Bitcoin payment processor BTCPay Server confirms critical vulnerability leading to fund theft, urges LND users to upgrade immediately.

Elon Musk reacted with an "awkward" emoji in discussions related to the Binance security incident. CZ responded to this, stating that while he has great respect for Musk, now is not the time for jokes and asked Musk to stop. Additionally, CZ noted that Binance invested $500 million when Musk acquired Twitter, and the SPCX shares held from this investment are now worth over $1 billion, expressing hope that Musk will provide some support.

Beating AI Express News: Elon Musk’s brain-computer interface (BCI) firm Neuralink has unveiled a new feature—users only need to mentally utter “Hey Neuralink” and describe their desired task, and the Grok Agent will autonomously operate a computer without manual input. Neuralink engineers recently visited the home of an amyotrophic lateral sclerosis (ALS) patient, spending 72 consecutive hours developing and testing the new feature. Beyond the Grok Agent prototype, the team also rolled out automatic speech intent recognition, brain signal input, and iPhone calling capabilities. The patient can generate speech via the BCI to make calls with his wife, and even place orders at a coffee shop. Two days ago, Neuralink released early results from its speech restoration trial: an ALS patient achieved 75 English words per minute with a 5.8% word error rate in the first week of use. Musk predicts that BCI information output speed will far outpace human speech or typing rates in the coming years.

According to ChosunBiz, multiple ransomware attacks targeting Synology Network-Attached Storage (NAS) devices have recently emerged in South Korea. Attackers exploited vulnerabilities in Synology’s DiskStation Manager (DSM) system to infiltrate the devices, encrypting users’ stored photos, files and other data, with affected files appended with the “.L0CK3D” suffix. The attackers demand victims pay 0.036960 BTC (approximately $2,952, or 4 million South Korean won) within 5 days to purchase a decryption tool called “C3RB3R DECRYPTOR”; ransom will double to 0.073920 BTC (about $5,904, or 8 million South Korean won) if payment is not made by the deadline. Chinese cybersecurity firm 360 analyzed that the attackers likely exploited two DSM vulnerabilities disclosed by Synology in September this year—CVE-2026-13639 and CVE-2026-13684—to breach devices, using a ransomware variant named C3RB3R to encrypt files. Both vulnerabilities allow external attackers to read or modify files without logging in, each carrying a CVSS severity score of 9.8 out of 10. Synology stated the attacks targeted devices running outdated DSM systems, advising users to immediately upgrade to the latest version. For already infected devices, it recommended disconnecting from the network or powering off, and restoring data via prior backups or snapshots. Synology has not yet released a decryption tool, recovery cost support, or compensation plan. The Korea Internet & Security Agency (KISA) has been receiving victim reports since around October 28, and is preparing to provide technical support, but has not disclosed specific victim scale or incident response details. The report notes the actual scale of losses from the attacks remains unclear, and work files and backup data on enterprise NAS devices may also be impacted.

According to monitoring by Tradingbeats, an address starting with 0x15a liquidated $100 million worth of BTC and ETH long positions on Hyperliquid, realizing a profit of $17.78 million. The address subsequently opened a short position of 20,000 ETH at $2,228, valued at $44.6 million. The address opened long positions of 1,000 BTC at $62,353 and 10,000 ETH at $1,762 in early July 2026, holding the positions for nearly four months.

CryptoQuant CEO Ki Young Ju posted that the Coinbase Premium Index has fallen to its lowest level in four years. The last time this metric hit such a low was in November 2022, following the FTX collapse, when Bitcoin also reached a local bottom. Ki Young Ju believes that current market bearish sentiment has reached a notable level, which could instead signal a bullish turn.

Beating AI News (Insight) reports: Cursor disclosed that on October 29, a maliciously tampered version of Claude Code 2.1.313 appeared in its extension marketplace. The installer was not created by Anthropic and was listed on the store for roughly 11 hours. Cursor estimates up to 5,000 users were affected and will contact them directly. Security research firm OpenSourceMalware analyzed the incident and found attackers inserted 66 lines of malicious code before the plugin’s legitimate code. The malware executes as soon as the editor loads the extension—no interaction with Claude is required. It collects device details including the computer name, Git email, and public IP, and secretly adds the attacker’s SSH key to the system’s authorized list. The malware then attempts to enable remote login, connect to the attacker’s server via a reverse SSH tunnel, and sets up a background task to run on startup, trying to reconnect every 60 seconds. However, the malicious code contains bugs. Cursor noted most Mac and Windows devices lack the admin privileges needed to enable SSH, so attackers generally cannot log in via the tunnel. Still, adding the malicious key, installing the background script, and exfiltrating device information may succeed. Even devices with SSH enabled are not safe. Cursor has removed the malicious extension, temporarily shut down its entire extension marketplace, and assisted in taking down the attacker’s server. Affected users must check their SSH authorized files for `svc-telemetry` and clean up using the official fix script; uninstalling the extension alone is insufficient, as the backdoor may persist.