website

Tencent officially launched an independent search website "Yuanbao Search" (so.qq.com), competing with Baidu and Google. The website defaults to AI search, allowing users to receive complete answers and reference sources after inputting questions, and supports follow-up inquiries. It also retains traditional web search and provides search entry points for public accounts, video accounts, images, and academic content.Currently, there have been instances where inputting keywords in Sogou Search directly redirects to the Yuanbao Search results page, and the latest version of QQ Browser also supports setting Yuanbao Search as the search engine. Tencent is gradually integrating existing search entry points into Yuanbao.The last self-developed search by Tencent dates back to "Soso," launched in 2006, when it brought in technical executives like Wu Jun from Google. In 2013, Tencent merged Soso's search business into Sogou, investing $448 million to acquire a 36.5% stake in Sogou; in 2021, it completed a full acquisition of Sogou. Starting in 2024, Tencent will promote Yuanbao AI Search, integrating WeChat Search and Sogou Search, and will open search capabilities to enterprises and developers in 2025. In October of this year, the service was renamed "Yuanbao Search," supporting API, MCP, and Skill integration. Official data shows that Yuanbao Search has an index of over 100 billion, with an average daily call volume of hundreds of millions, supporting more than 50 internal businesses such as Tencent Video, ima, and WorkBuddy.

The cross-chain protocol Across announced that it has regained control of its official website domain, and all systems have returned to normal operation. Across stated that it will fully compensate all affected users and will release a complete post-incident analysis report in the coming days.According to previous disclosures from Across, the attacker gained control of the domain through a social engineering attack on the domain registrar Namecheap. During the period when the domain was out of control, the security response team SEAL 911 assisted in marking it as a phishing site. Across noted that some wallets or browsers may still display phishing warnings, which are expected to be eliminated soon.

According to the "Science and Technology Innovation Board Daily," the artificial intelligence company DeepSeek has once again experienced issues with its chat function, with the chat interface temporarily displaying "Server busy, please try again later." The official status page indicates that starting from 15:11 today, there have been partial interruptions to the website and API, and the official team is investigating the issue to identify the cause.The affected services include the chat service, DeepSeek V4 Pro API service, and DeepSeek V4.1 Flash API service. The latest update on the DeepSeek official website states that the interruption issue has been addressed, and they are currently monitoring the effectiveness of the fix.

CZ cited security researchers regarding the discovery of counterfeit Trust Wallet websites, reminding users to be cautious in distinguishing between .cam and .com domain names.

The Chief Information Security Officer of Slow Fog, 23pds, posted on platform X that the APT29 professional organization related to Eastern Europe is spreading iOS and Android exploit tools through compromised websites and hijacked web analytics tool scripts.It pointed out that DarkSword and AndroSnitch have begun mass attacks, and normal websites or apps that users visit may contain backdoors. He advised users to upgrade their systems to the latest version.

Blast announced on the X platform that Blast L2 has officially shut down. Users who still hold ETH or USD in the L2 wallet, pending withdrawals, or in Blast Mobile can retrieve their assets through the Blast official website. This asset retrieval site will operate for 12 months, with the final support date being November 4, 2027.

The IPO dedicated website of AI company Anthropic, ipo.anthropic.com, is now live. The page is very simple, featuring three circles of increasing size, along with the phrase "More information to come." Developers examining the webpage code discovered that the site has preset paths for regions including the United States, the United Kingdom, Canada, Australia, and Japan, and also contains Japanese prompt text.Anthropic plans to issue stocks to retail investors in Japan, the United Kingdom, Canada, Australia, and some European countries, with participating institutions such as Interactive Brokers, Revolut, and SBI already announced. Japanese regulatory documents indicate that the local issuance scale is expected to be up to approximately $3.5 billion. The company publicly submitted its IPO prospectus on October 26, intending to list on NASDAQ under the code ANT, and may initiate the listing promotion during the week of November 9, aiming to complete the listing by the end of the month.

On November 1, 2026, multiple users posted on X stating that OpenAI's Codex usage data included a model label named GPT-6.2 Astra, while the model selector still displayed GPT-6 Astra. A usage chart covering October 26 to November 1 showed that gpt-6-astra accounted for 80%, and gpt-6.2-astra accounted for 19.8%. Another account posted a suspected JSON snippet of an API response, with the response.model field being gpt-6.2-astra. According to Quantum Bit, GPT-6.2 Astra has been undergoing a limited gray testing among some users, with access primarily restricted to Pro plan users at $500 per month. Some users reported that about 20% of requests were routed to 6.2, while others claimed all requests pointed to 6.2.On the same day, an account posted a screenshot claiming that hidden code on the Anthropic official website's Mythos page included Claude Mythos 5.5. The visible page displayed Claude Mythos 5.1, while the hidden header and logo alt text indicated 5.5. According to Quantum Bit, this text briefly appeared in the front-end code of the official website and was removed a few hours later. Anthropic has not confirmed this, and currently, apart from the screenshot, there are no archived copies to verify this change.Additionally, there were previous reports that Fable 5.5 had appeared in the Microsoft Azure and MLflow directories, with a context window of 1 million tokens and an output limit of 128K tokens. Verification showed that on October 13, 2026, a bot added the entry azure_ai/claude-fable-5-5 to the price list of the open-source tool LiteLLM, which was deleted the next day, with the deletion note stating "Azure did not list this model." These parameters are identical to those of Fable 5.1. As of now, neither OpenAI nor Anthropic has officially released the aforementioned models.

Hong Kong Interbank Clearing Limited disclosed the discovery of a fraudulent website that imitates its official website, luring users to recharge and withdraw through virtual wallets, and claiming to provide Fast Payment System (FPS) online transaction security support, including refunds, reporting unauthorized online transactions, and transaction support.Hong Kong Interbank Clearing Limited emphasizes that, under normal circumstances, it will not directly provide Fast Payment System services to individual members of the public, nor will it proactively contact individual members of the public. Do not provide personal or banking information to the related website.

According to SolanaFloor monitoring, the Step Drainer attack has been found on another 10 websites, including stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance, and apexdefi.xyz. SolanaFloor stated that it is actively investigating and collecting more data.In addition, StonkFun reported that its website has been restored after migrating to new infrastructure, and on-chain operations were not affected, with no known users impacted.It is reported that the Step Drainer attack is a highly active malware-as-a-service (MaaS) wallet theft tool in the Web3 and cryptocurrency space.

Flap posted on the X platform that the Flap official website has now resumed normal access, and the backup domain remains open. Users can currently access Flap through two domains.Flap thanks the community for their patience and support during this incident and states that it will continue to monitor the platform's operation.

Stonk posted that the StonkFun official website has resumed access. Previously, the team took the website offline due to a domain attack and migrated it to new infrastructure.Stonk stated that the on-chain functions have returned to normal, and no user impact has been detected so far. However, since some network synchronization DNS changes may take up to an hour, the team recommends that users wait an hour before connecting their wallets through the official website.

The founder of StonkBrokers, SimpleFarmer, posted on platform X stating that the security alert released by Blockaid regarding StonkBroker experiencing a domain attack was a false alarm, and the related malicious domain is not the official website. The official domain of StonkBroker is StonkBrokers.io.Blockaid has removed StonkBroker from the affected list and deleted the previously released related warning tweets. The team has also taken the malicious domain offline.

Kintsu officially announced that its website is experiencing DNS hijacking due to issues with its domain registrar, and currently accessing the official website may lead to malicious sites.Kintsu reminds users not to visit the official website, connect wallets, or sign any transactions. If users have connected wallets or signed transactions since October 31 at 00:00 (UTC), they should immediately revoke the relevant authorizations through the Revoke platform and transfer their assets.The official statement indicates that a further notice will be issued once the website's security is confirmed to be restored.

The founder of Flap posted on platform X to explain the impact of the official website domain anomaly event.He stated that the risk only involves users who accessed the abnormal website and connected their wallets or signed authorizations within a few minutes before the announcement was made. Users who had previously connected to the FLAP official website normally are not affected by this event and do not need to change their wallet addresses.The founder of Flap also emphasized that FLAP does not store users' private keys, mnemonic phrases, or wallet data; this information will not be saved in the FLAP backend. Until the issue is resolved, users should temporarily avoid accessing the official website, and once the site is restored, the team will issue a notification through the official account.For users who have just connected their wallets on the abnormal website, the founder of Flap stated that they can contact him for assistance via private message.

Flap posted on platform X that its official website is currently experiencing DNS hijacking and is being redirected to an unauthorized website.The team reminds users not to visit the official website, connect wallets, or sign any transactions, and stated that they are addressing the issue. An update will be released once the website's safety is confirmed.

Cybersecurity company XBOW published a statement disclosing a critical remote code execution vulnerability that can be exploited without authentication in a public web application of the U.S. Election Assistance Commission (EAC). This application is used for resource and logistics calculations, not for voting machines or voter registration systems.The vulnerability could allow attackers to execute code with root privileges in the backend container by crafting specific web requests, and access local protected resources and external networks. XBOW stated that it reported the issue according to the vulnerability disclosure policy published by the EAC, and after verification by the EAC team, the vulnerability was fixed before the U.S. federal midterm elections.

IT Home reported on October 30 that developers discovered application entry points and interface logic related to the Cyber cybersecurity model in the front-end code of the DeepSeek official website. The application page route points to /usage/model-application and has a feature gate switch set; accounts without permission will be redirected back to the usage page when accessed. The code also includes interfaces related to Cyber Key creation and quota management.The models in the code are identified as cyber-personal-v3 and cyber-enterprise-v4. The personal version is aimed at individual security practitioners, requiring the submission of ID information and completion of facial verification; the enterprise version is aimed at corporate entities, requiring not only real-name materials but also a business license and authorization letter. Common thresholds for both channels include that the account has completed real-name verification and is in normal status, registered in mainland China and bound to a mainland mobile number, and has no violation records in the past 90 days.The application process involves filling out an application form and submitting it for review. After passing the review, a Cyber Key is created. Currently, this entry point does not appear in the public menu of DeepSeek and is in a gray testing state. Some users have reported that only accounts covered by the gray test can see the relevant sections on the usage page, and when permissions are granted, the "DeepSeek Flash Cyber Cybersecurity Dedicated API" area will be displayed. As of the time of reporting, DeepSeek has not yet released an official announcement regarding this model; the information comes from observations of the official website's JavaScript code and feedback from gray test users.

The cybersecurity company XBOW disclosed that it has found a critical remote code execution vulnerability in a publicly accessible web application of the U.S. Election Assistance Commission (EAC) that can be exploited without authentication.This application is used for resource and logistics calculation, not for voting machines or voter registration systems.