vulnerability

The cryptographic security vulnerability of the Indian certificate authority eMudhra affects the Ethereum clients Teku and Besu. Researchers found that the private keys of 8 intermediate certificate authorities under eMudhra could potentially be deduced due to insufficient randomness, allowing attackers to forge certificates and trick unpatched software into trusting malicious services.Teku has released version 26.1.3, and Besu has released version 26.1.2, both of which have removed trust in the relevant certificates from their Docker images. If an attacker performs a man-in-the-middle attack, they could trick some validators into sending block fee rewards to the attacker's address; the risk may be higher under specific configurations using external signers. The Teku team stated that the default configuration of the Ethereum mainnet Teku node is not affected, and no action is required, with no reports of the vulnerability being exploited so far.For operators running Teku or Besu directly on the host without using Docker, simply updating the client may not be sufficient; they also need to manually update Java and its trusted certificate list. Operators still using the no longer maintained Java 26 will need to migrate to Java 25.

Bitcoin Core has discovered 3 new vulnerabilities, one of which allows attackers to remotely crash nodes. This vulnerability can affect nodes running Windows, macOS, or BSD by exhausting memory, while Linux nodes are not affected by this attack.Another vulnerability can gradually deplete node memory, and the third may corrupt blockchain rollback data.

Researchers disclosed a zero-click vulnerability in the Telegram sticker feature at a security conference held in Tokyo, demonstrating that an attacker could execute code on iOS devices without any user interaction.However, Telegram disputed the risk assessment of the vulnerability.

According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that had been used in real attacks.Malicious servers can present users with forged transactions and induce them to sign transactions that pay the attacker's address when users attempt to accelerate transactions with a replacement fee (RBF); attackers do not need to obtain the user's private key. Electrum stated that it has received two related reports, one of which involved a user losing Bitcoin after increasing the transaction fee, and advised users to update to version 4.8.3.

Bitcoin security expert Jameson Lopp stated that cyber attacks are growing along an "exponential" path. He pointed out that the number of vulnerabilities discovered in the past two and a half months has increased exponentially, with attackers being the first to adopt unreviewed AI models, and security researchers "failing to get adequate rest."Lopp explained that Bitcoin Core has adjusted its security policies because AI can discover vulnerabilities through simple prompts; security measures need to shift from annual audits to real-time defenses and be embedded in the development process. He also analyzed a PHP remote code execution vulnerability, believing the actual impact to be less than expected.Additionally, Lopp mentioned that Google's estimate of 500,000 quantum bits involves the difference between physical quantum bits and logical quantum bits; if the quantum threat time window is less than ten years, the industry will be at a disadvantage. Currently, there are only a few hundred available quantum bits, and quantum upgrades will take years due to Taproot, consensus rules, and untested cryptography. About 30% of addresses have exposed public keys, and attackers will prioritize targeting these addresses; unpatchable hardware issues and "wrench attacks" have exceeded 700 cases.

According to Initia monitoring, a security fix has been drafted for the vulnerability discovered on October 23, and audits are currently being conducted with security partners.After the audit is completed, Initia will announce a specific plan detailing how to restore support for the affected assets and orderly restart the Initia L1 and Rollup networks. This process is expected to be completed in the coming days.

According to CoinDesk, a large number of AI-assisted vulnerability reports have flooded in, prompting the Solana validator client Firedancer team to require researchers to permanently destroy 1 SOL (approximately $100) for each submitted vulnerability report to curb spam reports. This fee is non-refundable, even if the report is invalid, out of scope, or a duplicate; reports that do not destroy SOL are ineligible for rewards.The $1 million audit competition from April 9 to May 9 attracted 162 researchers who submitted 809 reports, resulting in 127 unique security findings, with nearly half of the valid submissions being duplicates. Jump Crypto believes that almost all submissions involved AI agents in the discovery or writing process, with pending reports once piling up to 299.Meanwhile, Jump has raised the reward standards, with eligible findings able to receive double the standard bounty before November 20, and specific vulnerabilities for Alpenglow being three times, with critical findings up to $300,000.

According to CoinDesk, Ethereum developers have fixed a vulnerability in the Glamsterdam upgrade that could allow operators to withdraw ETH intended for new validators from the staking service. The fix changed the handling rules for validator deposits and was merged on Monday, after developers had rejected the modification a week earlier.Researcher avsetsin discovered that if an operator first registers as a builder with a specific public key, and the staking service subsequently deposits ETH using the same key to activate the validator, the draft rules would credit both deposits to the builder. Avsetsin stated that this is a conditional code discovery and not a confirmed real-time exploit; existing checks can prevent the attack, and there are currently no reports of losses. The new rules treat deposits as sorted by withdrawal receipts, ensuring that validator deposits still belong to the validators.Glamsterdam has been running on the Sepolia testnet, but the launch on the Hoodi testnet has been delayed, with a new date to be determined before the mainnet launch.

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

On October 24, the Bitcoin lightweight wallet Electrum disclosed a malicious server attack targeting transaction fee increases and fixed it in version 4.8.3, corresponding to GitHub security advisory GHSA-6jp4-8v48-cc5v. Users may inadvertently sign funds over to the attacker when performing regular fee increases on transactions. Developers stated that the issue arose after users reported losing funds after signing fee increases.The results of two reports differed: one person discovered that transactions in the wallet history were replaced after broadcasting a payment and claimed that the original payment did not enter the Bitcoin peer-to-peer network and was withheld by the server; another person, Raju-K12, reported losing funds due to the fee increase on the replaced transaction. In the attack, the malicious server withheld new transactions broadcasted by the client and inserted a conflicting transaction into the history, replacing the original output with the attacker's address. The replacement transaction was signed invalidly at that time, but the lightweight client did not verify these signatures before displaying unconfirmed transactions; after the user manually increased the fee and signed through RBF, the attacker received the funds. Both individuals claimed that the last four digits of the attacker's address were the same as those of the legitimate receiving address. The announcement did not disclose the amount stolen, transaction identifiers, or the attacker's address.The patch corresponds to commit 90fe308, which checks the signatures of the wallet's own inputs before writing memory pool transactions to local history, but does not overwrite inputs from external addresses of the wallet and does not perform complete consensus verification. The announcement suggests that users who have not upgraded should verify the output address and amount each time they sign; clients connected to their own or trusted servers are not affected by this attack. On the timeline, the issue was first privately disclosed on October 11, received reports of fee loss on October 18, the fixed version was tagged on October 23, and the binary and public disclosure occurred on October 24.

Cryptocurrency hardware wallet manufacturer Keystone disclosed that its website experienced a security breach, allowing unauthorized third parties to access customer names, contact information, shipping addresses, and order details. Keystone stated that it has blocked access, fixed the vulnerability, and launched an investigation, while also notifying affected customers, but did not disclose the number of individuals impacted.Security researcher Taylor Monahan warned that the leaked shipping addresses could expose customers to targeted scams and personal attacks. Keystone stated in 2023 that it would shorten the retention period for customer data to 180 days, but some customers reported receiving breach notifications more than two years after purchasing their devices.

According to Bitcoin News, researchers claim that Tailscale has a serious vulnerability, where users with approved access can exploit its built-in SSH to gain root access to devices, and the attack may spread to other devices on the network.Users running nodes with Tailscale should disable Tailscale SSH and update promptly after the patch is released. Tailscale has not yet responded.

Succinct's zero-knowledge proof system SP1 has revealed a high-severity reliability vulnerability. This vulnerability was disclosed through GitHub announcement GHSA-p7v2-jjv3-8p8f, affecting SP1's native Rust verifier versions 6.0 to 6.8.0, allowing the mainnet Prover Network to potentially accept invalid proofs: malicious provers can submit proofs of invalid executions, and the network verifiers will still accept them.The cause of the vulnerability is that the verifier only reads the labels of the data (declaration dimensions) without verifying whether the actual number of stored elements equals the product of the dimensions, allowing attackers to forge labels to pass invalid proofs. The Groth16 and Plonk checks using fixed-shape wrap proofs are unaffected, and the on-chain Solidity checker is also safe. Succinct released the fixed version 6.8.1 on September 24, which has been deployed to the mainnet; this version adds deserialization length checks.The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users running the native Rust verifier and accepting untrusted provers need to upgrade to 6.8.1.

Initia posted on platform X that on October 23 at 22:59 (UTC+8), attackers exploited a caching vulnerability in the Initia MoveVM script to bypass security checks, forging MoveVM states to credit themselves with unsupported WETH, iUSD, and USDC, while the total supply of the related tokens remained unchanged; INIT was not minted, and the total supply was unaffected.Before the network was paused, the attackers had transferred out approximately $2.7 million in assets, including 105 WETH transferred via LayerZero and about 1.4 million AUSD0, as well as approximately 1.08 million USDC transferred via Noble and CCTP, which were then exchanged for 1135.52 ETH, currently held at the Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Initia stated that the security fix is expected to be completed and audited within a few days, and asset recovery efforts are being advanced with security partners. L1 and Rollup remain in a paused state, and a complete post-mortem report will be released subsequently.

The National Information Security Vulnerability Sharing Platform (CNVD) released a security announcement titled "Analysis and Repair Suggestions for PHP Remote Code Execution Vulnerability," in which it supports affected users to closely monitor official information, download and update to the latest version through official channels. Users who are temporarily unable to update can take measures to reduce certain attack vectors, mitigate vulnerability threats, and continuously monitor for abnormal PHP process exits, abnormal system command calls, unfamiliar process creations, and abnormal file writes, while retaining logs for traceability analysis.In its protection recommendations, CNVD stated that information system operating units should further strengthen security protection, comprehensively sort out their network assets, and reduce the public exposure of information systems according to the principle of not connecting to the internet unless necessary. Operating units that are currently unable to repair should take temporary response measures such as network isolation, network access restrictions, and taking unnecessary business systems offline.

OpenAI posted on the X platform that during a recent red team exercise, a vulnerability was discovered in the widely used compression library Brotli that allows remote code execution without authentication. Software such as Node.js, Bun, and Envoy all have this library built-in. Attackers can take over unpatched servers by sending malicious compressed data, and they can also take over clients that accept compressed data through malicious servers.OpenAI stated that the root of the issue was fixed in the Brotli source code in February of this year, but it was not identified as a security vulnerability at that time, and all software that includes this library needs to be updated accordingly. According to The Hacker News, the vulnerability is numbered CVE-2026-111497, and Node.js released a patched version on October 21.

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

The New York State Department of Financial Services in the United States has issued an alert regarding two critical PHP vulnerabilities, urging regulated entities to quickly identify and remediate known exploited vulnerabilities.