update

L2 Network Katana tweeted that it has completed three acquisitions, including the Sushi deployment on Katana (now Katana Swap), IDEX (now Katana Perps), and Vault Bridge (native yield generation).Katana also updated its tokenomics; vKAT and the voting mechanism will be phased out, and holders can participate in yields by staking to avKAT. Starting from November 17, a portion of the fees from Swap, Perps, Vault Bridge, and sequencer will flow to avKAT, and a programmatic buyback will be initiated, reducing the unstaking cooldown period from 45 days to 7 days.

AI company Anthropic has updated its "Supported Regions Policy" on its official website, with the new version taking effect on November 12. The policy applies to applications, APIs, and developer platforms such as Claude.ai, Claude Code, Cowork, as well as Claude models provided through cloud platforms and authorized distributors.The new policy clarifies that the following situations are considered as usage in unsupported regions: individuals located in unsupported regions, including users and employees of supported entities; entities registered or headquartered in unsupported regions and their users or employees, regardless of where these individuals are located; entities that are directly or indirectly majority-owned or controlled by individuals or entities from unsupported regions and their users or employees, again regardless of where they are located.According to the official website list, mainland China, Hong Kong, Macau, and Russia are not included in the list of supported regions.

On November 9, 2026, Google released an emergency stable channel update for the desktop Chrome browser, fixing nine security vulnerabilities, including a zero-day vulnerability that was already being exploited in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.8103.5/.51, and to 157.8103.5 on the Linux platform, and will be gradually rolled out over the next few days to weeks. The core focus of this update is the high-risk vulnerability numbered CVE-2026-125350, which is a use-after-free issue in an XML component. Google explicitly stated in the announcement that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, the scale of victims, or attribution of the attack activities.The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the fix. Among the nine fixes, seven are classified as "high risk" and two as "medium risk." In addition to CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also pertains to a use-after-free issue in an XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an actively exploited vulnerability. The other high-risk vulnerabilities include uninitialized resources in WebGL, improper FileSystem authorization, synthesizer buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.Google also confirmed that the Android version of Chrome (157.8103.5) released on the same day includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the update released separately on November 9, with Windows and Mac versions being 156.8078.96, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Security Incident Coordination Centre (GovCERT.HK) issued a security alert on the same day, defining affected systems as versions prior to Chrome 157.8103.5, and pointed out that successful exploitation of the related vulnerabilities could lead to remote code execution, denial of service, tampering, or bypassing security restrictions. The Hong Kong Computer Security Incident Coordination Centre (HKCERT) rated the risk level of this update as "extremely high risk." Google explained in the announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check and trigger the update via "Settings → About Chrome," and restart the browser after completing the update for the patch to take effect. For users still running versions prior to Chrome 157.8103.5, the current priority action is to confirm the version number and restart immediately to complete the upgrade.

According to Apple's security announcement, the iOS and iPadOS 27.2.1 update fixes multiple security vulnerabilities, one of which is a Messages vulnerability that could allow remote attackers to join iMessage group chats and receive messages.Another Messages vulnerability could allow new users joining a group chat to read messages sent before they joined. Apple also fixed issues where malicious Bluetooth devices could pair without user interaction, and where attackers within Bluetooth range could bypass pairing code attempt limits. Apple stated that the above update was released on November 9.

The founder of Slow Fog, Yu Xian, posted on the X platform stating that iOS has released a security update again, and the security of the iPhone is not as good as before, with various malicious exploits emerging.He reminded users not to install apps or open unfamiliar websites casually, especially those involving adult content, and noted that such reminders were mainly aimed at Windows in the past.

According to CoinPost, the Financial Services Agency of Japan has updated the warning page for "unlicensed financial and cryptocurrency trading platforms" and added a link to the Consumer Affairs Agency's anti-fraud measures, reminding investors to be cautious of trading platforms that are not registered in Japan.The Financial Services Agency pointed out that these unlicensed platforms lack investor protection mechanisms and often face issues such as refusing user withdrawals, charging "exorbitant fees," and even suddenly going offline. The official reminds users to verify the platform's qualifications through the "Unified Search Function for Financial Service Providers" before trading. In the warning list updated in September, a Hong Kong company operating "IZAKA-YA" was added. Additionally, the Consumer Affairs Agency of Japan has implemented anti-fraud measures in September, utilizing AI to analyze consumer consultation data from various regions to identify malicious fraud techniques early.

Insiders say that the artificial intelligence company Anthropic has informed bankers that the IPO filing previously sent to them was incorrect, and the company will update the data to the bankers.

The development team Sigma Prime of the Ethereum consensus client Lighthouse has released a high-priority security update and recommends node operators to complete the upgrade as soon as possible. The official statement indicates that specific details of the vulnerability will be disclosed after operators have had sufficient time to complete the upgrade.This update does not introduce any disruptive changes. Lighthouse is one of the mainstream clients of the Ethereum consensus layer, developed and maintained by the Sigma Prime team.

The Bitcoin wallet Electrum announced the release of version 4.8.4 on platform X, stating that this is another security update. According to the GitHub changelog, the release date of this version is November 6, and it fixes vulnerabilities related to Lightning Network onion messages: malformed onion messages from arbitrary sources may cause Electrum to disconnect from its channel peer nodes.Electrum will currently discard all incoming onion messages until practical use cases are implemented. In addition, the new version also fixes issues such as the failure to recover some mnemonic phrases from versions prior to 2. The previous version of Electrum, 4.8.3, was released in late October and fixed a high-risk vulnerability that had been exploited in the wild.

Binance founder CZ retweeted a warning about a critical vulnerability in Microsoft Paint, stating: "The application cannot protect you from operating system vulnerabilities, please update your operating system immediately."It is reported that Microsoft has disclosed a Windows Paint vulnerability numbered CVE-2026-83844, with a CVSS score of 8.1, affecting versions of Microsoft Paint below 11.2605.91. The vulnerability stems from an out-of-bounds read issue, which could allow an unauthenticated attacker to remotely execute malicious code without user interaction. Microsoft has released a security patch, and there have been no confirmed reports of the vulnerability being actively exploited. CZ uses this to remind users that application layer security measures cannot replace the security updates of the operating system itself, and system and software patches should be installed promptly.

Keystone hardware wallet announced that the Nexus App recently experienced a network attack, causing some users to be unable to use the app normally for a period of time. The team has responded quickly and strengthened server security. According to the current investigation results, no evidence has been found that user assets or personal information have been affected.Nexus App version 1.3.7 has further strengthened security measures and is now available on Google Play, while the iOS version is still awaiting App Store review. The official recommendation is for users to update as soon as possible and to confirm that the app developer is "Yanssie HK Limited" before installation to guard against counterfeit applications. Before the iOS version goes live, users can use third-party wallets supported by Keystone for signing.

According to multiple security researchers and KOLs, the iOS exploit toolkit DarkSword poses a serious threat to cryptocurrency users. This exploit takes advantage of an underlying flaw in iOS 18, allowing users to simply open infected websites through Safari, enabling malicious code to run in the background of the phone without the need to connect a wallet or perform any signature authorization. Attackers can use this to steal passwords, photos, files, as well as private keys and mnemonic phrases from cryptocurrency wallets.At least 18 malicious websites have been identified, resulting in victims losing up to 5.57 million dollars, involving more than 20 wallets. Zhao Changpeng commented on this, urging users to update their iOS systems, especially if they haven't updated for a while. He stated that no wallet software can update your operating system for you, and self-custody means self-responsibility.

GoPlus Security issued a security alert stating that the security organization SEAL recently reported multiple cases of asset loss among users of self-hosted wallets on iOS, involving several users. Users are reminded to update their iPhones to the latest iOS version as soon as possible and to check if any malicious applications are installed on their devices.During the period from October 28 to November 3, six related reports were received, with losses amounting to approximately $127,000, compared to four reports and about $434,000 the previous week. The related attacks are suspected to be associated with exploitation tools targeting wallet applications, such as DarkSword and Coruna, with victims mainly from Russia, Ukraine, and Kazakhstan.

As of 11 AM Eastern Time, all states in the U.S. have begun in-person voting except for Hawaii, which is expected to open polling stations in less than an hour. In New York's critical swing district, some voting machines in Westchester County have malfunctioned, while flooding in Florida has forced multiple polling locations to relocate temporarily.The Westchester County Board of Elections in New York stated that local voting machines are currently unable to read paper ballots, and voters can also choose to fill out ballots by hand. Republican Congressman Mike Lawler told CNN that he expects the related issues to be resolved soon. In Central Florida, 21 polling locations have been forced to relocate due to severe flooding, and the Secretary of State's office has confirmed this news.The U.S. Department of Justice has dispatched federal election monitors to several swing states and the largest cities and counties with higher Democratic support. Former President Obama released a new automated phone recording to campaign for Michigan Democratic Senate candidate Abdul El-Sayed as part of the final phase of election support efforts.

a16z Chief Legal Counsel Miles Jennings posted on X that the U.S. Securities and Exchange Commission (SEC) has released new FAQs that further clarify its token classification framework. He pointed out that Question 1.4 clearly states that systems can maintain decentralized governance and use legal entities such as DUNA; Question 1.5 distinguishes between licensed and unlicensed systems; and Question 1.6 clarifies the difference between "functional" and "decentralized."The SEC's Division of Corporation Finance updated the relevant Q&A on November 2. The response to Question 1.4 states that participants in a widely governed functional crypto system, if not interconnected and without formal or informal collaborative arrangements other than participating in that governance system, typically do not constitute a group of persons or entities defined as "centralized parties"; even if they do form such a group, they must still possess operational, economic, or voting control to meet the definition of "centralized parties." This conclusion also applies to cases where the governance system belongs to an organization, association, or foundation, and participation is based on holding native crypto assets.The response to Question 1.5 states that centralized party oversight of participants refers to the authority to control access to the system at the protocol, validator, or user level, such as unilaterally granting or restricting access, deciding on upgrade voting procedures, controlling who can participate in consensus, or modifying rule code, revoking transactions, and access. The response to Question 1.6 states that "functional" refers to native crypto assets being usable according to the system's programmed purposes, while "decentralized" refers to the system operating autonomously without any person, entity, or group having operational, economic, or voting control; the two are distinct concepts. The above responses represent the views of the staff of the Division of Corporation Finance and do not constitute SEC rules or statements.

Anthropic recently updated the usage policy for Claude, with the new regulations taking effect on November 12, 2026. The section "No Abuse of the Platform" has added restrictions, explicitly prohibiting unauthorized resale, agency, or otherwise providing third-party access to Claude.The new regulations specifically name two types of behavior: first, packaging the usage quotas of consumer subscriptions like Claude Pro and Max into third-party API services and charging for them; second, disguising the actual products or clients in use, such as making requests from third-party tools impersonate the official client to bypass access restrictions. Businesses relying on consumer subscription quotas to provide API relay services will face clearer policy restrictions.

Binance stated that as part of ongoing security response measures, the platform has updated the Proof of Reserves (PoR) address list to include newly generated wallet addresses.All subsequent withdrawals will be processed uniformly through these new wallet addresses.

OnKey founder Yishi posted on platform X to remind users that using older iPhone models as cold wallets for cryptocurrency assets may pose security risks. The checkm8 vulnerability exists in the BootROM of iPhone 4S to iPhone X, and the usbliter8 vulnerability, which was disclosed in June this year, affects iPhone XS, XR, 11 series, and second-generation SE, all involving the device's low-level boot code, which cannot be fixed through iOS system updates. Once an attacker gains physical access to the device, they can execute code via the USB interface before iOS boots, and turning on airplane mode cannot prevent such attacks.Yishi advises that iPhone 11 and earlier models are not recommended for storing mnemonic phrases. Users who have used such devices to save mnemonic phrases should generate a brand new mnemonic phrase in a trusted environment and migrate their assets, rather than just changing the wallet address under the original mnemonic phrase. Additionally, users should promptly update their systems, use more complex device and wallet passwords, avoid charging through public USB interfaces, and be vigilant about potential physical attacks during periods when the device is out of their control for extended periods.Previously, OneKey founder Yishi had posted on platform X suggesting users use iPhones as cold wallets, but only recommended using iPhone 17 or newer models.

Bithumb stated that its internal mobile collaboration system DaouOffice was accessed without authorization by external parties, resulting in the theft of some personal information of customers and employees. This incident involves 6,444 customers, of which the data of 5,600 people is in an encrypted state and cannot be read, while 844 customers have confirmed that their personal information has been leaked. Additionally, the information of 715 employees and partners has also been affected.