The White House: It was made aware of the PHP vulnerability on October 16, and is coordinating to accelerate the release of a fix patch.

Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.

Renowned trader Bonk Guy posted that the current crypto market is showing characteristics of a "privacy cycle". He noted that since yesterday, Bitcoin has risen approximately 3%, ZEC is up 16%, adding over $3 billion in market capitalization. MASK currently has a market cap of roughly $26 million, with its protocol trading volume and fees hitting consecutive all-time highs, he added. Citing data from DefiLlama, he stated that MASK ranks first among privacy protocols by revenue, outearning the next 10 privacy protocols combined. By comparison, ZEC’s market cap gain over the past 24 hours is roughly 115 times MASK’s entire market cap. Bonk Guy also said that MASK’s upcoming deployment on Solana is set to launch in the coming days, which he expects will further drive growth in usage, trading volume, and fees. He went on to call MASK the most undervalued privacy protocol in the crypto market.

According to reports from Reuters and Axios, the Kremlin stated that Russian President Vladimir Putin told U.S. envoy Steve Witkoff on Wednesday he "agrees in principle" to resume trilateral peace talks between Russia, Ukraine and the U.S. around November 10 to end the Russia-Ukraine conflict, with the venue potentially in Abu Dhabi. Witkoff held a three-hour meeting with Putin in St. Petersburg the same day, presenting the latest plan to end the Russia-Ukraine conflict. Trump envoy Jared Kushner joined the session via video. Witkoff informed Putin that progress had been made in the Oslo talks, and expressed hope that both sides would consider restarting the Russia-U.S.-Ukraine trilateral negotiations and allow technical experts to participate in discussions on specific issues. He also submitted multiple documents on the peaceful resolution of the Russia-Ukraine conflict to Putin. Separately, Putin raised with Witkoff the possibility of Russia acting as a mediator between the U.S. and Iran. Putin noted that Russia has decades of special trust relations with Iran and is willing to contribute to resolving the current crisis.

Beating AI Express: Security firm JFrog has discovered that popular open-source AI model gateway LiteLLM has fallen victim to another supply chain attack. Its latest v1.107.0 version was implanted with malware, and official Docker images were also compromised. LiteLLM enables unified access to models from providers like OpenAI and Anthropic, and centralizes API key management. It was previously targeted by a supply chain poisoning attack back in March this year. This latest attack is far more stealthy: hackers hid three extra files in Python packages. After installation, whenever users launch the associated Python environment—even without invoking LiteLLM—the malicious code runs automatically. It steals browser passwords, SSH private keys, AWS and other cloud platform credentials, plus authentication data for development tools including Claude, Codex, and Cursor. The malware also attempts to exfiltrate model API keys stored in LiteLLM’s database to servers masquerading as official domains. Attackers also embedded a persistent backdoor that checks for remote commands hourly, downloading and executing new code as needed. Notably, the official source code on GitHub contained no malicious files, but all seven platform-specific packages released to PyPI were infected with trojans. The community traced the issue via Docker build logs: the release system used a source address pointing to a fake repository that differed from the official one by only one hyphen. How the fake repo slipped into the release pipeline remains unconfirmed. PyPI has since removed the malicious versions, and Docker Hub has taken down affected images. JFrog warns users who installed or ran v1.107.0 to treat all related credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive data like API keys—rather than simply uninstalling the software. The confirmed safe rollback version is v1.106.2.

Tencent Cloud Security Center has detected a remote code execution vulnerability in PHP, with CVE identifiers CVE-2026-109618 and CVE-2026-109619, codenamed "php2shell". The flaw allows unauthenticated remote attackers to send specially crafted multipart POST requests to trigger memory corruption, leading to remote code execution that can result in full server compromise and other harms. Tencent Cloud Security recommends conducting timely security self-inspection; if your system is affected, update and patch immediately to prevent intrusion by external attackers.

Bybit CEO Ben Zhou said that Bybit plans to partner with established local firms when entering the U.S. market to compete with platforms like Robinhood. Citing Interactive Brokers as an example, he noted that it is more suitable at this stage to seek partners that already have a U.S. customer base and are looking to expand into crypto business. Ben Zhou added that applying for money transmission licenses state-by-state could take two to three years, so he prefers to wait for progress on the CLARITY Act and further clarity on the new regulatory framework before entering the U.S. at an opportune time rather than acting hastily. He believes the U.S. market, while large, is highly competitive and already saturated. Additionally, Bybit is exploring the U.K. market, but Ben Zhou said entry costs there are high, and the location of its London office has not yet been finalized. The company also plans to launch a comprehensive application in Europe as early as the first quarter of 2027, covering derivatives and tokenized stocks.