⚠️ ALERT: "Fake AI trading agents" distribute malware that replaces MetaMask and Coinbase extensions with malicious clones. Steals credentials when you enter them. Only download AI tools from official sources.
#AITrading#Malware#CryptoSecurity
Papertrade exploited for ~$1.28M just 8 hours after launch. Attacker manipulated Hyperliquid ETH prices while holding leveraged positions, extracting from shared USDC pool. Open-interest limits tightened.
#DeFiExploit#Hyperliquid#CryptoSecurity
🚨Sam Altman says the internet can no longer be SECURED by patching bugs.
"I no longer think we're going to be able to just patch all the bugs," the OpenAI CEO said, warning smarter models can find "hardware level insane stuff."
He says OpenAI can't responsibly open source its best model "anytime soon," but the open source world isn't far behind: "Not super."
🚨 JUST IN: Hardware wallet maker Keystone says hackers got into its website and walked off with customer names, contact details, home addresses and order info.
Seed phrases and keys weren't touched, but expect a wave of fake "Keystone support" scams.
🛡️ Claude Security Now Scans Repositories Continuously to Find Flaws and Track Fixes
Details: https://t.co/BirMmyGFq3
Anthropic has updated Claude Security so it can keep checking connected code repositories as they change, rather than waiting for a person to start each scan. The service also tracks reported vulnerabilities after developers make changes, marks them fixed when a correction is detected, and reopens them if they return.
The updated product is in public beta for Claude Enterprise customers. Anthropic says thousands of organizations have used Claude Security since its public beta began in April, finding more than one million vulnerabilities.
The update aims to help security and development teams keep findings closer to the current state of their software, where new code can introduce risks and older fixes can stop working.
#cybersecuritynews
BitBay Polygon vault exploited for ~$14K. Attacker forced liquidity to zero, redeemed one minimal share, contract sent entire token balance. Accounting logic flaw, not a hack.
#DeFiSecurity#SmartContract#Polygon
⚠️ ALERT: Ledger confirms hidden hardware implant in device sold via reseller CryptoBilis. Estimated losses $86M–$93M across Bitcoin, Ethereum, Tron. Buyers from last 90 days told to move funds to new seed.
#Ledger#SupplyChainAttack#CryptoSecurity
⚠️ ALERT: Coldcard exploit wave 4 suspected. Total losses now ~$130M across 7,300+ Bitcoin wallets. Firmware entropy flaw from 2021. Affected users MUST generate new seeds. Passphrase users safer.
#Coldcard#Bitcoin#HardwareWallet
No crypto wallet is 100% safe.
No software is bug free.
No tech is 100% secure.
There are risks in everything you do.
There are risks if you don't do anything.
There will be issues, setbacks and problems to solve.
Stay up-to-date. Manage risks. Solve problems.
🔵 NEWS: jscrambler npm package supply chain attack. Malicious versions 8.14.0–8.20.0 contained infostealer. Stolen credentials used to publish. Update to 8.22.0 immediately if you use it.
#SupplyChain#npm#CryptoSecurity
LATEST: 🚨 Cloudflare CEO Matthew Prince says there have been millions of exploit attempts targeting the critical PHP flaw since the bug was publicly disclosed.
‼️ BREAKING: Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Details: https://t.co/XZV8KY0rPW
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM.
The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component.
Oracle rates exploitation as low complexity, with no authentication or user interaction required. Successful attacks can expose or change sensitive data, although the risk matrix lists no availability impact.
#cybersecuritynews #vulnerability
Verus-Ethereum Bridge exploited again for $7.5M — same vulnerability class as May hack. Different attacker, new wallet. Bridges remain top target in 2026.
#VerusBridge#BridgeSecurity#DeFi
U.S. Government Bans DeepSeek AI and Orders Federal Agencies to Remove All Related Tools
Details: https://t.co/dhLgezxFrN
The U.S. Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and remove related technology from their IT systems.
The action covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and third-party products and services developed using DeepSeek implementations. The notice was filed for public inspection on October 19, 2026, with publication scheduled for October 20.
It creates a government supply chain restriction, not a nationwide ban on private use. Businesses and individuals are not prohibited from using DeepSeek by this order.
#cybersecuritynews
Fake IRS letters target crypto holders via physical mail. QR code leads to phishing site asking for exchange name and holdings. Then scammers call posing as IRS. Report to Coinbase Security.
#Phishing#IRS#CryptoSecurity