nera

Succinct's zero-knowledge proof system SP1 has revealed a high-severity reliability vulnerability. This vulnerability was disclosed through GitHub announcement GHSA-p7v2-jjv3-8p8f, affecting SP1's native Rust verifier versions 6.0 to 6.8.0, allowing the mainnet Prover Network to potentially accept invalid proofs: malicious provers can submit proofs of invalid executions, and the network verifiers will still accept them.The cause of the vulnerability is that the verifier only reads the labels of the data (declaration dimensions) without verifying whether the actual number of stored elements equals the product of the dimensions, allowing attackers to forge labels to pass invalid proofs. The Groth16 and Plonk checks using fixed-shape wrap proofs are unaffected, and the on-chain Solidity checker is also safe. Succinct released the fixed version 6.8.1 on September 24, which has been deployed to the mainnet; this version adds deserialization length checks.The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users running the native Rust verifier and accepting untrusted provers need to upgrade to 6.8.1.

Initia posted on platform X that on October 23 at 22:59 (UTC+8), attackers exploited a caching vulnerability in the Initia MoveVM script to bypass security checks, forging MoveVM states to credit themselves with unsupported WETH, iUSD, and USDC, while the total supply of the related tokens remained unchanged; INIT was not minted, and the total supply was unaffected.Before the network was paused, the attackers had transferred out approximately $2.7 million in assets, including 105 WETH transferred via LayerZero and about 1.4 million AUSD0, as well as approximately 1.08 million USDC transferred via Noble and CCTP, which were then exchanged for 1135.52 ETH, currently held at the Ethereum address 0x358ef0130f7a5aa516dcd81bdc80b18cde41cac8. Initia stated that the security fix is expected to be completed and audited within a few days, and asset recovery efforts are being advanced with security partners. L1 and Rollup remain in a paused state, and a complete post-mortem report will be released subsequently.

The National Information Security Vulnerability Sharing Platform (CNVD) released a security announcement titled "Analysis and Repair Suggestions for PHP Remote Code Execution Vulnerability," in which it supports affected users to closely monitor official information, download and update to the latest version through official channels. Users who are temporarily unable to update can take measures to reduce certain attack vectors, mitigate vulnerability threats, and continuously monitor for abnormal PHP process exits, abnormal system command calls, unfamiliar process creations, and abnormal file writes, while retaining logs for traceability analysis.In its protection recommendations, CNVD stated that information system operating units should further strengthen security protection, comprehensively sort out their network assets, and reduce the public exposure of information systems according to the principle of not connecting to the internet unless necessary. Operating units that are currently unable to repair should take temporary response measures such as network isolation, network access restrictions, and taking unnecessary business systems offline.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

OpenAI posted on the X platform that during a recent red team exercise, a vulnerability was discovered in the widely used compression library Brotli that allows remote code execution without authentication. Software such as Node.js, Bun, and Envoy all have this library built-in. Attackers can take over unpatched servers by sending malicious compressed data, and they can also take over clients that accept compressed data through malicious servers.OpenAI stated that the root of the issue was fixed in the Brotli source code in February of this year, but it was not identified as a security vulnerability at that time, and all software that includes this library needs to be updated accordingly. According to The Hacker News, the vulnerability is numbered CVE-2026-111497, and Node.js released a patched version on October 21.

According to official news, YZi Labs announced the launch of the first phase of the Atlas Scout program, recruiting four students from Stanford University, Yale University, the University of California, Berkeley, and the University of California, Los Angeles, to participate in early investment projects in the fields of Web3, artificial intelligence (AI), and biotechnology.The program aims to allow outstanding university students to gain early exposure to venture capital, participate in project discovery, preliminary research, due diligence, and investment judgment, and encourage them to organize entrepreneurial communities on campus and explore investment opportunities. YZi Labs will provide a maximum of $1 million in intended investment for related investment opportunities in this program and open its ecosystem network composed of over 300 portfolio companies.YZi Labs stated that many potential entrepreneurs often begin their explorations in laboratories, open-source projects, campus entrepreneurial organizations, and technology communities before entering traditional financing channels, and their peers who learn and work with them usually discover their potential earlier. The Atlas Scout program hopes to leverage students' own campus networks to help these early entrepreneurs obtain capital, mentorship, and industry resources. Eligible entrepreneurial teams will also have the opportunity to connect with YZi Labs' EASY Residency program or further discuss investment collaboration.The Atlas Scout program not only expands financing and resource channels for early entrepreneurs but also allows participating students to accumulate venture capital experience through practical projects, enhancing their project evaluation, founder communication, and investment judgment skills.YZi Labs stated that Scouts can independently carry out campus activities based on their interests, such as organizing technical exchanges, gathering entrepreneurial teams, or discovering potential investment projects, while receiving guidance and ecosystem resource support from YZi Labs in the process. The program aims to establish connections before entrepreneurial projects gain widespread attention, allowing initial ideas on campus to have the opportunity to develop into actual projects, while cultivating a new generation of investors who can identify technological trends and entrepreneurial potential earlier.

Zero-Knowledge Proof Infrastructure Succinct has fixed a security vulnerability in its SP1 that could allow invalid proofs to be deemed valid.According to The Defiant, the flaw existed in the native Rust verification path from version 6.0 to 6.8.0, while on-chain Groth16 and Plonk verification executed by the Solidity verifier were not affected.

According to Arbitrum monitoring, one month after the launch of Arbitrum One, it has generated $300,000 in priority fee revenue, during which 21 million transactions used PGA.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

Cailian Press reported on October 22 that a joint report released by Google, Temasek, and Bain & Company shows that the number of generative AI users in Southeast Asia reached approximately 243 million in less than three years, accounting for 58% of the local labor force, with a penetration rate about four times that of mobile internet. Only 1% to 2% of the local population pays for personal AI services.Florian Hoppe, a partner at Bain & Company, stated in an interview that businesses can achieve AI commercialization through e-commerce, digital advertising, and other operations without having to rely entirely on consumers paying directly. They can also use AI to improve e-commerce conversion rates and handle routine customer inquiries. The report noted that about 80% of customer inquiries on the e-commerce platform Shopee are handled by AI chatbots, with the cost per customer contact decreasing by 30% year-on-year. In early cases, companies that applied AI saw a year-on-year increase in conversion rates of 10%, with the average spending per order increasing by as much as 75%.The report also stated that the total value of goods traded in Southeast Asia's digital economy is expected to grow by 17% year-on-year to $368 billion by 2026, and is projected to exceed $1 trillion by 2035. Among these, the online travel market is expected to grow by 10% to $59 billion, online media revenue is expected to grow by 22% to $44 billion, and the ride-hailing and food delivery market is expected to grow by 15% to $40 billion. The total value of goods traded in Southeast Asia's e-commerce market is projected to be $226 billion in 2026, an 18% year-on-year increase.

The NFT project Ptah launched last night with a total of 100,000 pieces available for minting, and all were sold out by this morning. As of the time of writing, the floor price for this NFT is reported at $23, with a cumulative transaction volume reaching $928,000.Public information shows that the uniqueness of this project lies in the requirement for users to mint using a Binance Agent ID / Agentic Wallet (.ai Agent ID). Regular wallets cannot mint directly, but operations such as trading, synthesizing, and claiming are open to all wallets. Each Agent ID can mint a maximum of 4 Relics (with payments calculated in total using USDT and BNB). The total supply of 100,000 Relics includes 95,000 for public minting and 5,000 reserved by the team (for tutorials, demonstrations, rewards, gifts, etc.). Additionally, users can choose to burn 10 Relics to synthesize a Loom (mining machine).According to market news, the related project is still in its early stages, with high uncertainty and significant price fluctuations; users should invest with caution.

The New York State Department of Financial Services in the United States has issued an alert regarding two critical PHP vulnerabilities, urging regulated entities to quickly identify and remediate known exploited vulnerabilities.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

According to CoinDesk, the patch for the XRP Ledger vulnerability was delayed until November as the number of validator supports dropped to 26 (out of a total of 35), resetting the countdown timer for its effectiveness.Currently, the number of supports has risen back to 31, but due to the need to recalculate the two-week countdown, this fix has missed the originally impending effectiveness window.

The privacy coin project Pirate Chain has released a mandatory update v6.14, requiring all nodes, mining pools, and exchanges to discontinue the old version and upgrade immediately. Attackers exploited two validation vulnerabilities to mint approximately 39.82 million counterfeit ARRR in the transparent coinbase pool, temporarily increasing the supply by about 20%. Both vulnerabilities have been fixed.After reaching a consensus among the community, mining pools, exchanges, and dPoW notarization nodes, the chain has been rolled back to block 4,176,944 before the attack, and all counterfeit tokens have been removed. Balances have been restored to their state before the attack, with the maximum supply remaining at 200 million coins. The new version will automatically re-index the entire chain upon its first launch, and a complete technical review report will be released later.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

Coldcard hardware wallet manufacturer Coinkite and its co-founders Rodolfo Novak and Peter D. Gray are facing a class-action lawsuit in Ontario, Canada. The lawsuit alleges that the standard firmware used by the Coldcard hardware wallet since around March 2021 has fundamental flaws, as it does not utilize a true random number generator but instead relies on a predictable software pseudo-random number generator, which could lead to the mnemonic phrases being reproduced and the Bitcoin held by users being at risk of unauthorized access.The lawsuit seeks class certification and claims that Coinkite violated the Consumer Protection Act and the Sale of Goods Act, while also involving allegations of negligence, breach of contract, and seeks damages.

According to monitoring by Olaoluwa Osuntokun, the Chief Technology Officer of Lightning Labs stated that due to the CVE-2026-111943 vulnerability, it is strongly recommended that all lnd, btcd, tapd, and litd users update their binaries or rebuild using Go 1.27.3.The vulnerability involves the compromise of a certificate authority, which may affect the security of the related software.

Meta Platforms (META.O) CEO Mark Zuckerberg stated that the company is developing a new generation of small models, expected to be launched soon, to achieve Muse Wonder level intelligence with higher efficiency.

BTCPay Server has updated the optional WooCommerce/WordPress deployment through its Docker installer to address the recently disclosed serious PHP vulnerability. Users running WooCommerce on BTCPay Server should update immediately, which can be done by clicking "Update" directly within BTCPay Server.