Security
Crypto security incidents, service interruptions and recovery updates with dated source attribution.
Node.js Security Updates Fix Brotli Flaw Across Three Release Lines
Node.js lists 26.12.1, 24.22.1 and 22.23.4 as security releases. Exposure to the high-severity Brotli flaw depends on an application’s handling of compressed input.
Electrum 4.8.3 Fixes Malicious-Server Fee-Bump Attack; Users Urged to Upgrade
An October 24 advisory covers versions before 4.8.3. Loss requires signing the altered transaction; check full destination addresses and amounts.
CISA and FBI Warn of SafePay Ransomware, Citing at Least 600 Victims Since 2024
The October 20 joint warning highlights exposed credentials, internet-facing systems and backup disruption; its victim count is not specific to crypto businesses.
PHP Patches Two Critical RCE Flaws; Web Operators Urged to Update
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. Temporary measures do not fully remove risk.
Project Eleven and Relm Study Quantum Readiness in Crypto Insurance
Relm will advise on Strongpoint custody controls. The exploratory partnership does not establish premium discounts or new insurance coverage.
BiFi Security Reports Detail USDT Market Exploit and $159K Return
Security reports described a BiFi interest-calculation exploit extracting about 165,600 USDT, followed by a reported return of 159,103 USDC on October 18.
Qubic Reports 1,404 Wallets Drained Through Weak Seed Generation
Qubic linked a 1,404-wallet drain to insufficient seed randomness. Its October 18 update reported a protective halt and a seed-generation fix in v4.26.4.
SEAL Reports 81 Weekly Incidents as Fake Support Risks Persist
SEAL’s October 6–13 report records 81 incidents and 6,109 phishing domains. The figures describe its response dataset, not all crypto crime.
Cysic Suspends Bridge After Unauthorized 10M CYS Mint
Cysic suspended its bridge after 10 million unauthorized CYS were minted on BNB Smart Chain, with the final loss still under investigation.