1. CZ Warns Critical PHP Vulnerability Under Active Exploit: Exercise Extra Caution Visiting Websites in Coming Days link
CZ, founder of Binance, posted a reminder to exercise extra caution when visiting websites in the coming days, as some website administrators may fail to install security patches in a timely manner. He stated that PHP, widely used for web applications such as WordPress and Magento, fixed two critical vulnerabilities (CVE-2026–109618, CVE-2026–109619) on October 21. Details of the vulnerabilities were leaked ahead of their official disclosure, and exploitation of them has since been detected. Under certain conditions, attackers may execute malicious code remotely without authentication, take control of vulnerable web servers, and raise risks such as the theft of user credentials.
Amazon’s threat intelligence team found that hackers attempted to exploit the vulnerabilities as early as October 17, several days before their public disclosure. Exploitation activities intensified after the vulnerabilities were made public on Wednesday. Amazon said the vulnerabilities are being widely exploited but did not release information on specific victims. Cybersecurity firm Palo Alto Networks identified more than 22.6 million exposed instances worldwide affected by the flaws. Researchers at Wiz estimated that the vulnerabilities could impact roughly 70 percent of the internet and that the underlying issue has existed for over a decade. Matt Hull, Vice President of Cyber Intelligence and Response at NCC Group, warned that some vulnerable systems may have already been compromised and backdoored.
Responding to recent debates over offensive and defensive cybersecurity sparked by the discovery of severe PHP vulnerabilities with the aid of AI, Ethereum co-founder Vitalik Buterin said he has never predicted that cyber defenses would automatically stay ahead of attacks. Instead, he believes cybersecurity may eventually evolve into a landscape favorable to defenders in the long run, though the transition will be extremely difficult. He pointed out that having security researchers discover vulnerabilities in existing software before hackers does not create a fundamental defensive advantage. Meaningful shifts in the attack-defense balance require profound changes in technical approaches, including formal verification and minimizing the trusted computing base (TCB), and such transformations have only just begun. This is one key reason he continues to support considering slowing or pausing AI development, and he advocates allocating more than 1 percent of GDP to cybersecurity, biosecurity and real-world safety protection.
2. Dragonfly Partner: Crypto Industry Bears Brunt of Global Hacking Wave First link
Haseeb Qureshi, Managing Partner at Dragonfly, stated that global cybersecurity is facing a wave of hacking attacks analogous to the COVID-19 pandemic, and the crypto industry has experienced this trend first. He believes that since on-chain attacks are the easiest to monetize directly, security incidents involving crypto protocols can serve as an early warning of security risks across the entire internet. While the number of hacking attacks in the crypto industry has surged sharply, the annualized total value of stolen funds remains roughly on par with 2025, indicating that the average loss per attack has declined. Haseeb noted that attackers are targeting small DeFi protocols with weak security measures and insufficient maintenance, whereas large protocols have started leveraging AI tools to bolster defenses. He expects this trend of large-scale attacks to spread to the traditional internet sector.
3. a16z Drops “Crypto” From Flagship Fund Name link
Venture capital firm Andreessen Horowitz (a16z) plans to remove the word “Crypto” from the name of its flagship blockchain fund and expand its investment focus to areas beyond cryptocurrencies. In addition, a founding member of the fund will depart. It remains unclear whether this adjustment will affect its existing crypto investment business. a16z Crypto is one of the largest venture capital institutions in the crypto industry. It completed the fundraising of its $2.2 billion fifth crypto fund in May this year, roughly half the size of the $4.5 billion fourth fund raised in 2022. Its five crypto funds have raised approximately $9.8 billion in total.
4. OCC Issues First GENIUS Act Rule: No Automatic Exemption for Stablecoin Yields, Case-by-Case Review link
The Office of the Comptroller of the Currency (OCC) of the United States has issued the first final implementing rule under the GENIUS Act, setting forth regulatory requirements for stablecoin issuance, custody and third-party collaboration. The rule will take effect on January 18, 2027. Regarding stablecoin yield and reward programs, the OCC stated that existing programs are not automatically deemed compliant merely because they were launched before the Act, and no safe-harbor exemption is granted for pre-existing businesses. Regulators will assess compliance on a case-by-case basis according to specific arrangements.
The GENIUS Act prohibits stablecoin issuers from paying holders returns solely for holding, using or retaining stablecoins, though this does not mean all third-party reward programs are banned. The OCC noted that rewards may fall outside the scope of the prohibition if they are based at least partially on other grounds. Platforms including Coinbase, PayPal and Kraken currently offer stablecoin reward programs, and uncertainty remains over the compliance of such arrangements going forward.
5. Swiss Regulator Approves First Domestic Bitcoin ETF, Grants Partial Diversification Waiver link
The Swiss Financial Market Supervisory Authority (FINMA) announced on October 20 that it has approved the first exchange-traded fund (ETF) for retail investors to invest directly in Bitcoin. Classified under Swiss law as an alternative investment fund with specific risks, the product received a waiver from certain risk diversification rules, as FINMA cited Bitcoin’s longer trading history and higher trading volume relative to other cryptocurrencies. Regulated entities are required to implement measures to mitigate operational and asset custody risks, and clearly disclose Bitcoin’s price volatility and potential loss risks in fund documentation. Sales of the product must also comply with codes of conduct set out in Switzerland’s Financial Services Act (FinSA), including investment appropriateness and suitability assessments. FINMA noted that other fund providers have submitted or announced plans to submit applications for Bitcoin ETFs.
6. JPMorgan: U.S. Regulatory Moves Partly Offset Stalled CLARITY Act, Political and Legal Risks Remain link
JPMorgan analysts said recent policy moves by U.S. regulators have partially offset the negative impact of the stalled CLARITY Act in the Senate, though political and legal risks will persist. The SEC introduced a five-year innovation exemption for tokenized securities, the CFTC is exploring allowing regulated platforms to offer leveraged crypto trading, the OCC has granted national trust charters to stablecoin issuers and digital asset firms, and the FASB is considering permitting companies to classify certain stablecoins as cash equivalents. JPMorgan believes these measures help draw institutional participation in the short term but could be reversed by future administrations and cannot replace congressional legislation. The CLARITY Act is unlikely to pass this year and may be revisited in 2027. The crypto sector will continue to carry a high political and legal risk premium until comprehensive market structure legislation is enacted.
7. Ethereum Community Proposes Consensus Decoupling Draft for Post-Quantum Upgrade and Faster Finality link
A core protocol draft titled “Decoupled Consensus” has appeared in the Ethereum EIP repository. It proposes separating beacon chain head voting from finality voting to improve fork-choice safety, reduce finalization time, and lay groundwork for a future transition to post-quantum cryptography. Authored by Francesco D’Amato, Roberto Saltini, Yann Vonlanthen, Mikhail Kalinin, Ben Edgington and others, the proposal remains an early draft with many details unresolved. The submitters primarily seek an EIP number at this stage. The proposal is pending further review and has not been merged.
8. Solana’s Major Alpenglow Upgrade Goes Live, Targets ~150ms Transaction Finality link
Alpenglow, Solana’s largest network upgrade since 2020, went live on Wednesday. The upgrade moves validator voting off-chain into certificates, enabling transactions to be finalized within one to two rounds. It targets a reduction in transaction finality time from roughly 6 seconds to around 150 milliseconds, representing a roughly 40-fold speedup. The current 6-second finality window allows prices to shift before transactions are locked in, forcing exchanges and payment applications to wait before marking deposits as completed. By comparison, Ethereum takes approximately 13 minutes to achieve full finality. Validator costs are projected to drop by about 60%. Validators currently pay roughly 2 SOL per day in voting fees; Alpenglow eliminates per-vote fees and replaces them with a fixed validator admission ticket fee of 0.8 SOL per epoch, which lasts about 24 hours. Since launching in early May, the testnet has been wiped and restarted six times, including one full-network migration failure that required a rollback. Galaxy Digital, one of around 100 validator operators on the testnet, stated that subsequent migrations succeeded. The upgrade activated at the start of epoch 1064 on Wednesday, with the actual change taking effect at slot 459,653,000.
9. Mastercard Opens Early Access to AI Agent Payment System, Completes Pilots With Coinbase, Base and Others link
Mastercard has opened early access to its AI agent payment system Agent Pay for Machines for developers after completing end-to-end pilots with Coinbase, Base, Cloudflare, Ant International, BVNK and AIsa. It provides buyer and seller APIs, a development toolkit and a sandbox environment and is not yet commercially available. During the demonstration at Cloudflare Connect, an AI agent completed nine payments to two service providers within a preset budget via the x402 protocol introduced by Coinbase. The Coinbase Developer Platform supplied wallet infrastructure while Base handled on-chain settlement. The system supports deferred batch settlement of payment credentials and enables fiat and stablecoin payments through BVNK and Mastercard’s payment infrastructure.
10. Microsoft, Goldman Sachs and 14 Other Firms Oppose Tokenized Stock Trading on OKX-ICE Joint Platform link
Seven listed companies including Microsoft, Alphabet (Google’s parent firm) and Goldman Sachs have opposed the trading of tokenized versions of their shares on OKXICE, the joint platform established by OKX and Intercontinental Exchange (ICE), parent of the New York Stock Exchange. According to an updated notice released by OKXICE on October 19, the newly added objectors also include Qualcomm, Caterpillar, McDonald’s and Western Digital, bringing the total number of dissenting firms from nine to sixteen. Broadcom, Verizon and CoreWeave were among the companies that previously raised objections. OKXICE plans to launch round-the-clock tokenized stock trading under the U.S. SEC’s innovation exemption framework, with stablecoin settlement and backing by actual shares on a one-to-one basis. The framework allows issuers to object to tokenized trading of their shares on specific platforms, and the specific reasons for these companies’ objections have not yet been disclosed.
Fundraising
X Pay, an AI agent payment infrastructure provider, has raised $1 million. link
Dataline has secured $10.6 million in seed funding with participation from Coinbase Ventures and other investors. link
Tether led the pre-seed round for Peso to expand USDT payment infrastructure across Latin America. link
Crypto data provider Kaiko secured an extended Series B round led by S&P Global, bringing the total round size to $110 million. link
Hylo completed a $1 million strategic round led by Solana Ventures. link
Mural announced the completion of a $15 million funding round led by Tether. link
The developer of Bitcoin yield platform HoneyB closed a $5 million financing round at a $30 million valuation. link
Learn more, check out crypto-fundraising.info.
Follow us
Twitter: https://twitter.com/WuBlockchain
Telegram: https://t.me/wublockchainenglish