ility

A serious security vulnerability has been found in the open-source server software Apache HTTP Server. Attackers can exploit this vulnerability to corrupt server memory by crafting requests when they have access to the affected service, allowing them to execute code with the privileges of the web service process. The vulnerability is located in the HTTP/2 module, and attackers can trigger a concurrent synchronization flaw without authentication, leading to heap memory corruption. If successfully exploited, it allows code execution with the privileges of the Apache worker process and access to data that the process can read.The affected range includes Apache HTTP Server versions 2.4.55 to 2.4.70, as well as mod_h2 versions 2.0.8 to 2.0.42 used separately from GitHub. Red Hat stated that the risk involves servers that enable HTTP/2 through the Protocols directive, including H2 for encrypted connections and H2C for plaintext connections. Administrators need to check both global configurations and individual virtual host configurations; if a CDN or reverse proxy is deployed on the website frontend, it is also necessary to check whether the Apache origin server can be accessed directly via HTTP/2.Apache released HTTP Server 2.4.71 on November 11, 2026, and it is recommended that websites using Apache upgrade immediately. If an upgrade cannot be performed temporarily, HTTP/2 can be disabled as a temporary measure. The issue lies in the assign_headers() function of mod_http2. HTTP/2 allows multiple requests to be processed concurrently over the same connection, and the affected code has a synchronization flaw when handling shared resources, which may lead to heap memory corruption. This vulnerability was discovered by the Anthropic OSS Scanner open-source project and the Google Cloud vulnerability research team. Anthropic reported it to the Apache Foundation on October 26, and the Google Cloud team reported the same vulnerability on November 3.

CITIC Securities research report points out that management changes in leading technology companies may exacerbate short-term market volatility, but systemic selling pressure may be relatively limited. The slowdown in AI capital expenditure growth helps improve the free cash flow situation of CSP, and the SaaS sector is expected to benefit. The pricing logic of U.S. stocks may gradually return to the fundamentals of corporate earnings, with earnings growth and upward revisions in expectations supporting the market's mid-term performance.

According to a report by Crypto Briefing, Grayscale's research indicates that the correlation between crypto assets and Bitcoin is decreasing, with Bitcoin currently explaining only about 50% of the return volatility across various crypto sectors.The report breaks down the annualized volatility and the impact of Bitcoin-related factors by sector: the annualized volatility of the currency sector is 49%, with 43% attributed to Bitcoin; the annualized volatility of the smart contract platform sector is 58%, with 38% attributed to Bitcoin; the annualized volatility of the finance sector is 59%, with 30% attributed to Bitcoin; the annualized volatility of the utilities and services sector is 67%, with 30% attributed to Bitcoin; the annualized volatility of the consumer and culture sector is 76%, with 46% attributed to Bitcoin; the artificial intelligence sector has the highest annualized volatility at 85%, with only 35% attributed to Bitcoin.The research points out that Bitcoin's own annualized volatility has recently been around 43%, while the volatility of all sectors tracked by Grayscale is higher than that of Bitcoin. The report suggests that lower correlation does not imply lower risk, but the fact that Bitcoin explains only half of the return volatility means that the other half is driven by factors specific to each sector, providing investors with a reference for assessing which sectors can offer true diversification.

SpaceX plans to invest over 24 billion dollars in the Rio Grande Valley for the construction of new supercomputing infrastructure.

According to Bitcoin News monitoring, Coinkite CEO Rodolfo Novak (NVK) stated that a new AI model discovered a Coldcard vulnerability that was missed by human reviewers, which Bitcoin developers have disputed. This vulnerability exists in firmware versions 4.1 and later and can bypass the hardware random number generator.Between July 30 and August 4, over 5,200 addresses lost approximately 1,816 BTC, worth about $116 million. NVK mentioned that there had been at least 15 prior reviews.James O'Beirne stated that he privately pointed out issues with Coldcard's random number generation in May 2025. Firmware updates can fix issues for new devices but cannot fix old mnemonic phrases; affected users need to generate new mnemonic phrases.

According to Polymarket data, in the "Next CEO of NVIDIA" prediction market, the probability of the "No Change" option for Jensen Huang has risen from 19% earlier today to 29%, ranking first. NVIDIA's Vice President of High-Performance Computing Ian Buck has dropped to second place with 25%, while Chief Financial Officer Colette Kress ranks third with 23.3%.According to the rules, "No Change" means that NVIDIA has not announced an official successor before 23:59 Eastern Time on December 31, 2028, and interim CEOs do not count. Therefore, even if Jensen Huang steps down, as long as NVIDIA appoints only an interim CEO within the deadline, this option can still prevail. The 29% is the implied probability of "no official successor announced," not the probability of Jensen Huang staying on in the short term.

According to Cointelegraph, the market believes there is a 100% probability that the Federal Reserve will raise interest rates in December. CME FedWatch data shows a 90.8% probability of a 25 basis point increase and a 9.2% probability of a 50 basis point increase. The total of these two probabilities adds up to 100%, corresponding to the market's pricing outcome for the interest rate hike in December.

On the prediction market platform Polymarket, the market regarding whether NVIDIA CEO Jensen Huang will announce his resignation or be dismissed before a specific date showed that the probability once rose to about 91%, but has now fallen to 78%.As of the time of publication, the total trading volume of this series of markets is approximately $15.25 million. Pricing by different deadlines: about 59% for November 12, about 63% for November 13, about 74% for November 30, about 78% for December 31; about 82% for March 31, 2027, and about 86% for December 31, 2027.

According to Polymarket data, in the market "Who will be the next CEO of NVIDIA?", the current NVIDIA Vice President of Large Scale and High Performance Computing Ian Buck is currently in the lead with a 30% probability, followed by NVIDIA Executive Vice President and Chief Financial Officer Colette Kress at 21%, and the probability of Jensen Huang remaining the current CEO is 19%.Among the other options, Arm Holdings CEO Rene Haas currently has an 11% probability, NVIDIA Executive Vice President and Global Field Operations Head Jay Puri has 9%, AMD Chair and CEO Lisa Su has 3%, and NVIDIA Senior Director of Product and Technology Marketing for Physical AI Platform Madison Huang has 2%.

Derive option pricing shows that the probability of Bitcoin closing below $70,000 on Christmas has risen from 15% last week to 31%.

Scroll announced that it received a vulnerability bounty report on November 3, indicating that there was a vulnerability in the bundle proof validator deployed on the Ethereum mainnet, and it registered a fixed validator for batch version 10 on November 10. Scroll stated that it has confirmed that the vulnerability was not exploited on the mainnet.According to the report, the vulnerability could allow old valid proofs to be accepted for new public inputs, thereby allowing the final confirmation of any state root and withdrawal root. Exploiting this vulnerability requires having a permissioned prover role or enabling the forced batch mode after 7 days without final confirmation.Scroll stated that the forced mode was never enabled, and all 748 final confirmations during the period of the vulnerability used normal proofs, with previous versions of the validator unaffected.

According to The Block, the Financial Stability Board (FSB) urged Turkey to strengthen regulation of crypto assets and stablecoins in four areas.In its second peer review of the country, the FSB called for the establishment of a dedicated stablecoin framework, enhanced financial stability monitoring, strengthened regulation and enforcement, and improved cross-border cooperation and information sharing.

The People's Bank of China stated that it will make good use of the non-bank large redemption swap facility in the bond market to maintain the stable operation of financial markets such as stocks, bonds, and foreign exchange. The central bank will actively and prudently prevent and resolve financial risks, improve the systemic financial risk prevention and disposal mechanism, and strengthen financial risk monitoring, assessment, and early warning.

AnomaPay disclosed on platform X that it has discovered an external security vulnerability in the RISC Zero proof system it uses, which may jeopardize user funds. To protect users and ensure the safety of funds, the risc0 validator behind Anoma has been suspended and will be upgraded by the RISC Zero team.AnomaPay stated that the funds deposited by users are safe, but they will be temporarily inaccessible until the Anoma protocol is upgraded to version V2, which includes the new security updates from RISC Zero. The upgrade is expected to take about two weeks. Although this downtime is not ideal, it is necessary to protect user funds. Users do not need to take any action; funds will be automatically migrated to V2 and access will be restored after the upgrade is completed.

According to the Bitcoin Core security announcement, the medium-severity vulnerability CVE-2025-62859 was disclosed on November 10, 2026. This vulnerability exists in versions prior to 29.2 and 30, where malicious nodes can exploit witness malleation in compact blocks to stall the block processing of victims under specific conditions.The announcement states that affected nodes will clear the download status after rebuilding the compact block and before checking the witness data. If the check fails, the node will revert to requesting the full block from the same node and wait for a 10-minute timeout. If the attacker controls three high-bandwidth peer nodes of the victim, or if the victim is running in -blockonly mode, this attack can be repeated indefinitely.This vulnerability was discovered and responsibly disclosed by Eugene Siegel, and the fix has been included in Bitcoin Core versions 29.2 and 30.

On November 9, 2026, Google released an emergency stable channel update for the desktop Chrome browser, fixing nine security vulnerabilities, including a zero-day vulnerability that was already being exploited in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.8103.5/.51, and to 157.8103.5 on the Linux platform, and will be gradually rolled out over the next few days to weeks. The core focus of this update is the high-risk vulnerability numbered CVE-2026-125350, which is a use-after-free issue in an XML component. Google explicitly stated in the announcement that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, the scale of victims, or attribution of the attack activities.The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the fix. Among the nine fixes, seven are classified as "high risk" and two as "medium risk." In addition to CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also pertains to a use-after-free issue in an XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an actively exploited vulnerability. The other high-risk vulnerabilities include uninitialized resources in WebGL, improper FileSystem authorization, synthesizer buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.Google also confirmed that the Android version of Chrome (157.8103.5) released on the same day includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the update released separately on November 9, with Windows and Mac versions being 156.8078.96, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Security Incident Coordination Centre (GovCERT.HK) issued a security alert on the same day, defining affected systems as versions prior to Chrome 157.8103.5, and pointed out that successful exploitation of the related vulnerabilities could lead to remote code execution, denial of service, tampering, or bypassing security restrictions. The Hong Kong Computer Security Incident Coordination Centre (HKCERT) rated the risk level of this update as "extremely high risk." Google explained in the announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check and trigger the update via "Settings → About Chrome," and restart the browser after completing the update for the patch to take effect. For users still running versions prior to Chrome 157.8103.5, the current priority action is to confirm the version number and restart immediately to complete the upgrade.

According to Apple's security announcement, the iOS and iPadOS 27.2.1 update fixes multiple security vulnerabilities, one of which is a Messages vulnerability that could allow remote attackers to join iMessage group chats and receive messages.Another Messages vulnerability could allow new users joining a group chat to read messages sent before they joined. Apple also fixed issues where malicious Bluetooth devices could pair without user interaction, and where attackers within Bluetooth range could bypass pairing code attempt limits. Apple stated that the above update was released on November 9.

Confidential AI Infrastructure NEAR AI updated on platform X, stating that on November 8, an attacker exploited a vulnerability in its inference engine SGLang to access part of the infrastructure.NEAR AI has indicated that it has revoked relevant access permissions and completed the repairs. Affected users have been notified, and users who have not received notifications do not need to take any action.