Security

The PHP Foundation said indecision and a lack of resources stalled a fix for a critical vulnerability first identified in 2024, as governments and companies worldwide took websites offline ahead of emergency patches.

Obol Network released Charon v1.11.2 on October 21, 2026, an urgent patch addressing a compromise of intermediate certificate authority certificates linked to the eMudhra incident.

Emergency patches released for two PHP vulnerabilities rated 9.2 severity; attackers have already attempted exploitation, Cloudflare says.

Qubic's network is back online after an Oct. 18 attack exploited weak wallet recovery seeds, draining 1,404 wallets of roughly $1.3 million. Validators approved a recovery plan and payments to verified victims have begun...

Leonardo Zuluaga Duque received 160 months in federal prison for laundering $14.5 million in drug proceeds using Tether's USDT and conspiring to import cocaine, as part of a network that processed over $470 million in il...

ACINQ released two updates in five days to fix security flaws in Eclair that could have allowed peers to steal funds or disrupt payments.

PHP fixed two critical flaws on Oct. 21 that allow unauthenticated code execution, prompting warnings from Kraken and Ledger security executives and advice from Cloudflare and the UK's NCSC.

Italian authorities have arrested 30 people and dismantled a mafia-linked operation that laundered €68 million through a Milan car rental company and crypto exchanges.

PHP has released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities that allow unauthenticated remote code execution, prompting some governments to take websites offline as a precaution.

BitGo has stated its platform is not impacted by two critical PHP vulnerabilities that allow unauthenticated remote code execution and memory disclosure, citing security partnerships and a bug bounty program.

PHP Foundation schedules security release for October 21, 2026, addressing two critical vulnerabilities rated CVSS 9.2. UK NCSC advises organizations to identify PHP systems and prepare to patch immediately.

Eight private keys at Indian certificate authority eMudhra were compromised after researchers found they used easily guessed integers, allowing forged certificates. Browser makers blocked the certificates, but some nonbr...

Two advanced OpenAI agents interfered with misalignment-detection tools during internal coding tasks, according to incidents shared by technical team member Marcus Williams.

Project Eleven has partnered with Bermuda-based Relm Insurance to explore how post-quantum security controls can be incorporated into digital asset insurance underwriting, focusing on Project Eleven's Strongpoint custody...

Attackers exploited a third-party notification provider to send fake security alerts, tricking users into surrendering recovery phrases and draining approximately $2.56 million from 70 wallets across four networks.

Qubic has resumed its network and launched a claims platform for holders affected by a wallet seed vulnerability that drained about $1.4 million in QU tokens from 1,404 accounts.

A new protocol called Compact Shielded CSV removes on-chain signatures and shifts verification to user devices, potentially reducing transaction fees and network congestion while providing post-quantum security.

A wallet labeled 'Drift Exploiter 5' deposited 25,710 ETH into Tornado Cash on Oct. 20, leaving recovery prospects uncertain.

Liquid Network says it is in the final stages of recovery with enhanced security after hackers stole 4,000 bitcoin in September and returned most of it in a white hat operation.

Wallets tied to the April 1 Drift exploit deposited 25,700 ETH into Tornado Cash over two hours on Tuesday, while the attacker's tracked addresses still hold 81,454 ETH.