ELECTRUM BITCOIN WALLET CONFIRMS CRITICAL SECURITY VULNERABILITY EXPLOITED IN THE WILD
Electrum has disclosed a high-severity vulnerability allowing malicious servers to trick users into sending Bitcoin to an attacker when increasing a transaction fee.
The attack works by intercepting a broadcast transaction and replacing it in the wallet’s history with a fake transaction redirecting funds to an attacker-controlled address.
If the user attempts to increase the fee using Replace-by-Fee (RBF), Electrum can sign the malicious transaction, sending the Bitcoin to the attacker.
Electrum confirmed two reported incidents, including one user who lost funds. Attackers even generated addresses matching the last four characters of the intended recipient’s address.
The vulnerability affects versions before 4.8.3 and has been patched in the latest release.
Users are urged to update immediately and verify all destination addresses and amounts before signing transactions.
🚨 JUST IN: Hardware wallet maker Keystone says hackers got into its website and walked off with customer names, contact details, home addresses and order info.
Seed phrases and keys weren't touched, but expect a wave of fake "Keystone support" scams.
🇦🇷 UPDATE: An Argentine judge dismissed the investigation into President Javier Milei and his sister’s links to the $LIBRA cryptocurrency scandal at prosecutors’ request.
BREAKING: A fusion startup says it has turned mercury into gold, producing 10 times more than CERN's previous record.
Marathon Fusion says it achieved this using nuclear fusion.
For now, the amounts are tiny. But gold's price depends on it being rare, so anything that makes gold easier to produce is worth watching.
🚨 NEW: Ethereum Foundation delays the Glamsterdam upgrade on the Hoodi testnet, originally set for October 26, to further study EIP-8037’s impact on mainnet smart contracts.
⚡️ NOW: CZ says AI hacking fears around crypto are overblown since the internet and banking run on weaker encryption, but warns:
“AI doesn’t need to break Bitcoin’s cryptography to cause damage, leaked data already enables more phishing, social engineering, etc.”
Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.
Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early.
Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.
Stay SAFU!