Iran and Gulf countries to hold meeting to advance Strait of Hormuz agreement.

Email marketing platform Brevo has disclosed that attackers exploited an authorization boundary vulnerability in its login system to access 138 customer accounts. Among these accounts, 6 were used to send phishing emails, 43 had their contact information exported, and 93 showed no signs of valid misuse. Brevo did not clarify whether there was overlap between these account categories. Affected clients include crypto hardware wallet manufacturers Trezor and BitBox, as well as crypto portfolio and tax reporting platform CoinTracking. Attackers used Trezor’s Brevo account to send phishing emails titled “Critical Security Alert: STM32 Entropy Vulnerability” to around 347,000 newsletter subscribers, directing users to a malicious application to submit wallet backup information. Trezor blocked the relevant domain at the DNS layer within 20 minutes, but approximately 2,500 users had already accessed the link by then. Trezor stated that its Brevo account only stored subscribers’ email addresses, not other customer data, but is currently treating all roughly 347,000 email addresses as compromised by attackers, which could be used for subsequent phishing activities. BitBox has not yet found evidence of leaked funds or recovery phrases; CoinTracking users received fake emails asking them to refresh their API keys.

Per TradingBeats monitoring, the total long position of "Ma Ji" has expanded to $107 million, with an unrealized profit of roughly $80,000 as of now, while the trader has incurred a $5.6 million loss over the past week. The position breakdown is as follows: · 40,650 ETH long positions with 25x leverage, valued at approximately $99.971 million; · 50 BTC long positions with 40x leverage, worth around $3.856 million; · 42,950 HYPE long positions with 10x leverage, totaling about $3.406 million.

Beating AI Express News: Cursor has launched Projects, upgrading from a single Agent working model to an "Agent managing Agents" framework. Each project features a coordinating Agent that does not write code itself; instead, it is responsible for breaking down tasks, formulating plans, and distributing work to thousands of sub-Agents for parallel execution. Projects permanently store codebases, research findings, and user preferences, enabling work to resume even after months of pause. Tasks run on the cloud by default, so they won’t stop even when your computer is powered off; when local testing is required, it automatically spins up local Agents. The tool can also monitor Slack and pull requests (PRs), automatically fix CI issues, and kick off new tasks on its own without users needing to send additional prompts. This marks the official productization of Cursor’s earlier multi-Agent experiments. Back in January this year, Cursor demonstrated hundreds of Agents collaborating simultaneously, even building a browser from scratch with over 1 million lines of code. Now Projects is in beta and gradually rolling out to all users.

According to an official announcement, Binance will temporarily suspend U.S. stock trading to carry out system upgrades for its partner broker program. During this period, users will be unable to submit stock trading orders. The system upgrade is scheduled from 18:50 to 21:30 on September 12, 2026 (GMT+8).

From 动察 Beating AI Express: Security researcher Shou Chaofan said he recently purchased around 6TB of Fable model call data from a leading Chinese large language model (LLM) proxy. The dataset contained sensitive credentials including SSH keys, VPN configurations, Alibaba Cloud keys, and GitLab tokens. He added that the keys were sufficient to gain access to servers or internal systems of 19 leading Chinese enterprises and 7 Chinese and CIS government-related entities, including Huawei, Xiaomi, Nio, and MiniMax. LLM proxies sit between users and models like Claude, processing all requests and responses, so they have full access to plaintext data. Once developers insert SSH keys, API keys, VPN configurations, and other sensitive data into agent contexts, if proxies store or sell these records, the company’s system keys will leak. This is not Shou’s first warning about proxy risks. In an April paper he co-authored, 428 LLM proxies were tested: 9 actively injected malicious code, 17 used intentionally planted AWS test keys to access AWS services, and 1 directly siphoned ETH from a test wallet. Shou is co-founder of blockchain security firm Fuzzland, with a long focus on vulnerability and supply chain security research. In late March, he also led the discovery that Claude Code 2.1.88’s release package accidentally exposed roughly 500,000 lines of TypeScript source code via source maps.

Bitget’s API now fully supports Contracts for Difference (CFDs), further extending its algorithmic trading capabilities from crypto assets to global markets including gold, foreign exchange (forex), stock indices, and crude oil. Institutional clients and professional traders can directly manage CFD accounts via the API, covering core functions such as order execution, account inquiry, fund transfers, real-time market data, and risk control parameters, enabling them to extend their existing strategies to traditional financial derivatives markets within a familiar API framework. This upgrade further enriches the scenario dimensions of algorithmic trading. Traders can integrate factors like macroeconomic data, Federal Reserve policies, employment and inflation figures, oil prices, and stock index fluctuations into their strategy models, and flexibly configure these alongside different account types such as ECN, STP, and Pro. Through a unified API framework, the platform provides professional traders and institutional clients with more comprehensive algorithmic trading capabilities for global markets.