Putin in principle has agreed to resume the trilateral peace talks between Russia, the United States and Ukraine, with Abu Dhabi a possible venue.

White House officials said on October 21 that Trump planned to focus on the U.S. government’s actions to crack down on overseas crypto fraud rings during the White House’s cybersecurity event that day, including recovering funds and shutting down fraudulent operations. These transnational criminal groups steal funds from U.S. citizens via romance scams, phishing, ransomware and other methods. The U.S. government noted that law enforcement agencies have seized approximately $833 million in crypto assets linked to overseas fraud, and shut down 503 fraudulent crypto websites under the supervision of the Homeland Security Task Force. Relevant authorities have also notified nearly 9,000 U.S. citizens to alert them they are being targeted by fraud. The U.S. Treasury Department previously announced the establishment of an inter-agency "Fraud Strike Task Force" to target "pig butchering" scams run by organized criminal groups in Myanmar, Cambodia, Laos and the Philippines. Since last year, the U.S. has also imposed multiple sanctions aimed at cutting off support for related fraud websites and their infrastructure.

Crypto journalist Eleanor Terrett reported that the American Bankers Association (ABA) has voiced dissatisfaction with the final rules implemented by the U.S. Office of the Comptroller of the Currency (OCC) under the GENIUS Act. The OCC abandoned the previously proposed restrictions on stablecoin yields, a move the ABA argues will "maintain the status quo for crypto platforms." The ABA’s CEO stated: "It is a mistake to wait until deposit outflows and economic harm have already occurred before attempting to address these issues."

Node.js rolled out a security update on October 21, covering its 26.x, 24.x, and 22.x version branches, with corresponding patched releases: 26.12.1, 24.22.1, and 22.23.4. The advisory details 10 total vulnerabilities, categorized as 4 critical-severity, 3 medium-severity, and 3 low-severity, with varying impact scopes across the three version lines. The critical CVE-2026-111497 is an out-of-bounds write flaw in the Brotli decoder that could enable remote code execution (RCE), affecting all three branches. Other critical issues include improper null character handling in DNS resolution and a TLS certificate hostname validation bypass. The update also resolves problems with persistent connection response processing, random number cache duplication, and permission models, while updating dependencies including c-ares, OpenSSL, and Undici. The official note warns that end-of-life (EOL) versions may still be vulnerable, advising users to use the latest supported releases. Separately, prior reports noted PHP has fixed two critical unauthenticated RCE vulnerabilities, with patches available for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP users are urged to upgrade immediately.

Renowned trader Bonk Guy posted that the current crypto market is showing characteristics of a "privacy cycle". He noted that since yesterday, Bitcoin has risen approximately 3%, ZEC is up 16%, adding over $3 billion in market capitalization. MASK currently has a market cap of roughly $26 million, with its protocol trading volume and fees hitting consecutive all-time highs, he added. Citing data from DefiLlama, he stated that MASK ranks first among privacy protocols by revenue, outearning the next 10 privacy protocols combined. By comparison, ZEC’s market cap gain over the past 24 hours is roughly 115 times MASK’s entire market cap. Bonk Guy also said that MASK’s upcoming deployment on Solana is set to launch in the coming days, which he expects will further drive growth in usage, trading volume, and fees. He went on to call MASK the most undervalued privacy protocol in the crypto market.

The White House stated that the U.S. government was alerted to the PHP security vulnerability on October 16. It is closely monitoring the issue and coordinating with federal agencies and leading systems integration labs to accelerate the rollout of fix patches. The White House noted that federal agencies are evaluating the vulnerability’s potential impact on government systems and critical infrastructure, and are working with network operators to prioritize mitigation measures.

Beating AI Express: Security firm JFrog has discovered that popular open-source AI model gateway LiteLLM has fallen victim to another supply chain attack. Its latest v1.107.0 version was implanted with malware, and official Docker images were also compromised. LiteLLM enables unified access to models from providers like OpenAI and Anthropic, and centralizes API key management. It was previously targeted by a supply chain poisoning attack back in March this year. This latest attack is far more stealthy: hackers hid three extra files in Python packages. After installation, whenever users launch the associated Python environment—even without invoking LiteLLM—the malicious code runs automatically. It steals browser passwords, SSH private keys, AWS and other cloud platform credentials, plus authentication data for development tools including Claude, Codex, and Cursor. The malware also attempts to exfiltrate model API keys stored in LiteLLM’s database to servers masquerading as official domains. Attackers also embedded a persistent backdoor that checks for remote commands hourly, downloading and executing new code as needed. Notably, the official source code on GitHub contained no malicious files, but all seven platform-specific packages released to PyPI were infected with trojans. The community traced the issue via Docker build logs: the release system used a source address pointing to a fake repository that differed from the official one by only one hyphen. How the fake repo slipped into the release pipeline remains unconfirmed. PyPI has since removed the malicious versions, and Docker Hub has taken down affected images. JFrog warns users who installed or ran v1.107.0 to treat all related credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive data like API keys—rather than simply uninstalling the software. The confirmed safe rollback version is v1.106.2.