageBreak, used to test the security of its first-party web applications. This agent is built on Google's Gemini model and began a pilot program in November 2025, transitioning to a formal project in January 2026, with the goal of autonomously scaling vulnerability discovery and reducing manual input.Unlike common AI scanning tools, PageBreak hands over hypotheses to specialized validators after discovering suspicious defects, attempting actual exploitation in a real-time running copy of the application, and only reports once confirmed exploitable, with a false positive rate close to zero. Google claims that PageBreak has identified over 500 XSS vulnerabilities in its first-party web applications, which can be used to hijack login sessions, steal data, or impersonate users.Google stated that the security team has been overwhelmed in recent years by a large number of AI-generated vulnerability reports that appear reasonable but are not valid, making it a major challenge to distinguish real defects from hallucinations. When testing applications built using the next-generation high-assurance framework, PageBreak found only two vulnerabilities. The next step for Google is to integrate PageBreak with the automated remediation agent CodeMender, providing confirmed vulnerabilities with accompanying fixes.

Binance Wallet Security Announcement: iPhone users please check if you have installed the FomoPeek application. Binance has noted a recent security incident disclosed by the community. According to security companies such as SlowMist, the third-party application FomoPeek (versions 1.1-1.2) contains malicious code that can exploit vulnerabilities in the iOS system to gain maximum permissions on the device and may access sensitive data stored on the device, including private keys, mnemonic phrases, login credentials, chat records, files, etc. Please note that such malware directly attacks the device itself. If the attack is successful, all application data on the affected device may be accessed.Please check the following:Are you using an iPhone or iPad running iOS 26.x or earlier?Have you installed the FomoPeek application?If both of the above apply to you, it is recommended to take the following steps immediately:Delete the FomoPeek application and do not reinstall it.Update the iOS system to the latest version.For users with self-hosted wallets: Create a new wallet on a device that has never installed the application and transfer assets to the new wallet address.If you notice any unusual asset activity, please retain the affected device and relevant evidence, and contact customer service for further investigation.At the same time, all users are reminded: Do not install applications from untrusted sources and keep your device software up to date.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

Bitcoin News posted on the X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the security landscape of Bitcoin. Large language models have significantly reduced the cost of discovering vulnerabilities, allowing attackers to potentially find catastrophic vulnerabilities for just a few hundred dollars in computing costs.For Bitcoin Core, Project Loupe, the Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or severe vulnerabilities have been found. Gögge stated that relying on stronger models to discover vulnerabilities before attackers is not a sustainable security strategy. Developers should build testing infrastructure that can proactively prevent entire classes of vulnerabilities through automated testing, fuzz testing, and property-based testing. Key components of Bitcoin Core have accumulated over 100 years of CPU fuzz testing and have undergone decades of Bitcoin node network simulation.