Early leak of Moderna's phase 3 cancer vaccine data triggers a 26% plunge in the company's stock.

According to data from Farside, U.S. spot Bitcoin ETFs posted a net outflow of $635 million yesterday. Among them, BlackRock’s IBIT saw a net outflow of $254 million, Fidelity’s FBTC recorded a net outflow of $217 million, and ARK’s ARKB had a net outflow of $109 million. Additionally, U.S. spot Ethereum ETFs reported a net outflow of $110 million yesterday, with BlackRock’s ETHA seeing a net outflow of $75.5 million and BlackRock’s ETHB recording a net outflow of $17.2 million.

According to official sources, Bitget has launched two stock perpetual contracts: DHR (Danaher) and TSTOCK (American Telephone & Telegraph). The contracts are settled in USDT, support up to 20x leverage, and are available for 24/7 trading. As of now, Bitget supports a total of 376 stock contract underlyings.

According to TradingBeats data, the largest short position address for crude oil (xyz:CL) on Hyperliquid is on the verge of liquidation. The address uses an aggressive 20x leverage to trade crude oil contracts, holding a position worth $12.63 million, with an entry price of $96.7 and a liquidation price of $102.85. At the current oil price of $100, it only needs to rise 2.85% more to trigger liquidation. Recently, oil prices have climbed again, driven by a combination of surging Middle East geopolitical risks and persistent tight supply. Escalating U.S.-Iran tensions in the Strait of Hormuz, increased clashes between Iran’s Revolutionary Guards and U.S. forces, and ongoing Houthi attacks on Saudi oil facilities have collectively lifted the risk premium for crude oil supply disruptions.

SlowMist Security Team has released an in-depth analysis report on critical PHP vulnerabilities, stating that two recently disclosed high-severity PHP flaws pose systemic risks to Web3’s off-chain segments. Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities scored 9.2 on the CVSS v4.0 scale, classified as critical severity. Attackers do not need usernames, passwords, or API keys—they only need to send crafted requests to publicly exposed PHP services to execute arbitrary code with the web service process’s privileges. SlowMist notes the vulnerabilities affect all PHP versions from 5.4 to 8.5.11, with details leaked before official patches were released. Amazon Threat Intelligence observed active exploitation attempts four days prior to public disclosure. SlowMist’s threat intelligence system MistEye scanned 1,488 crypto-related domains, finding 793 (≈53.3%) carry direct PHP fingerprints. This means a large number of Web3 projects’ off-chain infrastructure—including frontends, APIs, airdrop claim pages, admin dashboards, and custodial wallet services—may run on vulnerable PHP environments. SlowMist emphasizes that Web3 security cannot focus solely on on-chain smart contracts. Attackers who exploit PHP vulnerabilities to compromise a project’s web server can alter frontends, trick users into signing malicious transactions, and directly steal assets. Even if on-chain contracts have no flaws, this does not guarantee the safety of off-chain components operating around them. For remediation, the PHP team has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; affected projects should upgrade immediately. PHP 8.1 and older versions have reached end of regular upstream support and must be migrated as soon as possible. SlowMist also warns that temporary mitigation measures for cases where upgrades cannot be done immediately only reduce risks from specific attack vectors—applying patches remains the only definitive solution.

Beating AI News Flash: CCTV's "Yuyuan Tan Tian" program disclosed that after China launched AI technology export registration management on October 16, DeepSeek and MiniMax have successfully completed registration, as well as the open sourcing of related technologies and their overseas authorization. The new catalog is currently in public consultation, with a temporary registration system in effect. The Ministry of Commerce previously clarified that technologies that have entered the public domain via open source are not included in the management scope. New technology open sourcing also has convenient measures such as automatic licensing, basically enabling "registration and immediate approval". Providing model services to overseas via API, web, and App also does not fall under the scope of this large language model technology export management.

According to Lookonchain's monitoring, since October 1st, 40 newly created wallets have cumulatively withdrawn 9,458 BTC (approximately $771.5 million) from Wintermute.