code

Android Authority reported on October 27 that it discovered a developing Overseas QR payments setting in Google Wallet version 26.42.1003171897. The "Learn more" link within this setting points to the Google Wallet support page, where this feature is referred to as Traveler QR.Google explains on the support page that relevant options will automatically appear when the phone detects that the user is in a covered area. Currently, the only explicitly named destination on the page is Singapore, corresponding to the Alipay+ partner network. Android Authority notes that Alipay is primarily used in China, while Alipay+ connects various payment systems across Southeast Asia. This discovery comes from the disassembly of the application installation package, and the features that appear in the disassembly may not necessarily make it into the public version. There has also been no official announcement regarding the release of Traveler QR yet.

According to Beating report, GitHub officially launched the multi-model scheduling system Copilot Fusion at the Universe 2026 conference. Simple tasks will be handled by the appropriate model; complex tasks can first be attempted by a lower-cost model, and if the results are insufficient, it can switch to a stronger model or allow different models to check each other.Independent evaluation agency Artificial Analysis's tests show that Fusion Max's overall programming score is 60, close to Claude Code paired with Opus 5.5 Max's score of 62. Fusion Max's average API cost per question is $5.59, taking about 36 minutes; Claude Code paired with Opus 5.5 Max costs $11.42, taking about 60 minutes, reducing costs by about 51% and shortening time by about 40%.In the evaluation, Fusion's cache hit rate was 97%, while Claude Code's was 95%. The original text also noted that frequent model switching may cause cache loss, and the above results only represent specific benchmark tests, not implying that all tasks in actual use can save half the cost.

Researchers disclosed a zero-click vulnerability in the Telegram sticker feature at a security conference held in Tokyo, demonstrating that an attacker could execute code on iOS devices without any user interaction.However, Telegram disputed the risk assessment of the vulnerability.

The Ethereum institutional privacy technology organization EthSystems announced the completion of formal verification for its privacy pool (shielded pool), ranging from written specifications to the bytecode running on the Sepolia test network. The verification used different tools in layers: models, circuits, and hashes with Lean; contracts with Halmos and Kontrol; wallets with Aeneas and Verus; and validators and deployment verified through byte-by-byte reconstruction.Double spending and value conservation have been verified by the Lean theorem prover. During the verification, a total of 6 issues were discovered, 3 of which were found in the verification tools themselves. The team also listed the assumptions that still rely on: hash collision resistance, validators rejecting forged proofs, and contract behavior being consistent with the model.

According to Slow Fog's disclosure, its security personnel discovered that the script udeskApi.2026-10-16.cached.js related to the Udesk customer service system was implanted with a malicious loader during routine threat intelligence checks. This loader hides the address through hexadecimal encoding and asynchronously loads the remote script deeps.js (sourced from udeskqlobal[.]com, note that the domain name starts with the letter q). This script reads accessible Cookies, localStorage, and sessionStorage on the page, intercepts form and login/authentication requests, and sends data to udeskqlobal[.]com/c.php. Attackers may use this to impersonate sessions or take over accounts. This data collection behavior is not restricted by the target site's rules, and unmatched pages may also be affected.According to Slow Fog's analysis, this script also targets three types of sites: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning the recharge page every 200 milliseconds and replacing identified recharge addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. At the same time, the script manipulates the clipboard API, replaces copy buttons, and intercepts copy events, making users see and copy tampered addresses. If users transfer funds to this address, the money will flow into the attacker's address.

According to Tencent news, on October 27, Tencent's cross-border payment platform TenPay Global reached a cooperation with South Korea's Samsung Wallet and Woori Bank to jointly promote the interconnectivity of cross-border QR code payments.After South Korean users come to China, they can use the Samsung Wallet Money e-wallet within Samsung Wallet to scan the WeChat Pay collection code or show the payment code to merchants, allowing them to spend at tens of millions of WeChat Pay merchants within China.

According to Bitcoin.com News, a cooperative project in Thailand has launched a digital wallet application called WORPT, allowing foreign tourists to exchange stablecoins such as USDT and USDC for Thai Baht and make payments to local merchants through Thailand's QR PromptPay network. The application was launched under the Thai Securities and Exchange Commission's tourist Digipay regulatory sandbox program, jointly developed by Waan Exchange and Wipay, with partners including Tether, The Mall Group, and Visa.According to the sandbox design, local merchants do not directly accept cryptocurrencies, and payments are settled in Thai Baht through standard payment systems. WORPT also plans to launch physical and virtual Visa prepaid cards, allowing users to share the same Thai Baht balance for QR code payments and card transactions. The project is scheduled to hold an official launch event in November 2026 and must comply with the sandbox requirements for identity verification, transaction monitoring, and anti-money laundering rules.

According to Beating reports, Zhipu announced that its AI programming tool ZCode provides each user with 300 million GLM-5.3-Flash Tokens for free every day.This quota can only be used within ZCode and is available for only 10 hours each day. Users can start claiming it at 19:00 Beijing time, and it can be used from 23:00 to 09:00 the next day. Users need to update the client, switch to Global Building after claiming the quota, and select the GLM-5.3-Flash model.

Anthropic publicly submitted its Nasdaq IPO application, with the stock code "ANT".Anthropic's revenue for the first half of the year was $16.3 billion. Anthropic may not be able to achieve or maintain profitability in the future.As of June 30, 2026, Anthropic reported a net loss of $80.7 billion for the six-month period. Goldman Sachs and Morgan Stanley are leading Anthropic's IPO.Anthropic disclosed that the company expects to pay Google up to approximately $11.45 billion before 2033 and to pay approximately $161.2 billion in rent under its leasing arrangements with Broadcom during the lease term (excluding interest).Anthropic stated that computing and infrastructure costs are expected to continue to increase in absolute terms and will become the company's largest operating expense in the foreseeable future. The company believes that its existing cash and cash equivalents are sufficient to meet operational funding and other needs for at least the next 12 months, but also warned that it may need to seek additional financing earlier than currently anticipated.In terms of safety, Anthropic mentioned that it has recently delayed the pre-training of its next-generation cutting-edge foundational model by more than a month to strengthen safety measures and prevent the leakage of model weights. The company also noted that as AI systems gradually automate AI research and development, associated risks will increase.

According to documents disclosed by the U.S. Securities and Exchange Commission (SEC), Cryptex Digital Market Cap ETF submitted its sixth pre-effective S-1 amendment on October 23, intending to list on NASDAQ under the trading code "BAGZ," with Cryptex Finance as the sponsor.The fund plans to directly hold a variety of crypto assets, constructing a portfolio based on the components and weights of the Cryptex Digital Market Cap Index, and rebalancing in accordance with the index. Assets listed in the document that may initially account for 5% or more of the fund's net asset value include BTC, ETH, XRP, HYPE, DOGE, SHIB, ADA, and CTX, with specific composition and weights subject to change over time. This submission is part of a registration application update and does not represent that the SEC has approved the product or that it has begun trading.

Paradigm Chief Technology Officer Georgios Konstantopoulos tweeted that this week the EVM code generation (codegen) feature of Solar will be released, which is over 100 times faster than solc and can generate more gas-efficient bytecode without writing any assembly code.

OpenAI posted on the X platform that during a recent red team exercise, a vulnerability was discovered in the widely used compression library Brotli that allows remote code execution without authentication. Software such as Node.js, Bun, and Envoy all have this library built-in. Attackers can take over unpatched servers by sending malicious compressed data, and they can also take over clients that accept compressed data through malicious servers.OpenAI stated that the root of the issue was fixed in the Brotli source code in February of this year, but it was not identified as a security vulnerability at that time, and all software that includes this library needs to be updated accordingly. According to The Hacker News, the vulnerability is numbered CVE-2026-111497, and Node.js released a patched version on October 21.

Zipcoin announced that it has ceased operations, stating that the project’s code repository and related keys have been fully compromised, and attackers may control the project’s wallets and infrastructure. The team indicated that they attempted to migrate the code and rotate credentials in the past 12 hours but failed to find a viable security solution.Zipcoin also disclosed that the project was affected by the UNCX incident on October 15, where hackers stole approximately 1.1% of the supply of multiple Ethereum tokens, including ZC, PAAL, and EDGEN, and sold them on the open market. The team subsequently attempted to buy back tokens from the market to compensate for the token shortfall corresponding to future team commitments.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

Tencent Cloud Security Center has detected that PHP has been disclosed to have remote code execution vulnerabilities, with vulnerability IDs CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". This can allow unauthenticated remote attackers to trigger memory corruption and ultimately achieve remote code execution by sending specially crafted multipart POST requests, thereby completely controlling the server and causing other harms.Tencent Cloud Security recommends conducting timely security self-checks. If you are within the affected range, please update and patch promptly to avoid being invaded by external attackers.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

An alliance composed of core banking and instant payment software company Matera, embedded payment company Payfinia, and Solana Foundation conducted the first public live demonstration of the American National Standard ANSI X9.150 at Money20/20 USA in Las Vegas. The demonstration showed that a single QR code on an invoice allows customers to pay via FedNow, RTP network, or with USDC on Solana, with the business invoice records automatically updated afterward.The report states that X9.150 was approved by the American National Standards Institute's standards committee X9 in July 2026, providing a unified QR code payment format for banks, payment networks, and software providers, covering account-to-account payments such as FedNow, RTP, ACH credit transfers, Zelle, and stablecoins. In the live process, small businesses send invoices with X9.150 QR codes, and customers can scan them using their credit union banking app or pay and confirm with USDC using the Squads Altitude wallet, with funds arriving within seconds, and the ERP marking the invoice as paid.Carlos Netto, Co-founder and CEO of Matera North America: The company has open-sourced the X9.150 reference software because a standard built by only one company is not a true standard. Jamal Raees, General Manager of Payments at Solana Foundation: X9.150 provides American businesses with a single QR code that can be used across payment rails, allowing customers to scan and pay with USDC, marking the invoice as paid within seconds. Payfinia provides embedded payment support for nearly 30 community financial institutions and stated that testing has been completed using the Star One Credit Union mobile app. The report clarifies that this demonstration is not a product launch. Participants in the X9.150 QR code alliance include Matera, Payfinia, Zelle under Early Warning, and Solana Foundation.

According to Hyperliquid News, entropyIO purchased the MOONSHOT ticker for 574.98 HYPE (approximately 46,068 USD). This is a new HIP-3 ticker added by Hyperliquid.

The security organization SlowMist has released an in-depth threat intelligence report on the DarkSword Trojan backend and iOS attack chain. The report tracks the evolution of this attack infrastructure and reveals its high danger to cryptocurrency asset users.According to SlowMist's analysis, after the relevant exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be operational by late September.The SlowMist team not only tracked its online infrastructure but also correlated its management panel with public GitHub repositories, dissecting the exploit code, delivery chain, and post-compromise capabilities. The report highlighted several key findings of this attack framework: a highly automated complete attack pipeline that integrates vulnerability delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation functions.The extensive and deep data theft capabilities of this toolkit target not only keychains, files, and information but also specifically cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds. Although the toolkit claims to support iOS 13 and above, code analysis confirms that its actual effective exploit window is concentrated in the iOS 18.6--18.7.2 and iOS 26--26.1 version ranges. The publicly available vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the threshold for launching complex iOS attacks.In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser could trigger vulnerabilities. If a device has accessed suspicious landing pages, users should consider their mnemonic phrases and private keys as compromised and must create new wallets and transfer assets using a clean device that has never accessed that page.Additionally, users should thoroughly check for abnormal transactions and token authorizations across various chains and immediately revoke unnecessary authorizations.

The XRP Ledger vulnerability fix package named fixCleanup3_4_0 is expected to officially take effect around 09:34 UTC on October 23. This fix package has received votes from 29 validators, surpassing the threshold of over 80% approval among the network's default 35 validators, and must be maintained continuously for two weeks. The countdown has been ongoing for nine days. Since there is no margin in the vote count, if any validator withdraws support, the countdown will restart.This fix package partially addresses the unsecured lending system that Ripple has been promoting to banks and payment companies since June, but this system has not yet been activated. Currently, the lending amendment has only 19 votes, and the vault amendment for holding funds has 21 votes, neither of which has started the countdown. Therefore, even if both reach 29 votes today, the lending function will not be available until early November at the earliest.As designed, lenders will deposit XRP or other tokens into the vault, and loan brokers will then lend out the funds for a fixed term. The ledger is responsible for recording the loans and tracking repayments, while brokers assess the borrower's qualifications off-chain. Since borrowers do not need to provide collateral, the broker's judgment becomes the only guarantee for lenders against default losses. Ripple has promoted this scheme to payment companies that need liquidity during cross-border settlement. Additionally, the fix package also closes a vulnerability that allowed accounts authorized to destroy tokens to create new tokens under specific conditions and adjusts the rounding of vault amounts as well as the rules for determining loan overdue and default.