exploit

According to Crypto Briefing, users of hardware wallet manufacturer SafePal are facing phishing letter attacks after a customer data breach. Attackers used previously leaked data to send fake letters containing QR codes to some Italian users, claiming firmware security issues, with the QR codes directing to phishing websites.SafePal disclosed this breach in August, affecting approximately 39,798 customers. The leaked information includes names, addresses, and purchase details, but private keys and mnemonic phrases were not affected. As of now, SafePal has confirmed that these letters are scams and has taken down over 30 related fraudulent websites. The company has previously notified affected customers and implemented preventive measures, such as limiting the data retention period to 90 days.

Scroll announced that it received a vulnerability bounty report on November 3, indicating that there was a vulnerability in the bundle proof validator deployed on the Ethereum mainnet, and it registered a fixed validator for batch version 10 on November 10. Scroll stated that it has confirmed that the vulnerability was not exploited on the mainnet.According to the report, the vulnerability could allow old valid proofs to be accepted for new public inputs, thereby allowing the final confirmation of any state root and withdrawal root. Exploiting this vulnerability requires having a permissioned prover role or enabling the forced batch mode after 7 days without final confirmation.Scroll stated that the forced mode was never enabled, and all 748 final confirmations during the period of the vulnerability used normal proofs, with previous versions of the validator unaffected.

On November 9, 2026, Google released an emergency stable channel update for the desktop Chrome browser, fixing nine security vulnerabilities, including a zero-day vulnerability that was already being exploited in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.8103.5/.51, and to 157.8103.5 on the Linux platform, and will be gradually rolled out over the next few days to weeks. The core focus of this update is the high-risk vulnerability numbered CVE-2026-125350, which is a use-after-free issue in an XML component. Google explicitly stated in the announcement that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, the scale of victims, or attribution of the attack activities.The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the fix. Among the nine fixes, seven are classified as "high risk" and two as "medium risk." In addition to CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also pertains to a use-after-free issue in an XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an actively exploited vulnerability. The other high-risk vulnerabilities include uninitialized resources in WebGL, improper FileSystem authorization, synthesizer buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.Google also confirmed that the Android version of Chrome (157.8103.5) released on the same day includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the update released separately on November 9, with Windows and Mac versions being 156.8078.96, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Security Incident Coordination Centre (GovCERT.HK) issued a security alert on the same day, defining affected systems as versions prior to Chrome 157.8103.5, and pointed out that successful exploitation of the related vulnerabilities could lead to remote code execution, denial of service, tampering, or bypassing security restrictions. The Hong Kong Computer Security Incident Coordination Centre (HKCERT) rated the risk level of this update as "extremely high risk." Google explained in the announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check and trigger the update via "Settings → About Chrome," and restart the browser after completing the update for the patch to take effect. For users still running versions prior to Chrome 157.8103.5, the current priority action is to confirm the version number and restart immediately to complete the upgrade.

GreyNoise reported that the Alpine SSH password bypass vulnerability has been successfully exploited, and Previdian has also detected 20 exploitation attempts.

According to multiple security researchers and KOLs, the iOS exploit toolkit DarkSword poses a serious threat to cryptocurrency users. This exploit takes advantage of an underlying flaw in iOS 18, allowing users to simply open infected websites through Safari, enabling malicious code to run in the background of the phone without the need to connect a wallet or perform any signature authorization. Attackers can use this to steal passwords, photos, files, as well as private keys and mnemonic phrases from cryptocurrency wallets.At least 18 malicious websites have been identified, resulting in victims losing up to 5.57 million dollars, involving more than 20 wallets. Zhao Changpeng commented on this, urging users to update their iOS systems, especially if they haven't updated for a while. He stated that no wallet software can update your operating system for you, and self-custody means self-responsibility.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X that the APT29 professional organization related to Eastern Europe is spreading iOS and Android exploit tools through compromised websites and hijacked web analytics tool scripts.It pointed out that DarkSword and AndroSnitch have begun mass attacks, and normal websites or apps that users visit may contain backdoors. He advised users to upgrade their systems to the latest version.

According to disclosures from OpenAI's official website, the company has established an autonomous security research pipeline covering vulnerability discovery, dynamic verification, exploitability assessment, and patch generation. In a run centered on an upcoming network model, the pipeline completed scanning and verification of targets related to the Linux kernel, generating 948 exploits that can achieve local privilege escalation (LPE) on commonly used Linux distributions, with an API cost of approximately $1.213 million, or about $1,279 per LPE exploit.It was reported that the pipeline identified and analyzed a total of 2,308 candidate discoveries, dynamically reproducing 1,724 vulnerabilities, and producing 291 information leakage proofs of concept (PoC); the target virtual machine ran a standard desktop system with complete protection. The Scout agent initially identified about 5,034 audit targets (approximately 2.8 million lines of code, accounting for about 7% of the kernel), and the Analyst agent produced candidate discoveries in about 12 hours. OpenAI stated that it has prioritized reporting critical vulnerability patches as recommended by the Linux community and continues to advance the remaining reports in collaboration with Patch the Planet partners.OpenAI also mentioned that in the adapted kernelCTF environment, an additional 25 information leakage PoCs and 21 LPEs were obtained; among 166 sampled exploits, the agent reportedly used at least 10 newer Linux exploitation techniques that it deemed more recent. The company emphasized that maintainers are quick to fix: over 100 LPEs have been patched or entered temporary patches within about 10 days of scanning, and approximately 300 others have entered public discussion.

Anthropic disclosed that the exploit program written by Claude can remotely execute commands on specific Linux servers, and the fixes for multiple versions of Ubuntu are still in progress.

Cosmos ecosystem NFT marketplace Talis Protocol stated on October 31 on X that attackers exploited vulnerabilities in its market and auction contracts on Injective, resulting in approximately 5,700 hosted NFTs being extracted and sold into public collection bids.Talis indicated that it has suspended new listings and auctions on Injective and will return over 26,000 NFTs in the contract to their holders. As a precaution, new listings and auctions on other chains have also been suspended. Please do not buy, list, or bid on Talis until the fixes are confirmed safe; users can still cancel unexecuted bids. If listings or auctions disappear, please check your wallet.The project stated that the repaired contracts are ready and are undergoing pre-deployment review, with a timeline to be announced later. The team has recorded each affected NFT, the holders before the theft, and each transaction bid, and is formulating a plan to return the NFTs to their original holders and compensate the bidders. A list of affected NFTs will be published, and please do not purchase these NFTs in the meantime.Talis also stated that it will not request wallet connections to claim any content via private messages, and a complete post-incident explanation will be released later.RootData shows that Talis Protocol was established in 2021 and completed a $2.35 million private fundraising round in November of the same year.

On October 31, the DeFi strategy platform Troves on Starknet announced that its xWBTC/WBTC treasury was exploited that day, resulting in an initial loss of approximately 8.6 BTC. Troves stated that, according to the investigation as of the time of the announcement, the exploitation was limited to that treasury, and no impact on other Troves treasuries had been found.Troves mentioned that the exploitation involved an old rebalancing contract that retained permissions even after being replaced. The team has revoked the relevant contract permissions and proactively paused the affected and potentially exposed treasuries. The team is continuing to verify the extent of the exposure and is tracking funds with security partners to assess possible recovery options.Troves later updated that approximately 40 minutes after discovering the exploitation, the problematic old contract was revoked, and all rebalancing permissions on its LST treasury were revoked. As a precaution, the three treasuries xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC are currently in a paused state. Troves provides automated DeFi strategies on Starknet, and the team stated that a detailed post-analysis and options for affected depositors will be announced after verification.

A researcher successfully cracked the "Steal My Bitcoin" challenge using a PHP vulnerability.The prize for the challenge was 0.02511679 BTC. However, the challenge operators later discovered that the server had saved the wrong wallet key, and ultimately had to manually transfer the prize to the researcher.

According to Bitcoin News, researchers claim that Tailscale has a serious vulnerability, where users with approved access can exploit its built-in SSH to gain root access to devices, and the attack may spread to other devices on the network.Users running nodes with Tailscale should disable Tailscale SSH and update promptly after the patch is released. Tailscale has not yet responded.

According to BlockSec monitoring, a suspicious transaction by X100 Global on Ethereum resulted in a loss of approximately 4.75 million USD, with the related attack stemming from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds to purchase X tokens, allocated the tokens to two controlled contracts, and then deposited them into the Freezer, thereby controlling 2 out of 3 senator seats in the same transaction, and subsequently immediately passed and executed a malicious treasury proposal.Specifically, the attacker first created and provided liquidity to the X-USDT trading pool on PancakeSwap V3, then used the obtained majority governance seats to approve the exchange of 400,000 X tokens into that trading pool, setting the minimum output amount to 0, ultimately receiving only about 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold part of the recovered X tokens through the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

Bitcoin core developer Antoine Poinsot announced an adjustment to the security vulnerability disclosure policy in the Bitcoin development mailing list. He stated that in the past, vulnerabilities were often kept secret for a long time to allow users to complete upgrades before details were made public, but this also led to fixes not being backported to older versions, requiring users to wait for the next major release. Poinsot pointed out that large language models make some vulnerabilities very easy to rediscover, and the protection that continued delays in fixing can provide is now quite limited.According to the new policy, vulnerabilities deemed "easy to discover" will be fixed as soon as possible in all maintained major versions, with security announcements released simultaneously. This classification applies to vulnerabilities that can be discovered with minimal effort, such as through simple LLM prompts. Other vulnerabilities will still follow the disclosure timeline based on severity: low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium to high-severity vulnerabilities will be disclosed two weeks after the last affected version reaches its end of life (usually one year after the fix is released in a new major version). Critical vulnerabilities are not covered by the standard policy and may require ad hoc procedures.Bitcoin ecosystem security researcher Luke de Wolf stated that he previously disagreed with Poinsot's security strategy but believes this update is a good adjustment. In August of this year, the volunteer-based Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with only about one-fifth being reproducible at that time. In the same month, Core Lightning developers urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports, while keeping technical details confidential for two weeks.

According to Bloomberg, Amazon's threat intelligence team discovered that hackers attempted to exploit related vulnerabilities days before the public disclosure of two security vulnerabilities in PHP. After the vulnerabilities were disclosed on Wednesday, hacker activities further expanded. Amazon stated that the related vulnerabilities are being widely exploited but did not disclose specific victim information.Cybersecurity company Palo Alto Networks found that there are over 22.6 million exposed instances worldwide with related vulnerabilities. Wiz researchers estimate that the vulnerabilities could affect about 70% of the internet and have existed for over a decade, while Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised or even implanted with backdoors.

The XRP Ledger recently fixed a payment system vulnerability that could be traced back to 2015. This vulnerability could allow attackers to bypass the system's calculation limits on token exchange amounts through a specially designed payment transaction, generating and spending large amounts of XRP out of thin air, undermining the mechanism that caps the total supply of XRP at 10 billion.It was disclosed that attackers could create hundreds of accounts, allowing these accounts to post offers to exchange a small amount of tokens for a large amount of XRP, and then execute a transaction simultaneously. Due to a flaw in the software's calculation of the total transaction amount, the seller's account could receive the full XRP, while the buyer's account would need to pay almost nothing. Researchers Cayden Liao and Veria AI reported the vulnerability on September 22, and RippleX subsequently reproduced the attack and confirmed that the generated XRP could be used in subsequent transactions. RippleX stated that there is currently no evidence that this vulnerability has been exploited on any public network. The development team released version 3.4.1 of xrpld on September 25 to fix the vulnerability.

Security company CertiK's analysis shows that a legacy MakerDAO auction keeper contract was exploited, with the attacker taking away 200 ETH, worth over $500,000. CertiK stated that the root cause was the lack of access control for the 0x8804d1de function in the keeper implementation contract.This contract was involved in the "Black Thursday" liquidation crisis in March 2020, when it won ETH with zero bids, with four transactions of 50 ETH each remaining unsettled. The attacker took this batch of funds and transferred them out in amounts of 10 ETH each via Tornado Cash. Although this contract is not currently a core part of the Sky ecosystem, old contracts with remaining funds may still become targets for attacks.

Immunefi Security Chief Gonçalo Magalhães stated that an unnamed Base treasury suffered a vulnerability exploit of approximately 6 million dollars, while there were still about 31.7 million dollars in assets within the treasury at the time of the incident.According to the briefing, the attacker added a malicious contract to the treasury's lending whitelist through a Safe multi-signature wallet, subsequently withdrawing 1,783 aBaswstETH, which were then exchanged for approximately 1,783 wstETH via AaveV3. Gonçalo Magalhães pointed out that the whitelist's restricted addresses appeared secure, but approved addresses could withdraw assets without collateral, constituting a vulnerability; this whitelist weakness had been discovered the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remedial measures.

The Chief Information Security Officer of Slow Fog Security, 23pds, stated that Alex Shevchenko, the General Manager of NEAR Intents, indicated that the exploiters of the NEAR Intents vulnerability transferred 1 BNB to the recovery wallet and left a message expressing willingness to cooperate and requested the other party to provide a Signal contact.This transfer came from the same address that previously moved approximately 3.8 million USD. About an hour ago, that address also transferred 0.295 ETH on the Ethereum network and sent the same message.