service

A serious security vulnerability has been found in the open-source server software Apache HTTP Server. Attackers can exploit this vulnerability to corrupt server memory by crafting requests when they have access to the affected service, allowing them to execute code with the privileges of the web service process. The vulnerability is located in the HTTP/2 module, and attackers can trigger a concurrent synchronization flaw without authentication, leading to heap memory corruption. If successfully exploited, it allows code execution with the privileges of the Apache worker process and access to data that the process can read.The affected range includes Apache HTTP Server versions 2.4.55 to 2.4.70, as well as mod_h2 versions 2.0.8 to 2.0.42 used separately from GitHub. Red Hat stated that the risk involves servers that enable HTTP/2 through the Protocols directive, including H2 for encrypted connections and H2C for plaintext connections. Administrators need to check both global configurations and individual virtual host configurations; if a CDN or reverse proxy is deployed on the website frontend, it is also necessary to check whether the Apache origin server can be accessed directly via HTTP/2.Apache released HTTP Server 2.4.71 on November 11, 2026, and it is recommended that websites using Apache upgrade immediately. If an upgrade cannot be performed temporarily, HTTP/2 can be disabled as a temporary measure. The issue lies in the assign_headers() function of mod_http2. HTTP/2 allows multiple requests to be processed concurrently over the same connection, and the affected code has a synchronization flaw when handling shared resources, which may lead to heap memory corruption. This vulnerability was discovered by the Anthropic OSS Scanner open-source project and the Google Cloud vulnerability research team. Anthropic reported it to the Apache Foundation on October 26, and the Google Cloud team reported the same vulnerability on November 3.

According to The Block, TRM Labs has launched a custody service called Beacon Concierge, aimed at assisting law enforcement agencies in collaborating with cryptocurrency exchanges and stablecoin issuers to prevent and seize illegal cryptocurrency flows on any chain or asset.Beacon has over 200 members, covering 80% of cryptocurrency trading volume, with response times measured in minutes.

On Thursday, Microsoft experienced a widespread service outage in Eastern Time, affecting thousands of users in multiple regions, involving Microsoft 365 services and Outlook. Amazon Web Services and Google users also reported service interruption issues.Microsoft is investigating, with the problem primarily concentrated on Exchange Online, caused by some servers unexpectedly becoming unavailable, leading to excessive load.

According to The Block, the New York State Department of Financial Services has issued new guidelines for advertising and marketing requirements for licensed cryptocurrency entities in the state, which include avoiding misleading or deceptive content. Acting Superintendent Kaitlin Asrow stated in a press release that today's guidelines reinforce the commitment to protecting New York residents and ensure that advertising and marketing practices in the virtual currency space are clear, comprehensive, and accessible.The New York State Department of Financial Services announced on the same day that these guidelines apply to virtual currency entities licensed or chartered by the department, requiring them to establish and implement policies and procedures for advertising and marketing materials related to virtual currency products, services, and activities, with a focus on content accuracy, clear disclosures, and governance and review processes. Relevant entities must update their policies and procedures according to the guidelines by May 10, 2027, review them at least once a year, and maintain records for regulatory inspection. The Department of Financial Services will assess the implementation and effectiveness of these policies and procedures through examinations and ongoing supervision.Common practices listed in the guidelines include: reviewing marketing claims to ensure they fairly present products, services, or activities, are supported by evidence and verifiable, and do not contain exaggerated or false statements about performance or regulatory status; customer disclosures should be clear, prominent, easily understandable to the general audience, and clearly identify the entity providing the products, services, or activities; establishing governance review processes for advertising and marketing materials, designating responsible parties, conducting due diligence on third-party promoters, and promptly monitoring and addressing instances of fraudulent or improper use of their name or brand by others.

Inflation data for October in the United States sends multiple warning signals. The data shows that the core CPI rose by 0.3% month-on-month, higher than the market expectation of 0.2%, exceeding expectations for the third consecutive month; the overall CPI rose by 0.4% month-on-month, also above expectations. The impact of rising energy prices is spreading to areas such as food and transportation, and service inflation remains robust, further complicating the Federal Reserve's efforts to control inflation.Specifically, food prices in the U.S. rose by 0.5% month-on-month in October, with grocery prices recording the largest monthly increase since April; urban transportation service prices saw the largest monthly increase since 2020, and prices for airline tickets and delivery services also increased. Additionally, service prices excluding energy and housing rents rose by 0.4% month-on-month, while owners' equivalent rent increased by 0.3%.AI investments are bringing new cost pressures. Over the past three months, the annualized price increase for computers and peripheral devices in the U.S. reached 25%, and electricity prices rose by 0.9% month-on-month in October, marking the largest increase in six months. Morgan Stanley estimates that AI-related factors have contributed about 6 basis points to the core CPI this year, with the current impact still relatively limited, but as data center investments expand, related pressures may rise further.In terms of monetary policy, Chicago Fed President Goolsbee described the latest inflation data as approaching an alarming level. Fed Governor Waller previously stated that if the core CPI month-on-month increase reaches 0.3% or higher, the December meeting should consider raising interest rates by 50 basis points. Goldman Sachs has included a forecast for an additional 25 basis point increase in March 2027, expecting that the target range for the federal funds rate will rise to 4.25% to 4.50%. However, some economists warn that there is a lag in the transmission of energy prices, and over-reliance on current data may lead to excessive tightening of monetary policy.

According to PR Newswire, the Depository Trust & Clearing Corporation (DTCC) announced plans to integrate its Tokenization Service (DTCC Tokenization Service, DTS) with Solana's Layer 1 network, allowing eligible assets held by DTC to be converted into token form and to gain corresponding token lifecycle functionalities. This integration is expected to go live in the second half of 2027.DTS was officially launched on October 28, and this integration with Solana is an extension of its "multi-chain strategy." DTCC stated that after the integration, DTC tokenized assets will retain the same investor protections, ownership rights, and regulatory safeguards as traditional held securities, while enhancing liquidity, collateral liquidity, and capital efficiency.DTCC President and CEO Frank La Salla stated that this brings regulated DTC tokenized securities to another mainstream blockchain ecosystem; Brian Steele, President of Clearing and Securities Services, emphasized that the service is a "secure, interoperable, and market-neutral" infrastructure; Nadine Chakar, Global Head of Digital Assets at DTCC, mentioned that interoperability is key to the scalability of digital markets; Nick Ducoff, General Manager of Institutional Business at the Solana Foundation, stated that after the integration, tokenized securities can be settled and circulated like other on-chain assets.

According to The Block, digital asset infrastructure company BitGo announced that it has added minting and redemption features for USDC in its Go Account. This service is open to qualified clients of its subsidiary BitGo Bank & Trust, which is a digital asset trust bank regulated by the Office of the Comptroller of the Currency (OCC). Clients can initiate and monitor USDC orders on the BitGo platform or via API, and BitGo will process them through its Circle Mint account, charging a fixed fee disclosed before the client confirms the transaction.The service supports USDC on Ethereum, Solana, Base, Arbitrum, Polygon, Avalanche, HyperEVM, Monad, and Aptos, with specific availability depending on jurisdiction and account requirements. Eligible orders can be processed on-chain 24/7, but fiat deposits and withdrawals must still adhere to banking processing windows and settlement times.BitGo launched the Mint service for the first time in April this year, initially supporting USD1 from World Liberty Financial and SoFiUSD from SoFi Bank, allowing institutions to access related assets without establishing separate relationships with each issuer.BitGo CEO and co-founder Mike Belshe stated that the more assets institutions use, the greater the workload for managing independent accounts and relationships with issuers. The company is enabling clients to access more assets through a single BitGo account based on the infrastructure they have already used.Just a week prior, BitGo launched BitGo Global Markets, led by former NYDIG executive Pete Janney, offering institutional trading and financial services such as crypto collateral financing, options, and swaps; this business stems from the acquisition of NYDIG's institutional trading business on August 27, with about 30 employees joining as a result.

According to Bloomberg Technology, Poste Italiane SpA has launched a mutual investment fund with a target size of 600 million euros (approximately 665 million dollars), focusing on projects including data centers.This move comes after its acquisition of Telecom Italia SpA, aiming to further expand its digital infrastructure layout.

According to Gate data, U.S. cloud service providers and the storage sector continue to strengthen, with CoreWeave's increase expanding to 20% and NEBIUS rising over 15%. At the same time, the Philadelphia Semiconductor Index's increase expanded to 5.10%, reporting 10,500.83 points, as the U.S. semiconductor sector surged.SanDisk surged over 14.7%, Lumentum rose over 12.6%, Micron Technology increased over 11.2%, Coherent rose over 11%, and Seagate Technology increased over 10.2%; SK Hynix rose over 9.6%, Marvell Technology increased over 9.1%, Arm Holdings rose over 9.0%, Intel increased over 6.9%, Lam Research, Broadcom, Applied Materials, and AMD rose over 5%, TSMC increased over 3.4%, and NVIDIA rose over 3.0%.

According to CoinPost, the Financial Services Agency of Japan announced the key points of the first meeting of the "Research Meeting on Responses to Digital and Decentralized Finance" held on October 20. Regarding DEX (Decentralized Exchange) and DeFi (Decentralized Finance), committee members suggested that Japan should respond promptly to avoid becoming a "regulatory void or a place for regulatory arbitrage."

According to The Block, JPYC Inc., the issuer of the yen stablecoin, CEO Noritaka Okabe stated that as more banks face service disruptions, the demand for JPYC stablecoin will rise. Shortly before Okabe made the above remarks, Japan's GMO Aozora Net Bank suspended part of its bank API services after detecting unauthorized communications.Its parent company, GMO Internet Group, experienced a significant cybersecurity incident last month, involving ransom demands following unauthorized access to servers. JPYC is a regulated yen-pegged stablecoin, and the company registered as a money transfer service provider with Japanese authorities in October 2025.

According to market news, Deutsche Bank's custody services for German institutional and corporate clients are now online, supporting BTC, ETH, and some stablecoins like USDC under BaFin/MiCA authorization.The bank employs a multi-layer control mechanism to manage keys and plans to expand to Asia and launch tokenization services by 2027. This service aligns with its goal of achieving an 8% compound annual growth rate in corporate banking by 2028, but the initial scope is limited, not aimed at retail users, does not provide deposit guarantees, and trading functionality has not yet been confirmed.

AI cloud service provider CoreWeave (CRWV.O) reported a 167% year-over-year revenue increase in the third quarter to $3.66 billion, exceeding market expectations of $3.55 billion, with a loss per share of $1.27, better than the expected loss of $1.46. The company raised its full-year revenue guidance from $12.4 billion to $13.2 billion to a range of $13 billion to $13.3 billion. According to MSX.COM data, after the earnings announcement, CoreWeave's stock price rose by as much as 8.7% in after-hours trading, following a cumulative decline of over 40% in the previous month and a year-to-date decline of 32%.As of the end of June, CoreWeave's debt exceeded $50 billion, with a bond yield of about 15.2% due in 2030. The company's CEO stated that investments are based on signed customer contracts, and customer prepayments also help support data center construction, with the existing order backlog sufficient to cover debt obligations. Microsoft previously stated that some emerging cloud service providers' data center projects have been delayed, tightening project oversight and exiting some high-risk projects. After the U.S. midterm elections, several newly elected officials indicated they would slow down or halt data center construction. CoreWeave stated that it plans to expand revenue by launching new services and expanding into the Asian market.

According to a report by Business Wire, the U.S. brokerage infrastructure provider DriveWealth announced that its European affiliate UAB DriveWealth Europe has been authorized by the Bank of Lithuania to become a crypto asset service provider under the EU's Markets in Crypto-Assets Regulation (MiCA). DriveWealth plans to gradually open related services to partners starting in 2027, with specific launch dates to be announced later.UAB DriveWealth Europe previously held a MiFID II license issued by the Bank of Lithuania. After the launch of crypto asset services, banks, fintech companies, digital wallets, and brokerages can access crypto asset services along with existing investment services such as U.S. stocks, ETFs, fixed income products, and options through the same interface.DriveWealth also announced a partnership with Ripple, planning to introduce RLUSD stablecoin settlement, cross-border payments, and digital asset custody in Europe first.

According to a report by the Korean News Agency, Shin Eun-seop, the director of the Electronic Financial Inspection Bureau of the Financial Supervisory Service of Korea, stated at a discussion held at the Financial Investment Education Institute in Yeouido, Seoul, that if stablecoins are used as a means of electronic payment, it is inevitable that the Electronic Financial Transactions Act will apply from the perspective of fairness with existing electronic payment methods, user protection, and payment settlement stability.

The Lightning Network project Lnfi Network tweeted that its withdrawal service has been restored.Previously, Lnfi Network tweeted that the team had discovered issues related to withdrawals and was in the process of maintenance and repair. The withdrawal function had been temporarily suspended, and the pending withdrawal amounts would be fully refunded to the users' balances.

According to CoinPost, the Financial Services Agency of Japan has updated the warning page for "unlicensed financial and cryptocurrency trading platforms" and added a link to the Consumer Affairs Agency's anti-fraud measures, reminding investors to be cautious of trading platforms that are not registered in Japan.The Financial Services Agency pointed out that these unlicensed platforms lack investor protection mechanisms and often face issues such as refusing user withdrawals, charging "exorbitant fees," and even suddenly going offline. The official reminds users to verify the platform's qualifications through the "Unified Search Function for Financial Service Providers" before trading. In the warning list updated in September, a Hong Kong company operating "IZAKA-YA" was added. Additionally, the Consumer Affairs Agency of Japan has implemented anti-fraud measures in September, utilizing AI to analyze consumer consultation data from various regions to identify malicious fraud techniques early.

The Internal Revenue Service (IRS) is sending a large number of Notice 6174 to cryptocurrency taxpayers, reminding recipients to review their past filings. Clinton Donnelly, CEO of Cryptotaxaudit, stated that dozens of individuals have contacted the company recently, including its clients; he noted that receiving the notice itself does not imply any wrongdoing.Donnelly previously estimated that the IRS sends about 10,000 such notices each month. Notice 6174 is a voluntary compliance reminder, informing taxpayers that the IRS has information about their cryptocurrency transactions and asking them to verify whether they have fulfilled their tax filing obligations. Donnelly mentioned that the notice does not specify any particular filing issues and typically does not require a direct response. He advised recipients to carefully read the notice and understand their situation before hastily amending their filings or submitting information to the IRS.

According to a report by Reuters, PNC Bank announced a partnership with Coinbase to allow eligible businesses and institutional clients to receive payments in USDC stablecoins issued by Circle, which will be automatically converted to US dollars upon receipt. Both parties stated that this service could help businesses access funds more quickly and expedite cross-border transaction settlements. The service will initially be launched in a pilot format on a small scale. Tom Lang, head of PNC's cash management products and operations, stated that the current goal is to test with clients to see which features of stablecoins are useful to them. Last year, PNC provided cryptocurrency trading to clients through Coinbase's "crypto-as-a-service" platform and offered banking services to Coinbase.