vulnerability

The New York State Department of Financial Services in the United States has issued an alert regarding two critical PHP vulnerabilities, urging regulated entities to quickly identify and remediate known exploited vulnerabilities.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

According to CoinDesk, the patch for the XRP Ledger vulnerability was delayed until November as the number of validator supports dropped to 26 (out of a total of 35), resetting the countdown timer for its effectiveness.Currently, the number of supports has risen back to 31, but due to the need to recalculate the two-week countdown, this fix has missed the originally impending effectiveness window.

The privacy coin project Pirate Chain has released a mandatory update v6.14, requiring all nodes, mining pools, and exchanges to discontinue the old version and upgrade immediately. Attackers exploited two validation vulnerabilities to mint approximately 39.82 million counterfeit ARRR in the transparent coinbase pool, temporarily increasing the supply by about 20%. Both vulnerabilities have been fixed.After reaching a consensus among the community, mining pools, exchanges, and dPoW notarization nodes, the chain has been rolled back to block 4,176,944 before the attack, and all counterfeit tokens have been removed. Balances have been restored to their state before the attack, with the maximum supply remaining at 200 million coins. The new version will automatically re-index the entire chain upon its first launch, and a complete technical review report will be released later.

The Cybersecurity Threat and Vulnerability Information Sharing Platform (NVDB) of the Ministry of Industry and Information Technology of China has detected two critical remote code execution vulnerabilities in PHP, posing serious risks. PHP is an open-source server-side scripting language widely used for web development. Unauthenticated attackers can exploit these vulnerabilities to execute arbitrary code remotely, leading to server control, sensitive information leakage, business interruption, and other harms.The affected versions include the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, and the 8.1 series and earlier versions. The PHP security team has fixed the vulnerabilities and released a security announcement.NVDB recommends that relevant units and users conduct immediate inspections, upgrade to the latest secure version in a timely manner, or take temporary protective measures such as taking the system offline, disabling session upload progress features, network isolation, and restricting network access, as well as strengthening monitoring and management, and promptly modifying credentials such as accounts, passwords, and keys.

BTCPay Server has updated the optional WooCommerce/WordPress deployment through its Docker installer to address the recently disclosed serious PHP vulnerability. Users running WooCommerce on BTCPay Server should update immediately, which can be done by clicking "Update" directly within BTCPay Server.

Tencent Cloud Security Center has detected that PHP has been disclosed to have remote code execution vulnerabilities, with vulnerability IDs CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". This can allow unauthenticated remote attackers to trigger memory corruption and ultimately achieve remote code execution by sending specially crafted multipart POST requests, thereby completely controlling the server and causing other harms.Tencent Cloud Security recommends conducting timely security self-checks. If you are within the affected range, please update and patch promptly to avoid being invaded by external attackers.

According to Cointelegraph, blockchain security company CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by the Indian digital certificate authority eMudhra, cryptocurrency trading bots and exchange applications may still be exposed to related vulnerability risks, and browser fixes may not cover software that uses independent security systems.Peiyu Wang, Senior Director of Digital Asset Security at CertiK, pointed out that attackers could exploit the compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or induce users to approve malicious transactions. However, such attacks also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Cryptocurrency service operators should update software and certificate trust stores and ensure that applications reject affected certificates.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

The on-chain data platform DefiLlama announced a collaboration with the prediction market platform Trueo to launch a new prediction market settled with DefiLlama data, covering protocol revenue and the probability of vulnerabilities occurring.Revenue markets include protocol revenues from Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade. Vulnerability markets cover DeFi hacking incidents and the probability of specific protocols being exploited, including whether Aave and Morpho will experience vulnerabilities this month, as well as weekly and monthly markets for the scale of the largest hacking events.Other on-chain indicator markets include the RWA market capitalization and DEX trading volume of Robinhood Chain, as well as who will have a higher TVL this weekend between Solana and Base.

The blockchain security research organization Asymmetric Research disclosed that there was a vulnerability in the governance program svmgov on the Solana chain: when validators did not participate in voting, independent votes submitted early by their delegators might not be counted in the final results. This vulnerability was reported to the Solana Foundation on July 10 and was fixed on the mainnet on August 3, ahead of the governance vote on August 24.Asymmetric Research estimated based on on-chain data that if the vulnerability had not been fixed, the approval rate of the SGP-0002 proposal, which aims to accelerate the decline of SOL inflation, could have dropped from the actual 67% to 66.65%, below the passing threshold of 66.67%. This vulnerability was fixed before the voting, and did not actually change the outcome of the proposal.

The cross-chain exchange protocol NEAR Intents released a post-mortem report attributing a $3.8 million vulnerability to a flaw in the deposit notification feature. The protocol deploys a public settlement contract on NEAR that maintains an internal ledger of deposited tokens, while withdrawals transfer tokens out via a cross-chain bridge. The report was published by NEAR Intents General Manager Alex Shevchenko on October 16, stating that the attacker withdrew $3.8 million before the protocol was shut down on October 1 and returned all funds within 36 hours of detection, with all affected users fully compensated.The report indicates that the feature notifies third-party contracts when tokens are deposited. The attacker created a contract that intentionally caused the notification to fail, allowing the token contract to refund the deposit while NEAR Intents retained the corresponding ledger credit. Through 23 failed deposit transactions, the attacker accumulated $3.8 million in unsupported balance, referred to in the report as ghost funds, and subsequently withdrew real tokens based on this and transferred them to other chains via the Omni infrastructure. Shevchenko stated that this was a vulnerability in the NEAR Intents contract, not in the Omni infrastructure.Withdrawals occurred between September 29 and October 1. The settlement contract was paused and reopened on October 1, with affected routes gradually restored, and contract-side deposits resumed on October 2. The report noted that the vulnerability went undetected because monitoring only compared the original chain assets with the total balance of NEAR side tokens, without comparing the total internal user balances with the actual tokens held by the contract; the team has since added this check and will automatically pause the contract when there is a balance inconsistency. The fix for the October vulnerability was deployed on October 2, but another serious vulnerability report regarding the same feature prompted its complete removal on October 7, with the relevant researcher receiving a $300,000 reward.

The privacy coin project Pirate Chain stated that its network suffered a vulnerability attack, resulting in the generation of 39.8 million ARRR tokens out of thin air.Currently, the Pirate Chain network is still operating normally, but the development team is advancing recovery efforts and has requested users not to transfer funds until the recovery is complete.

The liquid staking token bOSMO issued by Backbone Labs nearly exhausted its contract support after a large redemption in the Osmosis community pool. A disclosure on the Osmosis forum on October 15 revealed that approximately 40,508 OSMO were designated for compensation to 1,037 accounts. The disclosure author Johnny Wyles stated that the staking contract has overpaid for each redemption since at least April 2026, settling at approximately 1.676 OSMO per bOSMO, while the declared exchange rate of the contract was about 1.117 OSMO.The vulnerability repeatedly counted the OSMO staked on Backbone's own validators, allowing redeemers to receive about 50% more assets, at the cost of diluting the support for remaining holders. The defect was exposed when preparing to liquidate the community pool position, and the passed governance proposal 1049 authorized the withdrawal of the Margined managed treasury position and the destruction of the reclaimed OSMO when it ceased managing liquidity operations. The pool's bOSMO treasury holds approximately 1.137 million bOSMO, accounting for about 97% of the total supply of the token; the redemption transaction executed on October 9 at 21:59 ET destroyed 776,000 bOSMO and began unbinding approximately 1.3 million OSMO.Compensation is based on the qualified balance at block 72,237,940, calculated at 1.1174 OSMO per bOSMO. bOSMO purchased after the snapshot is not included in the compensation, and underlying holders in the liquidity pool and other contracts are also included;

According to Bitcoin News monitoring, the Lightning Development Kit (LDK) has released a security update that fixes vulnerabilities that could allow malicious nodes to steal funds. The most serious vulnerability involves Lightning channel reconnections. According to Bitcoin Optech, malicious nodes may falsely claim that they did not receive previously confirmed channel updates.The vulnerable LDK software could subsequently sign conflicting commitment transactions without properly recording the related transactions, allowing attackers to regain Bitcoin after forwarding the payment is completed. Versions LDK 0.2.7 and 0.1.13 have fixed this vulnerability. As of the reviewed disclosure information, no confirmed losses caused by these specific vulnerabilities have been found.

On-chain detective ZachXBT responded to the XRP Ledger Foundation regarding security fixes, stating that the foundation's treasury holds billions of dollars but only paid $250,000 to the white hat hacker who discovered the serious vulnerability of "infinite XRP issuance." He claimed that this would encourage attackers to choose not to report vulnerabilities in good faith but instead exploit them to steal hundreds of millions of dollars.ZachXBT also stated that because of this, it is difficult for people to view the XRP Ledger or Ripple as legitimate institutions. Previously, the XRP Ledger Foundation clarified that the relevant vulnerability did not lead to the issuance of additional XRP, and the patch was driven by community consensus.

The XRP Ledger Foundation published a post on platform X to clarify the recent security vulnerability incident of the XRP Ledger, stating that the vulnerability could be used to bypass the limit of the total supply of XRP fixed at 100 billion coins, but it was fixed two weeks ago with version 3.4.1. After verification, no new XRP has been created, and the total amount of XRP currently circulating in the ledger is approximately 99.986 billion coins.The foundation stated that the vulnerability requires hundreds of deliberately constructed operations to trigger and that normal payment transactions are unlikely to be involved. In the future, they will strengthen formal verification, AI adversarial testing, security research collaboration, and vulnerability bounty programs with RippleX and the community. Regarding the repair process, the foundation explained that publicly releasing a patch could allow attackers to use AI to accelerate vulnerability analysis. To address this situation, the XRPL community coordinated efforts. Participants including the XRP Ledger Foundation, RippleX, core developers, and validators reached a social consensus to agree on a plan to directly release the repair program.In addition, version 3.4.1 was also adopted as the mandatory version for the network only after going through the normal amendment voting process and receiving over 80% support from validators for two consecutive weeks. Protocol changes still need to be completed through the amendment mechanism. Previously, J. Ayo Akinyele, the engineering lead at RippleX, also posted on platform X expressing high concern about the recently disclosed critical vulnerability issue in the XRP Ledger (XRPL) payment engine, which is a serious security issue that has existed in the codebase for over 10 years and theoretically could lead to XRP being over-created, breaking the fixed supply limit. However, the vulnerability was discovered by the security research organization Veria AI through Ripple's vulnerability bounty program before it could be exploited.

According to Bitcoin.com News, Juan Curutchet, the head of financial and foreign exchange institution regulation at the Central Bank of Argentina (BCRA), recently stated that in the short term, cryptocurrency assets will not be allowed to integrate into the banking and payment service systems, and the regulations prohibiting financial institutions from providing cryptocurrency services established in 2022 will continue to be maintained.Juan Curutchet pointed out that Argentina's current economic vulnerability is insufficient to support the advancement of related measures, and whether the ban will be lifted in the future depends on the economic situation. Related topics may be discussed during the second term of Milei.

Regarding the critical vulnerability in the payment engine reported by Veria AI, RippleX engineering lead J. Ayo Akinyele stated that the XRP Ledger (XRPL) payment engine has a serious vulnerability that has existed for over 10 years, which could lead to the issuance of XRP beyond its fixed supply. This vulnerability was discovered through a bug bounty program and has not yet been exploited.The development team has released the xrpld 3.4.1 patch version and coordinated with validators to complete the network upgrade before public disclosure. Akinyele mentioned that AI is accelerating the speed of vulnerability discovery, and XRPL will increase proactive security investments, clean up technical debt, advance formal verification, and systematically eliminate potential risks in old code.

The XRP Ledger recently fixed a payment system vulnerability that could be traced back to 2015. This vulnerability could allow attackers to bypass the system's calculation limits on token exchange amounts through a specially designed payment transaction, generating and spending large amounts of XRP out of thin air, undermining the mechanism that caps the total supply of XRP at 10 billion.It was disclosed that attackers could create hundreds of accounts, allowing these accounts to post offers to exchange a small amount of tokens for a large amount of XRP, and then execute a transaction simultaneously. Due to a flaw in the software's calculation of the total transaction amount, the seller's account could receive the full XRP, while the buyer's account would need to pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22, and RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version 3.4.1 of xrpld on September 25 to fix the vulnerability.