Featured topic
10 articles
Cloudflare's Matthew Prince says attack attempts against two critical PHP vulnerabilities, dubbed PHP2Shell, exploded after patches were released on 21 October, though evidence shows exploitation began days earlier.
Cloud development platform Railway confirmed an attacker accessed and decrypted customer environment variables, freezing deployments as researchers link the incident to hundreds of suspicious blockchain transactions.
Amazon's MadPot honeypot network recorded exploitation attempts against the critical PHP2Shell flaw four days before official patches were issued, a gap that security teams are now treating as a blind spot in their incident timelines.
Charles Guillemet says critical bugs in PHP, Node.js and compromised TLS certificates have left hundreds of thousands of servers exposed, though Bitcoin's core protocol is unaffected.
A user who bought a Ledger wallet at a Mediamarkt store reported finding a hidden spy component inside, extending a supply-chain attack previously tied only to an Asian reseller.
Coldcard's official X account posted and quickly deleted a phishing link in the early hours of October 11. The bitcoin hardware wallet maker says its offline 2FA and credentials show no sign of compromise, but it is investigating possible unauthorised access at the platform level.
Ethereum co-founder Vitalik Buterin has responded to warnings from researcher Justin Drake about artificial intelligence threatening the cryptographic schemes securing Bitcoin, Ethereum and other networks, pointing to lattice-based systems as the area of greatest near-term concern.
Core Lightning has told operators to update to version 26.06.8 immediately after confirming active attacks against nodes running 26.06.7 or earlier, warning that funds held in routing channels could be at risk.
THORChain says its architecture cannot selectively freeze transactions, rejecting Bitget's request to stop attackers from moving stolen assets through the network.
The FINMA-supervised bitcoin payments platform took its infrastructure offline on September 14 after detecting likely unauthorized access, with emails, IBANs, BTC addresses and transaction histories reportedly exposed.