Featured topic
11 articles
Cloudflare's Matthew Prince says attack attempts against two critical PHP vulnerabilities, dubbed PHP2Shell, exploded after patches were released on 21 October, though evidence shows exploitation began days earlier.
Cloud development platform Railway confirmed an attacker accessed and decrypted customer environment variables, freezing deployments as researchers link the incident to hundreds of suspicious blockchain transactions.
Amazon's MadPot honeypot network recorded exploitation attempts against the critical PHP2Shell flaw four days before official patches were issued, a gap that security teams are now treating as a blind spot in their incident timelines.
A weakness in seed phrase generation allowed an attacker to empty 1,404 Qubic wallets of 2.94 trillion QUBIC tokens in under two hours, echoing the entropy flaw previously reported in Coldcard hardware wallets.
A US court order allowed Microsoft and Health-ISAC to seize domains tied to three phishing-as-a-service operations that targeted more than 75,000 organisations and accepted stablecoin and crypto payments.
Security firm SlowMist warns of a phishing campaign impersonating Ledger firmware updates, capitalising on fears sparked by an $86 million theft tied to compromised devices sold by reseller CryptoBilis.
Analytics firm Onchain Lens has publicly called on Binance to audit and freeze accounts tied to funds stolen from buyers of a Ledger-authorized reseller, after 430.2 ETH moved through Tornado Cash.
Gracy Chen said attackers compromised a critical wallet server and manipulated transaction records to push through unauthorised transfers, as Bitget brings in Mandiant and SlowMist to investigate.
Elon Musk's platform has taken alleged operators of a bitcoin-focused fake news network to England's High Court, accusing them of fabricating stories about Goldman Sachs and Citibank to farm engagement payments.
SlowMist and OKX confirmed that FomoPeek, an app tracking large crypto holders on iOS, concealed a module capable of extracting private keys via the iOS Keychain, reigniting concerns over app store vetting.
Hackers withdrew $320 million in Bitcoin from Liquid but returned about $270 million after claiming to have acted as “white hats”.