🅔🪝DanielH {𝗫▸}

[CISA Cyber @CISACyber]

⚠️ We issued 19 🆕 & 1 updated public #ICS Advisories. These advisories provide info about current security issues, vulnerabilities, & exploits surrounding ICS. More at https://t.co/4KvmlrK8Zn

[NSA Cyber @NSACyber]

NSA and others releases guidance on applying prevention tactics to strengthen defense of U.S-based programmable logic controllers being targeted by cyber actors using AI. Learn more:
https://t.co/HO99aak50Y
#cybersecurity #AI

[Handy Andy {X} 🪝 𝗫▸ @Handy_4ndy]

If the @xrpl365 account reaches 365 followers over the next 24 hours I’ll dye my hair pink 😂

#XRPL @xrp

[Fomo {X} @ShortTheFOMO]

Excited to be part of the next chapter of XRPL 365! I've known and worked alongside Kris and Andy for some time, and it's great to be making this collaboration official.

We've got plenty of ideas and ambitions, and I'm looking forward to seeing what we can build together.

[⚡️Kris Dangerfield @krisdangerfield]

XRPL 365 has been part of my journey in the XRP Ledger ecosystem for many years, but today I'm annoucing some changes.

I'm bringing Andy (@handy4ndy) and Lathan (@ShortTheFOMO) on board as an exciting next step.

They're both developers I respect, and together we have an opportunity to build something bigger than any of us could individually.

Looking forward to what we can achieve!

👇 Read about this exciting new announcement and make sure you follow the @xrpl365 account.

[Microsoft Threat Intelligence @MsftSecIntel]

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. https://t.co/VXovj0jI90

Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.

Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.

[Xahmoeba @xahmoeba]

Xahmoeba · A life

[Aikido @AikidoSecurity]

⚠️ Node.js is vulnerable to remote code execution.

CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.

You’re exposed if your app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser)

Aikido detects this. Patches are available.

[Richard Holland 🪝🇦🇺 @RichardXRPL]

The next 12 months are like a computer version of the pandemic. Frontier models are now significantly better at security review than humans are at writing code. The whole backlog of human written code is now vulnerable until the gap between AI review and human written closes.

[The Hacker News @TheHackersNews]

🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.

CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.

Read - https://t.co/frrfCwYlgp

[Wietse Wind - 🪝☝️🛠 Xaman® + XRPL + Xahau @WietseWind]

So let me get this straight:

@OpenAI WILL help security M/F with their AI, resulting in disclosure, resulting in exploits unless if nerds patch & fix

But @OpenAI WILL NOT allow nerds to use that AI to defend against exploits because can't help with that, security, risky, 🤡

[CISA Cyber @CISACyber]

🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 https://t.co/8vu6SvNzfB

[Mike Kipruto @itsMikeKipruto]

Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.

If you run either stack in production, keep an eye on official advisories and apply patches promptly.

Security maintenance doesn't stop at your application code. Your runtime matters too.

Node.js advisory: https://t.co/rmgw4sOnqU

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[FBI Cyber Division @FBICyberDiv]

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[Mike Selig @ChairmanSelig]

For too long, the @CFTC and @SECGov were locked in regulatory turf battles, unable to even agree on who regulates what.

Those days are over. @SECPaulSAtkins and I are turning the page on jurisdictional disputes and bringing long-overdue clarity to American markets. More on @Bankless:

[Mike McCluskey @MikeMcC1uskey]

USTX is live. Now we build on it.

Yesterday’s launch brings another piece of our tokenization vision to life.

Wallet ✅
Native liquidity ✅
RWAs & scale mode: incoming 🚀

Issued by @brale_xyz, USTX brings native dollar liquidity to tx - our next step in building TVL and a settlement layer for tokenized stocks and other RWAs.

The opportunity is substantial: roughly $300 billion in stablecoins today, with trillions projected in the next few years.

We’re building tx to compete for that capital.

Our plans include USTX integrations and listings, vault opportunities, and additional user rewards. We also plan to support more chains and stablecoins, giving capital more ways into the tx ecosystem. USTX will continue to evolve and grow, serving as the foundation for everything to come.

These pieces are coming together with one goal: make tx a destination for capital and the assets people want to own.

[Stuart Alderoty @s_alderoty]

The GENIUS Act established the framework. Now, Treasury’s rules must ensure that Americans are not stranded holding stablecoins if regulations change, have pathways to recover stolen funds, and can self-custody if they choose.

[Yellow @Yellow]

Moving value across borders in seconds is old news. XRPL already solved that.

The real challenge now is trust: how do two autonomous AI agents with zero shared history transact safely? They need guaranteed outcomes.

Yellow provides the exact trustless settlement layer to make it happen.

[MoonPay 🟣 @moonpay]

can confirm