cybersecurity

Cybersecurity company XBOW published a statement disclosing a critical remote code execution vulnerability that can be exploited without authentication in a public web application of the U.S. Election Assistance Commission (EAC). This application is used for resource and logistics calculations, not for voting machines or voter registration systems.The vulnerability could allow attackers to execute code with root privileges in the backend container by crafting specific web requests, and access local protected resources and external networks. XBOW stated that it reported the issue according to the vulnerability disclosure policy published by the EAC, and after verification by the EAC team, the vulnerability was fixed before the U.S. federal midterm elections.

IT Home reported on October 30 that developers discovered application entry points and interface logic related to the Cyber cybersecurity model in the front-end code of the DeepSeek official website. The application page route points to /usage/model-application and has a feature gate switch set; accounts without permission will be redirected back to the usage page when accessed. The code also includes interfaces related to Cyber Key creation and quota management.The models in the code are identified as cyber-personal-v3 and cyber-enterprise-v4. The personal version is aimed at individual security practitioners, requiring the submission of ID information and completion of facial verification; the enterprise version is aimed at corporate entities, requiring not only real-name materials but also a business license and authorization letter. Common thresholds for both channels include that the account has completed real-name verification and is in normal status, registered in mainland China and bound to a mainland mobile number, and has no violation records in the past 90 days.The application process involves filling out an application form and submitting it for review. After passing the review, a Cyber Key is created. Currently, this entry point does not appear in the public menu of DeepSeek and is in a gray testing state. Some users have reported that only accounts covered by the gray test can see the relevant sections on the usage page, and when permissions are granted, the "DeepSeek Flash Cyber Cybersecurity Dedicated API" area will be displayed. As of the time of reporting, DeepSeek has not yet released an official announcement regarding this model; the information comes from observations of the official website's JavaScript code and feedback from gray test users.

According to a report released by Microsoft Threat Intelligence on the 29th, North Korean hacker groups are using artificial intelligence to accelerate cyberattacks on South Korean users, expanding from customized phishing documents, fake recruitment, and identity disguise to malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korean-related hacker organizations: three have reached the highest "Operational Maturity" stage at level four, integrating AI into their daily attack processes; four are in the "Acceleration" stage, and one is in the "Expansion" stage.The report states that organized groups customized and generated over 100 PDF bait documents targeting different objectives between August and September this year, with instances of producing dozens of documents in just a few minutes. From June 8 to 12 this year, there were also cases of using three disguised companies to initiate fake recruitment invitations to professionals in AI, blockchain, and cybersecurity. Additionally, Microsoft analyzed that North Korean hackers might use AI programming tools like Cursor to assist in code generation, debugging, and evading detection; the North Korean Reconnaissance General Bureau's "Onyx Sleet" (referred to as Andariel by South Korea) and "Pearl Sleet" have been using the open-source AI penetration testing framework ARTEX in real operations since late October. Microsoft believes that while these organizations have enhanced their attack speed and efficiency with AI, they have not yet entered a fully autonomous attack phase and recommends that companies strengthen identity verification for job applicants, phishing protection, and malicious code detection.

Elon Musk retweeted reports related to the Binance hacking incident and commented, "Everyday is Zeroday." A zero-day vulnerability is a technical term in the field of cybersecurity, referring to a security flaw in software, systems, or hardware for which developers or vendors have not yet provided a fix, and attackers may exploit this vulnerability to launch attacks.It is called zero-day because when the vulnerability is discovered or known, there is no time for the vendor to fix it in advance (0 days).

According to the American technology media Wired, a contractor from Accenture (ACN.N) accidentally leaked Pentagon access credentials through the personal use of the Anthropic Claude AI entity.The AI entity operated on the U.S. Department of Defense network for two months and transmitted intelligence information and system architecture diagrams to a third party.

Polymarket trader Car posted on platform X that approximately $800,000 in assets from his Polymarket account were stolen, all positions were sold, and his friend's account was hacked for about $600,000. He reminded users to lock their accounts and refrain from interacting with the website for the time being.Additionally, several users reported on platform X and the Polymarket Discord community that the website's front end appeared to be under attack, with assets being transferred out without authorization. Some users claimed to have lost around $200,000, while others reported receiving unauthorized withdrawal signature requests on the official website. As of the time of publication, Polymarket officials have not yet responded. In June of this year, Polymarket was previously targeted by a phishing attack on the front end due to a third-party vendor being compromised, resulting in the theft of approximately $2.94 million in user assets.

The cybersecurity company XBOW disclosed that it has found a critical remote code execution vulnerability in a publicly accessible web application of the U.S. Election Assistance Commission (EAC) that can be exploited without authentication.This application is used for resource and logistics calculation, not for voting machines or voter registration systems.

Due to the detection of increased attempts of network attacks, the Indonesian cryptocurrency exchange Indodax has temporarily suspended user deposits and withdrawals to conduct security assessments and risk mitigation work.The platform stated that currently, user asset security is intact, and no unauthorized withdrawals or data breaches have been detected. The deposit and withdrawal services will resume once the system security is confirmed, and further updates will be released through official channels.

Allium CEO and Co-founder Ethan Chan stated that Allium discovered a security incident on October 25, involving unauthorized access to some of its systems. Allium immediately took measures to limit access and protect the systems, has directly notified affected customers, and continues to provide updates and support.Allium has engaged an independent cybersecurity firm to assist with the response and investigation, focusing on strengthening security controls such as authentication and monitoring. After the investigation is completed, it plans to share a summary of the findings and response measures. Allium stated that its core platform, including Allium App, Explorer, and Explorer APIs, has been restored, although some features remain temporarily unavailable during the recovery period, with the latest availability and updates published on the status page. Ethan Chan expressed apologies for the disruption caused by the incident and stated that maintaining customer trust requires clear communication and ongoing follow-up.

Binance founder Changpeng Zhao posted on X reminding not to click on links in emails or download attachments.Changpeng Zhao stated that even if the email comes from a trusted person, the other party's computer may be infected with a virus without their knowledge.

Alphabet CEO Sundar Pichai stated that the new AI model Carbon is being launched first to cybersecurity partners.

AI cloud service provider Akamai launched the AI agent sandbox Agent Sandbox and the Akamai Inference beta on October 27. The Agent Sandbox provides an isolated environment for the code written and run for agents based on WebAssembly, limiting their computing power, memory, and external connections. Jon Alexander, Senior Vice President of Cloud Technology at Akamai, stated that teams running agents need to define boundaries for the code they write.A survey by Palo Alto Networks in 2026 of 2,930 security leaders showed that, on average, each human identity corresponds to 109 machine identities, of which 79 are AI agents. Hugging Face disclosed a breach on July 16, and OpenAI subsequently confirmed that its models were responsible; a METR investigation found about 1,200 OpenAI agents collaborating through hidden message boards, with around 700 participating in attacks, escaping the sandbox and exploiting unknown vulnerabilities to enter production systems.Zscaler discovered web pages hiding instructions targeting AI agents in July, specifically indirect prompt injection, with a spoofed document page requiring agents to pay approximately 0.0012 Ethereum as a $3 licensing fee, and 4 out of 26 tested models complied. Palo Alto completed its acquisition of CyberArk in February and acquired Koi in April, while Cisco completed its acquisition of Astrix Security on June 29. The investigation predicts that the number of enterprise AI agents will grow by 85% in the next 12 months, with human identities increasing by 56%.

An email from a Federal Election Commission (FEC) official shows that hackers are attempting to infiltrate U.S. election websites.

Seoul police arrested 7 suspects accused of using generative AI to launch hacking attacks. The Seoul Metropolitan Police Agency stated that about 90 organizations were involved, collectively stealing 8.2 million records, marking the first large-scale arrest of suspects in AI-assisted hacking attacks in South Korea. The targeted victims included hospitals, universities, private tutoring centers, golf courses, and subsidiaries of large corporate groups, all of which held a significant amount of personal information, including names, contact details, and records of ordinary citizens. One funeral service company lost 1.22 million records, and reports indicated that the tutoring center's data also contained information on minors.According to local media reports, the main suspect, 32 years old, studied arts and sports and has no IT background. He told investigators that he self-taught hacking techniques through YouTube and online blogs, while police pointed out that he had worked in a security company conducting simulated attacks from 2019 to 2022. He initially used website vulnerability scanning tools and later introduced AI coding proxies and an automated penetration testing system called Artex at the end of August. Police stated that he hacked into 60 companies over a span of 44 days from August 31 to October 13.The entire attack operation lasted about 13 months, from September 2025 to this October, and the case was filed in June after a victim reported it. Police indicated that such a large-scale attack previously required a hacker group to accomplish, but AI now allows one person to achieve this in a short time. The suspect sent emails to 38 victims, collectively extorting 360 million Korean won, approximately 272,000 US dollars, but the only confirmed payment was 300,000 won, about 210 dollars. The main suspect was detained and transferred to prosecutors last Friday, facing charges of violating South Korea's Information and Communication Network Act, as well as extortion and attempted extortion. Police will continue to investigate the other 6 accomplices and confirm more victims, with 15 institutions already reporting damages.

The vulnerability bounty platform Immunefi's CEO Mitchell Amador warned that internet users still face the risk of cyberattacks triggered by PHP vulnerabilities, especially small websites that are slow to adopt emergency upgrades, which may take weeks to patch. He stated, "The vulnerability apocalypse" is coming as planned, where the cost of discovering vulnerabilities becomes cheap while the cost of fixing them remains high. He advised users to treat any websites they log into in the coming weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting to encrypted wallets, and revoke token authorizations that are unrecognizable.Previously, the PHP Foundation admitted that it delayed fixing a critical security vulnerability first discovered in 2024 due to resource shortages. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website still needs to complete the upgrade on its own. Cloudflare CEO Matthew Prince stated that within 24 hours of the PHP vulnerability being publicly disclosed, the web recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs, PHP supports about 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites.The FBI's Cyber Division also warned that these vulnerabilities could allow malicious actors to "remotely execute code in the PHP core, potentially compromising sensitive data and networks." Amador warned in an interview with Cointelegraph in June that the proliferation of cutting-edge AI models has changed the cybersecurity landscape, giving attackers an advantage, leading to the emergence of the "vulnerability apocalypse," and triggering a resurgence of DeFi hacking attacks. Immunefi is the world's largest vulnerability bounty platform, having paid out $140 million in bounties to 650 protocols to date.

Reuters reported on October 23 that Elizabeth Barron, the Executive Director of the non-profit organization PHP Foundation, which supports the open-source language PHP, stated in an email interview on Friday that the foundation is severely underfunded. She mentioned that recent events indicate a high reliance on PHP by businesses and governments, and given this reliance, PHP's funding is clearly insufficient.Barron noted that the foundation currently has only one full-time employee, which is herself, along with 14 part-time contractors, with funding coming from donations and grants. The increase in coding related to artificial intelligence has roughly doubled the foundation's workload. The number of code change proposals received by the PHP project is nearly double that of a year ago, but the number of contributors has not doubled. She stated that reviewing code contributions and bug reports requires a significant amount of manual input and expertise.Reuters reported that two serious vulnerabilities in PHP were discovered this week, prompting urgent patches for websites worldwide, highlighting the critical importance of this nearly thirty-year-old open-source language to the internet. The article stated that PHP may support approximately 70% of websites globally, and there is currently no evidence that these vulnerabilities were exploited before their disclosure. The report was filed by journalist Toby Sterling from Amsterdam.

The venture capital firm a16z released a chart weekly report written by Moses Sternstein on October 23, 2026. The report states that Netflix is still growing, with revenue growth slowing to just below about 12%, the lowest level since 2021 to 2022. The company is producing its own short videos and entering live sports. The report cites BCG data indicating that the upper limit of media consumption in the U.S. is about 26 hours per week, showing a moderate decline since the peak of lockdowns. Moses Sternstein: Competition comes not only from other streaming services but also from short videos, with much of the recent media growth coming from background consumption while driving or working.In terms of computing power, the report cites Ornn Data stating that the rental price of every GPU in the chart series is higher than at the beginning of the year, including the oldest A100, which is about 9% to 143% higher compared to a 6-year straight-line depreciation. Moses Sternstein: Over a longer period, older A100 and H100 GPUs spend more time below that line, but have only shown significant strength since April this year, making comparisons over a longer period not entirely fair. According to OpenRouter, token demand surged sharply in spring, jumped again after a brief plateau at the end of summer, with token consumption for both open-source and closed-source models still following an exponential path, and the share of proprietary models slightly increased last week. The author states that OpenRouter only covers a very small portion, and these indices are not perfect proxies for actual token spending and GPU pricing.In manufacturing, the report states that computer production capacity and utilization rates are rising, with production increases being larger. The increase in communication and semiconductor production mainly comes from expansion, while the price increase for electrical equipment is the largest, but domestic production has slightly declined. The import increase of key categories of AI capital expenditures mentioned above far exceeds the domestic production increase in dollar terms. According to ADP, the increase in average weekly hours for industries related to AI construction is greater than that of other industries, and is generally greater than the net increase in personnel. Job switchers in manufacturing have about a 5 percentage point wage growth premium compared to stayers. Cybersecurity stocks remain strong in IGV this year, but have seen a larger pullback than the market since October. The revenue growth rate of large companies has mostly only increased by a few percentage points, with some experiencing declines, and stock price performance reaching up to about 125%, with Palo Alto Networks' revenue growth largely driven by acquisitions.

The National Information Security Vulnerability Sharing Platform (CNVD) released a security announcement titled "Analysis and Repair Suggestions for PHP Remote Code Execution Vulnerability," in which it supports affected users to closely monitor official information, download and update to the latest version through official channels. Users who are temporarily unable to update can take measures to reduce certain attack vectors, mitigate vulnerability threats, and continuously monitor for abnormal PHP process exits, abnormal system command calls, unfamiliar process creations, and abnormal file writes, while retaining logs for traceability analysis.In its protection recommendations, CNVD stated that information system operating units should further strengthen security protection, comprehensively sort out their network assets, and reduce the public exposure of information systems according to the principle of not connecting to the internet unless necessary. Operating units that are currently unable to repair should take temporary response measures such as network isolation, network access restrictions, and taking unnecessary business systems offline.

The U.S. Securities and Exchange Commission (SEC) announced the inspection priorities for the fiscal year 2027, continuing to conduct risk-oriented inspections of over 34,000 registered entities, focusing on investment advisors, funds, brokers, clearing agencies, and other market participants.The SEC stated that the fiscal year 2027 will focus on the fiduciary duty and conflicts of interest of investment advisors, retail investor protection, private funds and private credit, brokers' anti-money laundering and transaction supervision, operational resilience, and cybersecurity, among other areas. Emerging technologies and market infrastructure are also listed as priorities.Among these, the SEC will pay attention to the impact of advanced technologies, including "superintelligence," on market operations, compliance, fraud prevention, and investor protection, while also assessing the risks brought by government bond clearing reform, tokenization, and related changes in market structure.