vulnerability

Scroll announced that it received a vulnerability bounty report on November 3, indicating that there was a vulnerability in the bundle proof validator deployed on the Ethereum mainnet, and it registered a fixed validator for batch version 10 on November 10. Scroll stated that it has confirmed that the vulnerability was not exploited on the mainnet.According to the report, the vulnerability could allow old valid proofs to be accepted for new public inputs, thereby allowing the final confirmation of any state root and withdrawal root. Exploiting this vulnerability requires having a permissioned prover role or enabling the forced batch mode after 7 days without final confirmation.Scroll stated that the forced mode was never enabled, and all 748 final confirmations during the period of the vulnerability used normal proofs, with previous versions of the validator unaffected.

AnomaPay disclosed on platform X that it has discovered an external security vulnerability in the RISC Zero proof system it uses, which may jeopardize user funds. To protect users and ensure the safety of funds, the risc0 validator behind Anoma has been suspended and will be upgraded by the RISC Zero team.AnomaPay stated that the funds deposited by users are safe, but they will be temporarily inaccessible until the Anoma protocol is upgraded to version V2, which includes the new security updates from RISC Zero. The upgrade is expected to take about two weeks. Although this downtime is not ideal, it is necessary to protect user funds. Users do not need to take any action; funds will be automatically migrated to V2 and access will be restored after the upgrade is completed.

According to the Bitcoin Core security announcement, the medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026. This vulnerability exists in versions prior to 29.2 and 30, where malicious nodes can exploit witness malleation in compact blocks to stall the block processing of victims under specific conditions.The announcement states that affected nodes will clear the download status after rebuilding the compact block and before checking the witness data. If the check fails, the node will revert to requesting the full block from the same node and wait for a 10-minute timeout. If the attacker controls three high-bandwidth peer nodes of the victim, or if the victim is running in -blockonly mode, this attack can be repeated indefinitely.This vulnerability was discovered and responsibly disclosed by Eugene Siegel, and the fix has been included in Bitcoin Core versions 29.2 and 30.

On November 9, 2026, Google released an emergency stable channel update for the desktop Chrome browser, fixing nine security vulnerabilities, including a zero-day vulnerability that was already being exploited in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.8103.5/.51, and to 157.8103.5 on the Linux platform, and will be gradually rolled out over the next few days to weeks. The core focus of this update is the high-risk vulnerability numbered CVE-2026-125350, which is a use-after-free issue in an XML component. Google explicitly stated in the announcement that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, the scale of victims, or attribution of the attack activities.The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the fix. Among the nine fixes, seven are classified as "high risk" and two as "medium risk." In addition to CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also pertains to a use-after-free issue in an XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an actively exploited vulnerability. The other high-risk vulnerabilities include uninitialized resources in WebGL, improper FileSystem authorization, synthesizer buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.Google also confirmed that the Android version of Chrome (157.8103.5) released on the same day includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the update released separately on November 9, with Windows and Mac versions being 156.8078.96, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Security Incident Coordination Centre (GovCERT.HK) issued a security alert on the same day, defining affected systems as versions prior to Chrome 157.8103.5, and pointed out that successful exploitation of the related vulnerabilities could lead to remote code execution, denial of service, tampering, or bypassing security restrictions. The Hong Kong Computer Security Incident Coordination Centre (HKCERT) rated the risk level of this update as "extremely high risk." Google explained in the announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check and trigger the update via "Settings → About Chrome," and restart the browser after completing the update for the patch to take effect. For users still running versions prior to Chrome 157.8103.5, the current priority action is to confirm the version number and restart immediately to complete the upgrade.

According to Apple's security announcement, the iOS and iPadOS 27.2.1 update fixes multiple security vulnerabilities, one of which is a Messages vulnerability that could allow remote attackers to join iMessage group chats and receive messages.Another Messages vulnerability could allow new users joining a group chat to read messages sent before they joined. Apple also fixed issues where malicious Bluetooth devices could pair without user interaction, and where attackers within Bluetooth range could bypass pairing code attempt limits. Apple stated that the above update was released on November 9.

Confidential AI Infrastructure NEAR AI updated on platform X, stating that on November 8, an attacker exploited a vulnerability in its inference engine SGLang to access part of the infrastructure.NEAR AI has indicated that it has revoked relevant access permissions and completed the repairs. Affected users have been notified, and users who have not received notifications do not need to take any action.

The Chief Information Security Officer of Slow Fog, 23pds, reminds that malicious IPA can utilize worse_query to read other application containers, and plaintext stored wallet data may be at risk.

GreyNoise reported that the Alpine SSH password bypass vulnerability has been successfully exploited, and Previdian has also detected 20 exploitation attempts.

The Bitcoin wallet Electrum announced the release of version 4.8.4 on platform X, stating that this is another security update. According to the GitHub changelog, the release date of this version is November 6, and it fixes vulnerabilities related to Lightning Network onion messages: malformed onion messages from arbitrary sources may cause Electrum to disconnect from its channel peer nodes.Electrum will currently discard all incoming onion messages until practical use cases are implemented. In addition, the new version also fixes issues such as the failure to recover some mnemonic phrases from versions prior to 2. The previous version of Electrum, 4.8.3, was released in late October and fixed a high-risk vulnerability that had been exploited in the wild.

Binance founder CZ retweeted a warning about a critical vulnerability in Microsoft Paint, stating: "The application cannot protect you from operating system vulnerabilities, please update your operating system immediately."It is reported that Microsoft has disclosed a Windows Paint vulnerability numbered CVE-2026-83844, with a CVSS score of 8.1, affecting versions of Microsoft Paint below 11.2605.91. The vulnerability stems from an out-of-bounds read issue, which could allow an unauthenticated attacker to remotely execute malicious code without user interaction. Microsoft has released a security patch, and there have been no confirmed reports of the vulnerability being actively exploited. CZ uses this to remind users that application layer security measures cannot replace the security updates of the operating system itself, and system and software patches should be installed promptly.

Alpine Linux Warning: Under certain configurations, attackers can bypass SSH password authentication. The official recommendation is to update OpenSSH and restart the service.

According to Carlos's monitoring, its old hot wallet was emptied early this morning, suspected to be a large-scale attack initiated by "noble.base.eth," and is believed to be related to the Railway vulnerability. Carlos stated that the transfers were signed by its own wallet, and the incident falls under the category of theft due to mnemonic phrase or private key leakage.Within about 70 minutes, 96 wallets were emptied, and all victim wallets exhibited the same pattern. Carlos advised users holding hot wallets to rotate them immediately. The attacker prioritized using Relay as the withdrawal channel, and Relay subsequently stated that it had banned the related wallets.

Floki posted on the X platform stating that it is investigating a vulnerability exploitation incident. Currently, the related bot services have been taken offline, and the team is taking measures to protect the remaining user funds and confirm the specific affected users.Subsequently, affected users will be migrated to a new secure wallet, and the remaining funds will also be transferred to them. Floki reminds users not to deposit funds into the bot wallet until further notice; if users have exported their private keys and still have funds in the wallet, they should immediately transfer them to a wallet they fully control. The official emphasizes that the team will never proactively message users or ask for mnemonic phrases or private keys, and users should ignore anyone claiming to provide "refund" or "recovery" services.

DeFi risk management organization Gauntlet has closed the supply queue of its V1 vault, suspended asset allocation, and reduced exposure to LayerZero cross-chain bridge assets following the report of an op-reth vulnerability on certain OP Stack chains. Gauntlet stated that, to its knowledge, there have been no reports of the vulnerability being exploited.The report indicated that clearing the supply queue will prevent new deposits into the vault, but this measure will not close the withdrawal function or the underlying lending market; withdrawals will still depend on the liquidity available in the underlying market. Gauntlet stated that the relevant measures will remain in place until the issue is resolved, but did not provide a specific recovery timeline.Gauntlet is a risk curator for DeFi lending protocols, providing risk management services for vaults on protocols like Morpho, responsible for setting collateral parameters, supply caps, and asset allocation strategies. This adjustment involves its V1 vault operating on the relevant chains.

GitBook released a security incident review on November 2, stating that attackers exploited a vulnerability in its single sign-on process to forge employee login sessions, allowing them to query improperly configured GitHub App authentication information within the organization, access internal code repositories, and obtain Cloudflare API keys, ultimately gaining full production environment permissions through service accounts.GitBook disabled the relevant internal service accounts to cut off the attack within hours, resulting in the platform being offline for approximately 16 hours, and fully restored on November 3 at 11:56 UTC. The attackers remained in the production environment for a total of about 3 hours and 25 minutes. GitBook has rotated all infrastructure and revoked customer keys and API tokens.GitBook stated that current indications show the attack targeted a single customer rather than the platform as a whole, and no other customer content has been found to be tampered with. However, since the attackers could access customer data within the platform, they are treating it as if all customer data may have been exposed, including API tokens, integration keys, session signing keys, assistant Q&A records, and authorized repository permissions for GitHub and GitLab applications. Billing information, passwords, and IP addresses were not affected.GitBook noted that the speed and precision of the attack heavily relied on automation and AI. Slow Mist's Chief Information Security Officer 23pds forwarded the review, stating that the targeted entity was Trade.xyz. Trade.xyz previously indicated that the document anomaly stemmed from an intrusion into GitBook's infrastructure, and there were no signs of their own infrastructure being compromised, and they will migrate away from GitBook within a few days.

According to CoinDesk, the XRP Ledger activated a fix named fixCleanup3_4_0 at 22:52 Beijing time on November 4. This fix addressed a vulnerability: certain accounts that were originally only authorized to "burn" tokens issued by the issuer could, under specific conditions, also create new tokens. This vulnerability affected the network's permissioned delegation system, for example, stablecoin issuers could authorize payment processors to burn tokens when customers redeem them, but did not grant them the authority to create new tokens; under the old rules, accounts with limited burn permissions could mint tokens simultaneously.The vulnerability affected assets issued on the XRP Ledger, including stablecoins, but did not impact XRP itself, and there are currently no publicly confirmed exploitation cases. This fix also included accounting corrections for the planned lending system and Single Asset Vaults, as well as corrections related to automatic trading pool token recovery, permissioned transactions, and transaction signatures. The activation was completed after two consecutive weeks of support following an interruption in validator support in October.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X stating that the Android zero-click remote code execution vulnerability has been included in the November security patch, and users are strongly advised to upgrade. Google announced in November 2026 that it has fixed over 200 vulnerabilities, the most severe being the Framework layer CVE-2026-58868 (Critical), which allows remote execution of arbitrary code without user interaction and additional permissions, affecting Android 14, 15, 16, 16 QPR2, and 17. Currently, there are no confirmed in-the-wild exploits.23pds indicated that versions with a security patch level of 2026-11-01 and above include Framework/System fixes such as CVE-2026-58868; versions from November 5 and above cover all vulnerabilities in this round, including fixes at the kernel, MediaTek, Qualcomm, and other chip levels. Users can check the "security patch level" in "Settings → About Phone → Android Version."

The open-source Bitcoin payment processing tool BTCPay Server has received multiple reports of unauthorized fund theft from its Bitcoin and Litecoin hot wallets on the platform. The project team released an investigation update confirming that the attack targeted servers running BTCPay Server version 2.4.1 or earlier. The attackers exploited a vulnerability that was fixed in version 2.4.2 on August 7, gaining administrative access to the servers through various methods and draining the hot wallet funds.BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, particularly version 2.4.1, were affected; users running the latest version 2.4.7 have not reported any credible losses. Some affected service providers, including LunaNode, have automatically shut down at-risk older instances. The official recommendation for users still using version 2.4.1 or earlier is to immediately transfer any remaining funds in old hot wallets to a new wallet created with a completely new mnemonic, take the old server offline while retaining relevant logs, and then install the latest version on a new virtual machine and connect the new wallet, ensuring not to restore the old server entirely to the new machine.Simply updating the software version is not enough to eliminate the risk, as attackers may have gained persistent access to the old server. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. The vulnerability is related to a flaw fixed in August of this year, when attackers had manipulated nodes by obtaining LND administrative credentials. As of now, this vulnerability has not been assigned a CVE number and is not listed in CISA's known exploited vulnerabilities catalog.

According to disclosures from OpenAI's official website, the company has established an autonomous security research pipeline covering vulnerability discovery, dynamic verification, exploitability assessment, and patch generation. In a run centered on an upcoming network model, the pipeline completed scanning and verification of targets related to the Linux kernel, generating 948 exploits that can achieve local privilege escalation (LPE) on commonly used Linux distributions, with an API cost of approximately $1.213 million, or about $1,279 per LPE exploit.It was reported that the pipeline identified and analyzed a total of 2,308 candidate discoveries, dynamically reproducing 1,724 vulnerabilities, and producing 291 information leakage proofs of concept (PoC); the target virtual machine ran a standard desktop system with complete protection. The Scout agent initially identified about 5,034 audit targets (approximately 2.8 million lines of code, accounting for about 7% of the kernel), and the Analyst agent produced candidate discoveries in about 12 hours. OpenAI stated that it has prioritized reporting critical vulnerability patches as recommended by the Linux community and continues to advance the remaining reports in collaboration with Patch the Planet partners.OpenAI also mentioned that in the adapted kernelCTF environment, an additional 25 information leakage PoCs and 21 LPEs were obtained; among 166 sampled exploits, the agent reportedly used at least 10 newer Linux exploitation techniques that it deemed more recent. The company emphasized that maintainers are quick to fix: over 100 LPEs have been patched or entered temporary patches within about 10 days of scanning, and approximately 300 others have entered public discussion.

The blockchain vulnerability bounty platform Immunefi announced the launch of Immunefi Credits. Since the submission fee mechanism was initiated, researchers will receive an equivalent amount of Credits for effective reports, covering valid discoveries, valid reports of duplicate submissions, privately known issues, and situations where the mediation results are favorable to the researchers. The platform stated that over 700 researchers have already received Credits without needing to apply separately, and the amount can be viewed on the Credits page associated with the console balance.Immunefi stated that starting today, Credits can be used to pay for submission reports, mediation, account verification, and other fees within the platform, and will be used for related services once Immunefi Studio is open to the public. One Credit is worth 1 US dollar and can be purchased with USDC. Credits do not replace vulnerability bounties or audit competition rewards; valid discoveries will still receive rewards according to the original rules, and additionally receive Credits equivalent to the submission fees. The Credits issued retroactively will be valid for 12 months from today, and thereafter each Credit will be valid for 12 months from the date of crediting, bound to the account, and non-transferable or redeemable.Eligible situations also include valid discoveries already paid in vulnerability bounties or confirmed in audit competitions, duplicates of valid reports by others, privately known issues and their duplicates, as well as mediation fees when mediation is won. Publicly known issues, invalid reports, out-of-scope submissions, policy violations, duplicates of rejected reports, and duplicates of self-reports are not counted. Account verification fees can earn equivalent Credits when there is a valid report after verification and the accuracy rate reaches at least 25%. The fee mechanism has been applicable to vulnerability bounties since March 24 and to audit competitions since April 10, with relevant verifications currently conducted approximately every two weeks.