fog

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

The security organization SlowMist has released an in-depth threat intelligence report on the DarkSword Trojan backend and iOS attack chain. The report tracks the evolution of this attack infrastructure and reveals its high danger to cryptocurrency asset users.According to SlowMist's analysis, after the relevant exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be operational by late September.The SlowMist team not only tracked its online infrastructure but also correlated its management panel with public GitHub repositories, dissecting the exploit code, delivery chain, and post-compromise capabilities. The report highlighted several key findings of this attack framework: a highly automated complete attack pipeline that integrates vulnerability delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation functions.The extensive and deep data theft capabilities of this toolkit target not only keychains, files, and information but also specifically cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds. Although the toolkit claims to support iOS 13 and above, code analysis confirms that its actual effective exploit window is concentrated in the iOS 18.6--18.7.2 and iOS 26--26.1 version ranges. The publicly available vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the threshold for launching complex iOS attacks.In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser could trigger vulnerabilities. If a device has accessed suspicious landing pages, users should consider their mnemonic phrases and private keys as compromised and must create new wallets and transfer assets using a clean device that has never accessed that page.Additionally, users should thoroughly check for abnormal transactions and token authorizations across various chains and immediately revoke unnecessary authorizations.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

The Chief Information Security Officer of Slow Mist Security, 23pds, stated that if the modification of the Ledger device's PCB is indeed as described by former Mt. Gox CEO Mark Karpelès, the attacker would possess a considerable level of technical skill.23pds mentioned that the possible attack process involves the wallet generating a mnemonic phrase within a secure element and displaying it on the screen for the user to write down. A malicious module could obtain the displayed content through screen data lines such as SPI, record the complete mnemonic phrase, and then send the data to the attacker via LTE/eSIM. The secure element can prevent the private key from being directly read or exported, but it cannot stop external modules from accessing the information currently displayed on the screen. He noted that the above analysis is based on the premise that the PCB has indeed been modified in the described manner, and the relevant attack paths and hardware implantation still require independent verification.Mark Karpelès previously stated that a Ledger hardware wallet he received was suspected of being implanted with a spy module. The device came from Malaysia, the outer packaging was intact with shrink wrap, and the implant was hidden in the position where the screen originally had a cushion, containing LTE communication components, an antenna, eSIM, and a microcontroller connected to the Ledger SPI bus, capable of analyzing the characters displayed to the user and sending relevant data after the mnemonic phrase setup is completed.

Bitcoin News posted on platform X that U.S. federal prosecutors informed Judge Katherine Polk Failla that the U.S. Court of Appeals for the District of Columbia upheld the conviction of Bitcoin Fog founder Roman Sterlingov on September 25, supporting the trial of Tornado Cash defendant Roman Storm in New York.The appellate court determined that the District of Columbia had jurisdiction to prosecute, reasoning that law enforcement had deposited approximately $250 worth of Bitcoin into Bitcoin Fog from the District of Columbia. Prosecutors stated that user Shakeeb Ahmed accessed Tornado Cash from his apartment in Manhattan, thus the same logic applies. Roman Storm released this letter and noted that FinCEN withdrew the mixer report request made in 2023 on the same day, citing that the proposal could hinder legitimate activities.

U.S. federal prosecutors cited the appellate ruling related to the cryptocurrency mixer Bitcoin Fog as a supplementary basis against the not guilty motion of Tornado Cash developer Roman Storm. In documents submitted on Monday, the prosecution referenced the September 25 ruling by the appellate court that upheld the conviction and sentencing of Bitcoin Fog operator Roman Sterlingov. The District of Columbia Circuit Court found that Washington, D.C. had jurisdiction over all four charges: the money laundering charge was based on undercover agents completing Bitcoin Fog transactions in its D.C. office, while the unlicensed money transmission charge was supported by sufficient evidence showing that Bitcoin Fog had served clients in the area.The prosecution stated that the ruling "directly supports" its position in the Storm case, arguing that Tornado Cash's activities in Manhattan were sufficient to establish jurisdiction in the Southern District of New York for the conspiracy charges of money laundering and unlicensed money transmission against Storm, citing the testimony of Shakeeb Ahmed, who claimed to have used Tornado Cash in a Manhattan apartment. Judge Katherine Polk Failla has heard the arguments for the not guilty motion in April 2026 but has yet to rule. In August 2025, the jury found Storm guilty of conspiracy to operate an unlicensed money transmission business, but deadlocked on the charges of money laundering and conspiracy to evade sanctions; Storm submitted a post-trial not guilty motion in September 2025, arguing that the prosecution failed to prove he intended to assist criminals in abusing Tornado Cash.

According to Cointelegraph, blockchain security company SlowMist stated that its investigation has not linked the recent security warning caused by the iPhone Safari attack to confirmed cryptocurrency theft incidents.SlowMist told Cointelegraph that it has not independently confirmed any victims affected by the specific Safari attack samples it analyzed, and the strongest technical evidence it possesses covers iOS versions 18.4 to 18.6.2. The company stated that the reported impact range of "iOS 13 to 26.5" should be regarded as a preliminary assessment, and it tends to avoid claiming that iOS 26.5 is affected until reproducible technical evidence is obtained.SlowMist pointed out that the Safari attack reused the previously disclosed DarkSword exploit chain technology, which is independent of another investigation involving malicious components embedded in App Store applications called FomoPeek. The Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain used by multiple threat actors since November 2025.

Slow Mist's Yuxian posted on platform X, stating that the related application is FomoPeek, and Slow Mist has never referred to it as the FOMO App. Overseas related security KOLs and media have misrepresented this.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X stating that the black and gray industries have established an attack chain against iOS users: clicking on links to extract private keys and mnemonic phrases; when users access web pages using Safari, they gain JS layer read and write capabilities through WebKit/JSC memory corruption; bypassing PAC to obtain native call capabilities; escaping the WebContent sandbox; escalating privileges in the kernel to gain root access, stealing Keychain and wallet data.The affected versions are iOS 13 to 26.5, and it is recommended that iOS users upgrade as soon as possible.

According to SlowMist monitoring, a Brazilian banking malware operation, active since at least May 2025, known as REF9334, has recently been disclosed. Its KREMLIN malware ecosystem uses a multi-stage loader and malicious browser extensions to steal credentials, session tokens, and sensitive data. The malicious extensions can be installed into Chrome and Edge without user approval by bypassing the Chromium integrity mechanisms, including Secure Preferences, HMAC, and App-Bound encrypted hashes.The operation also uses Ethereum smart contracts as "dead letter parsers" to dynamically update C2 endpoints and payload hosting locations. After registering the network Canary domain name, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. SlowMist recommends that security teams monitor related malware, browser extension activities, and infrastructure associated with this operation.

According to Slow Mist's warning, two attackers have been detected replicating the recent Notional Finance vulnerability attack method on the BSC chain. The attackers have completed their preliminary preparations and created malicious fCash positions using the same vulnerability pattern. Currently, the attack has not been fully executed, and the malicious positions are awaiting expiration.Once expired, the attackers may settle the positions and withdraw assets from the protocol. Slow Mist strongly recommends that affected projects take immediate mitigation measures to complete protection before the positions expire.

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

Fogo's official announcement states that the Fogo mainnet has been restarted and is operating normally. A total of 400 million FOGO tokens were stolen in this incident, of which 237 million have been recovered and permanently removed from the total supply.The official statement indicates that they are working with centralized exchanges and law enforcement to continue recovering the remaining affected assets. The investigation is still ongoing, and further information will be released through this official channel; please rely solely on updates from this channel.

According to The Defiant, the Fogo mainnet has stopped producing blocks for about 46 hours since Saturday afternoon due to an attack on the Fogo Foundation, resulting in 4 million FOGO tokens (approximately 10.3% of the circulating supply) being transferred to the attacker's address. The foundation initially stated that the chain itself was unaffected, but 15 hours later, the network was actively paused, and plans were made to restrict the related addresses through an upgrade. Currently, the Fogo official explorer shows the last block as 718,525,971, and the RPC endpoint returns a 502 error, while the on-chain TVL tracked by DefiLlama has been frozen at $987,000 for three consecutive days.This downtime is attributed to Fogo's validator design: the chain is managed by a council of 7 voting validators, with the foundation staking evenly among 7 operators, allowing for coordination to pause and implement a client-level address blacklist within minutes. On the exchange side, both KuCoin and Gate have disabled FOGO deposits and withdrawals but retained trading, with a 24-hour spot trading volume of approximately $2.3 million. Meanwhile, a Twitter account impersonating the Fogo Foundation, @FcgoFNDN, posted a false compensation voting link, and Fogo officials reminded users to rely only on information from official channels.Fogo is the second network to actively pause over the weekend, following Cronos, which rolled back its state due to an attack on the Tectonic lending protocol. Fogo raised approximately $7 million by selling 2% of its supply through Binance before launching its mainnet in January, with a valuation of $350 million. The foundation has not yet disclosed details of the attack, compensation plans, or a restart timeline.

According to SlowMist's YuXian monitoring, a certain hacker address is involved in a mass theft incident, affecting over 100 addresses and dozens of real users, due to private key leakage, with hackers profiting approximately $200,000.This gang is an old gang, and the stolen users can try to identify commonalities.

SVM public chain Fogo officially announced that the Fogo mainnet has been temporarily shut down as a precautionary measure due to the detection of unauthorized activity in the past hour.The shutdown aims to prevent further transfer of affected assets. During the downtime, the network will be upgraded to restrict addresses related to the incident. Fogo stated that further updates will be shared after confirming more information and urged users to rely solely on this official channel for updates.

An unknown attacker has breached the Fogo Foundation, transferring approximately 400 million FOGO tokens to a malicious address. The Fogo Foundation has notified major exchanges and is in communication with law enforcement and blockchain forensic experts.This incident will not affect the Fogo blockchain itself, and the network is currently operating normally. The Fogo Foundation will announce further developments once more information is available.

The Slow Fog security team recently disclosed the discovery of a malicious GitHub repository impersonating the "Qwen 3.8 27B local quantitative model." The repository claims that the model file should exceed 16GB, while the actual downloaded content is only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. Slow Fog emphasizes that the official Qwen project has not been compromised.Slow Fog's analysis indicates that after the malicious program runs, it will collect host information, capture the screen, and send it to the attacker's C2 server; when the hard-coded server fails, it will also read backup C2 addresses from contracts on the Polygon chain, allowing the attacker to rotate infrastructure through on-chain transactions.Subsequent payloads can steal browser login information, cookies, history, email, WinSCP, Steam credentials, as well as files and extension data related to cryptocurrency wallets. Slow Fog also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.

Arthur Hayes posted on the X platform that the FLOP tokenomics infographic for his AI/crypto project Flop Labs will be released this week. Hayes stated that there will be an AMA on X Spaces and YouTube next week to answer questions about the tokenomics and gather feedback to improve the design.