isc

Google's security team Project Zero announced the implementation of a new "Full X" vulnerability disclosure policy: vulnerabilities will be made public X days after being reported to the vendor. The new policy will be executed as "Full 90" starting today, shortened to 60 days on February 2, 2027, and further shortened to 30 days on January 3, 2028.The previous "90+30" policy has been canceled, and special terms such as grace periods and variant rules have also been removed. There are only three exceptions remaining: vulnerabilities that have been exploited in the wild, vulnerabilities whose details have been disclosed by others, and vulnerabilities that the vendor actively requests to be made public. Project Zero stated that AI has significantly accelerated the speed of vulnerability discovery and exploitation, and the number of vulnerabilities discovered has also increased significantly.

According to crypto.news, from November 7 to 13, 2026, the cryptocurrency industry disclosed a total of 9 financing deals, amounting to approximately $409 million, which includes corporate financing commitments and two public token sales; additionally, 4 announcements did not disclose amounts or only reported cumulative financing amounts.Project Faro received financing commitments of about $270 million from institutions such as Goldman Sachs, Citigroup, Santander, and Deutsche Bank to cover 5 years of operating costs; the project is promoted by a consortium of 21 institutions, planning to establish an issuer in the United States and launch a dollar stablecoin in the first half of 2027, followed by a euro token. This funding is a corporate commitment and has not yet been announced as fully paid.Index Industries completed a $50 million seed round financing, led by Lightspeed Venture Partners, with participation from Polychain Capital, Galaxy Ventures, and Wintermute Ventures. The project was founded by former Polychain president Josh Rosenthal and Longmark CEO Brian Hardecker, providing tokenized infrastructure for the U.S. daily home price index and housing-linked products. Alta completed a $47.5 million Series A financing, led by Index Ventures, with a cumulative financing amount reaching $80 million. The three aforementioned financing deals accounted for nearly 90% of the total disclosed financing amount for that week.

Maple disclosed that the total loan collateral of the three syrup lending pools amounts to 1.89 billion dollars, with collateralization ratios ranging from 137.7% to 156.2%.

Anthropic CEO Dario Amodei stated during a fireside chat with CEO Jamie Dimon at JPMorgan's New York headquarters on Friday that the company does not particularly care about which month or under what market conditions to go public, emphasizing that Anthropic hopes to adopt a strategy of "less commitment, more delivery."Amodei expressed agreement with the suggestion that the company's valuation should not exceed its true value by even 1 dollar. Against the backdrop of significant fluctuations in the AI sector and pressure on tech stock valuations, Anthropic remains cautious about IPO pricing.According to reports, Anthropic currently targets a valuation of approximately 1.33 trillion dollars or higher, planning to issue 825 million shares at a price of 70 to 78 dollars per share. Based on the midpoint of the price range, the fundraising scale will exceed 61 billion dollars. Additionally, investors, including Google, plan to invest about 26 billion dollars through private placements.Amodei also admitted that the investment in computing power is the company's "deepest business challenge," as the enormous expenditure on computing resources continues to put pressure on the company's finances.

Web3Auth has released the latest developments on the security incident, which previously affected some embedded wallets created through Google or Apple login due to security vulnerabilities in the infrastructure, leading to unauthorized access to some accounts. Affected services include Torus Wallet and some embedded wallets used by third-party applications like Keplr.Currently, the affected funds are securely held by the project team, which is coordinating the subsequent return process. Specific procedures are expected to be announced in the coming days, and asset rescue operations are still ongoing. In terms of services, existing users can log in and access wallets through Web3Auth Plug & Play and Single Factor Auth (SFA) SDK, but some restrictions still exist. Web3Auth SDK v9 and earlier versions have been deprecated, and developers need to upgrade to v10 or v11. Existing SFA users can log in normally, but new user registration is temporarily restricted. Developers on the Sapphire network can open new user registration by migrating to the latest SDK, while the Legacy network plans to restore this feature by November 23, 2026.Web3Auth reminds users to be vigilant against scams impersonating official asset recovery services, and not to disclose their mnemonic phrases, private keys, or login credentials to anyone, nor to trust private messages that actively offer asset recovery services.

The Federal Reserve report pointed out that the sustainability of fiscal debt has risen two places, becoming the fifth largest risk in the financial system.

Bitcoin News posted on the X platform stating that Bitcoin Core has disclosed a vulnerability: when service providers bundle Bitcoin Core with Tor, incoming Tor traffic is treated as local traffic, causing nodes with whitelist settings to relax spam and privacy restrictions towards external nodes, thereby inheriting a "trusted" status across thousands of nodes.The fix for this vulnerability was released in October 2025, and Bitcoin Core announced the details two weeks after stopping support for the 29.x series. Additionally, there is a high-severity vulnerability that may prevent mining nodes from constructing valid blocks until a restart; currently, no related attacks have been reported, and nodes without whitelist settings are unaffected.

Telegram founder Pavel Durov commented on Jensen Huang's departure, stating that the "rookie mistake" made by Huang was establishing a board of directors. Durov recalled that he was ousted by the board in 2014 for telling intelligence officers "no," and jokingly remarked about the intelligence allegations surrounding Huang that regardless of saying "yes" or "no," the board could still push founders out.Pavel Durov ultimately advised entrepreneurs: "Don't set up a board of directors; be the board of directors yourself."

On November 13, B.AI announced another upgrade to the model discount matrix. The discount for GLM-5.3-Flash has been reduced from 30% to 40%, while Hy4 is available at a limited-time 50% discount, DeepSeek-V4.1-Flash at 40% off, and Qwen3.8-Flash at 20% off, covering scenarios such as code development, deep reasoning, and multimodal agents. Leveraging intelligent routing and computing power aggregation capabilities, developers can seamlessly switch between major models with a single integration, ensuring precise routing and measurement for each call, allowing applications to be built at a better cost. You are welcome to log in to chat.b.ai/chat to experience it.

According to CoinDesk citing Bloomberg, SpaceX and Tesla may announce a merger as early as December, with the announcement possibly delayed until early 2027. The boards and advisors of both parties are formulating the terms of the deal and the management plan for the merged company. The two companies collectively hold approximately 30,220 BTC, with SpaceX holding 18,712 BTC as of the end of September and Tesla holding 11,509 BTC.Based on the reported Bitcoin price of nearly $69,000 at the time of publication, the aforementioned holdings are valued at approximately $2.1 billion, accounting for about 0.06% of the combined market capitalization of the two companies, which is $34 trillion. The merger itself does not require either party to increase their Bitcoin holdings; it will only consolidate the existing holdings on both sides' balance sheets. Tesla's board has established an independent committee to evaluate the potential merger, and the transaction must receive the committee's recommendations and necessary shareholder approval; Tesla's annual shareholder meeting is scheduled for December 3.

According to BBX data, yesterday and in recent days, global cryptocurrency treasury companies have intensively released their Q3 2026 financial reports, disclosing the latest on-chain asset reserves and operational data. The core information is as follows:· Bit Digital (NASDAQ: $BTBT) disclosed that it holds over 163,000 ETH in Q3, with a market value of $439 million: The Ethereum treasury company Bit Digital released its Q3 financial report showing that its balance sheet currently holds approximately 163,725.9 ETH. Based on the price of about $2,684 per ETH at the end of the reporting period, the total market value of its holdings is approximately $439.4 million. During the third quarter, the company did not purchase new ETH but sold 1,625 ETH at an average price of about $2,114.62 for regular cash flow and operational expenses.· Hyperion DeFi (NASDAQ: $HYPD) reduced its HYPE holdings to repay debts, with a total holding value of approximately $167.9 million: The HYPE treasury company Hyperion DeFi disclosed that as of September 30, it holds approximately 1.848 million HYPE on its balance sheet. This figure has decreased from 2.04 million at the end of Q2, and the company clearly stated that the main reason for the reduction was to sell HYPE to repay debts. Based on a market price of $90.83 per HYPE, the current value of its HYPE treasury is approximately $167.9 million (with an average holding cost of $40 per HYPE), and the company's overall net asset value is approximately $182.4 million.· BTCS (NASDAQ: $BTCS) is deeply involved in the DeFi ecosystem, with ETH holdings reaching 49,571: The Ethereum treasury company BTCS released its Q3 financial report showing that as of September 30, it holds 49,571 ETH (with a fair value of approximately $133.1 million), a decrease from 70,787 ETH at the end of 2025. Notably, BTCS has invested the majority of its assets into decentralized finance networks to generate returns: among these, 2,880 ETH is used for node staking, and 46,607 ETH is deposited in DeFi protocols (with most held as collateral in Aave). This year, BTCS has also exchanged some ETH for stablecoins for DeFi borrowing and liquidity pool deployment, and as of September 30, its liquidity pool position has reached $40.95 million.

Some NVIDIA employees are calling for former CEO Jensen Huang to return. A long-serving engineer submitted feedback through the company's internal suggestion channel before Jensen Huang's resignation, requesting the board to consider employee sentiments before taking action and to publish the survey results, formally soliciting employee opinions on Jensen Huang continuing as CEO. This matter has accumulated over 1,600 comments, the majority of which support Jensen Huang's reinstatement. Another employee sent an email to the entire company, requesting increased transparency regarding Jensen Huang's departure.Jensen Huang has led the company since NVIDIA's founding in 1993. In an email sent to employees on Sunday, he admitted to infidelity and stated that there were "no excuses." The board announced his resignation on Thursday morning, following media reports alleging that he had an extramarital affair with a direct subordinate; Reuters subsequently reported that he was also alleged to have had an affair with another NVIDIA employee. Jensen Huang has not responded to related reports since the Sunday email. The board has appointed Chief Financial Officer Colette Kress as interim CEO and appointed former Synopsys CEO Harvey Jones as chairman.

According to Cryptopolitan, the security company Island released a study on November 12, revealing 186 counterfeit domains mimicking 27 well-known AI brands. Among them, ChatGPT was the most impersonated, with 25 similar domains, followed by Claude with 18, DeepSeek with 16, and Runway with 12. Some of these similar domains redirect users to advertising pages, while others point to malicious websites.The study states that attackers implement their attacks using a technique called TypoPrompting, exploiting spelling errors made by users when entering AI tool URLs. Island tracked three related pathways: redirecting visitors to a fake Cloudflare verification page and enticing Windows users to execute PowerShell commands; promoting a disguised security check application called Net Guard, which can hijack browsers and run remote scripts; and involving 30 browser extensions that hijack searches, of which 13 have been removed, while the remaining 17 collectively have 972,000 users. Island noted that the 186 fake domains are a count of the number, not confirmed infection cases, and it has not yet been confirmed that this activity has caused any losses.

Cisco (CSCO.O) raised its revenue and adjusted EPS guidance for fiscal year 2027, and increased its revenue expectation from hyperscale cloud service providers for AI infrastructure in fiscal year 2027 to $9 billion.

According to Jinshi Data, foreign media cited two informed sources reporting that senior officials in the White House are discussing whether to ask Secretary of Commerce Gina Raimondo to resign. Raimondo has recently faced increasing criticism, and her performance in office and related regulatory controversies have raised questions among congressional members.The report stated that the relevant criticism had emerged before NVIDIA CEO Jensen Huang announced his resignation. A White House official stated that Trump still fully trusts Raimondo and her capabilities in office. The White House has not yet made a formal response regarding Raimondo's future.

Péter Szilágyi, the founder of Dark Bio and former head of the Ethereum Go client (codename Karalabe), stated that individuals holding connected smart devices should immediately remove the network connection of their devices. He suggested unplugging the Ethernet cable and disconnecting from WiFi; if disconnection is not possible, the device should be discarded. Szilágyi mentioned that a storm is coming, and the situation will be unsettling, marking the moment of reckoning for decades of negligence in the Internet of Things. Public records show that he served as the head of Go Ethereum from 2015 to 2025 and is currently establishing a personal health data analysis platform, Dark Bio.

A hacker publicly sold suspected personal information of TSMC employees on an underground forum, claiming to possess up to 46,000 records with a data volume of 6.9GB, and is asking for 3 bitcoins. The hacker even threatened to fully disclose the related information if no one purchases it within a week.In response, TSMC confirmed that some personal information of current and former employees was disclosed without authorization. Preliminary investigations indicate that this information matches data from a certain cloud service provider's system, but there is currently no evidence that TSMC's own data systems have been breached. TSMC emphasized that the related information is unrelated to the company's production and customer data. The company has been notifying affected individuals and providing necessary assistance, while closely cooperating with the relevant cloud service provider, investigative agencies, and third-party cybersecurity organizations to expedite the clarification of the incident's cause and take necessary measures.

Blockchain infrastructure service provider Chainstack disclosed that it experienced an AI-driven cyber attack from October 26 to 31, 2026. The attacker accessed the development environment through an unmodified default administrator credential and a Grafana instance without single sign-on protection, subsequently gaining cluster administrator privileges via an unauthenticated MCP tool server and stealing credentials through an automated platform, ultimately accessing the production environment to read the customer database.This incident resulted in the exposure of customer account information, including organization names, account holder names, member email addresses, and password hashes. The attacker also had access to systems containing node credentials, although there is no evidence that they were read; however, Chainstack still urged customers to rotate their node credentials. Chainstack stated that customer-facing services operated normally during the incident, and customer nodes, consoles, and APIs were not modified. Investigations revealed that the attacker used the open-source framework ARTEX, with no evidence found of exploiting software vulnerabilities. Chainstack has cut off the attack access path and requested customers to change passwords, rotate node credentials, regenerate platform API keys, and remain vigilant against phishing information.

John Kim has joined the Singapore office of the Chicago proprietary trading firm DV Trading, responsible for the newly established cryptocurrency discretionary trading team, which will operate through its cryptocurrency business division DV Chain. John Kim previously served as the head of derivatives trading at Nomura's digital asset division Laser Digital, joining the company in October 2025; prior to that, he spent three years as the head of derivatives trading at the cryptocurrency investment bank Galaxy Digital. DV Chain was established in 2016, previously focusing primarily on market-making; the number of employees at DV Trading has increased to over 600.