Rosenblatt initiates coverage on Robinhood with a Buy rating and a $135 target price; JPMorgan raised its target price for the stock to $115 on the same day.

SlowMist Security Team has released an in-depth analysis report on critical PHP vulnerabilities, stating that two recently disclosed high-severity PHP flaws pose systemic risks to Web3’s off-chain segments. Tracked as CVE-2026-109618 and CVE-2026-109619, both vulnerabilities scored 9.2 on the CVSS v4.0 scale, classified as critical severity. Attackers do not need usernames, passwords, or API keys—they only need to send crafted requests to publicly exposed PHP services to execute arbitrary code with the web service process’s privileges. SlowMist notes the vulnerabilities affect all PHP versions from 5.4 to 8.5.11, with details leaked before official patches were released. Amazon Threat Intelligence observed active exploitation attempts four days prior to public disclosure. SlowMist’s threat intelligence system MistEye scanned 1,488 crypto-related domains, finding 793 (≈53.3%) carry direct PHP fingerprints. This means a large number of Web3 projects’ off-chain infrastructure—including frontends, APIs, airdrop claim pages, admin dashboards, and custodial wallet services—may run on vulnerable PHP environments. SlowMist emphasizes that Web3 security cannot focus solely on on-chain smart contracts. Attackers who exploit PHP vulnerabilities to compromise a project’s web server can alter frontends, trick users into signing malicious transactions, and directly steal assets. Even if on-chain contracts have no flaws, this does not guarantee the safety of off-chain components operating around them. For remediation, the PHP team has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35; affected projects should upgrade immediately. PHP 8.1 and older versions have reached end of regular upstream support and must be migrated as soon as possible. SlowMist also warns that temporary mitigation measures for cases where upgrades cannot be done immediately only reduce risks from specific attack vectors—applying patches remains the only definitive solution.

Beating AI News Flash: CCTV's "Yuyuan Tan Tian" program disclosed that after China launched AI technology export registration management on October 16, DeepSeek and MiniMax have successfully completed registration, as well as the open sourcing of related technologies and their overseas authorization. The new catalog is currently in public consultation, with a temporary registration system in effect. The Ministry of Commerce previously clarified that technologies that have entered the public domain via open source are not included in the management scope. New technology open sourcing also has convenient measures such as automatic licensing, basically enabling "registration and immediate approval". Providing model services to overseas via API, web, and App also does not fall under the scope of this large language model technology export management.

According to Lookonchain's monitoring, since October 1st, 40 newly created wallets have cumulatively withdrawn 9,458 BTC (approximately $771.5 million) from Wintermute.

Whales are accumulating $BTC! Since Oct 1, 40 newly created wallets have withdrawn 9,458 $BTC ($771.5M) from #Wintermute.

Beating AI Flash News: Anthropic announced it is donating the Agent Skills standard to the Agentic AI Foundation (AAIF), an initiative under the Linux Foundation. The format was developed by Anthropic for Claude Code, launched in October 2025, and opened as a cross-platform standard in December 2025. Over 70 agent platforms including ChatGPT, Cursor, and GitHub Copilot have already integrated the standard. A Skill acts as a reusable "work manual" for AI agents: developers outline task steps in a SKILL.md file, and can attach scripts and reference materials for agents to access on demand. MCP (Model Context Protocol) enables agents to connect to external tools and data, while Skills guide them to complete specific tasks. Anthropic’s donation includes the standard’s name, logo, GitHub organization, and official website domain. The AAIF was co-founded in 2025 by Anthropic, OpenAI, and Block under the Linux Foundation, and previously received the MCP standard. Moving forward, engineers from Anthropic, OpenAI, and Google will jointly maintain the Skills standard in their individual capacities, ending Anthropic’s sole leadership. The Skills ecosystem is expanding rapidly: Vercel data shows the skills.sh directory hosts around 1 million skills, with nearly 280 million total installations. Security risks have also surfaced: Snyk identified 76 malicious skills in ClawHub’s skill samples. Anthropic has proposed establishing version control, formal proposal processes, and security guidelines.

Phase 3 data for the personalized melanoma vaccine co-developed by Moderna (MRNA) and Merck was leaked early. Despite positive clinical results, the stock was heavily sold off. During Thursday’s U.S. trading session, MRNA hit a low of $180.80, down approximately 26.45% from the prior close, and roughly 28.95% from its October 21 peak of $254.48. The stock later rebounded, closing at $202.63, down 17.57% on the day. The positive results reportedly failed to meet the market’s already elevated expectations. According to Reuters, the released data shows the combination therapy reduced melanoma recurrence or death risk by 42%, and distant metastasis or death risk by 38%. After the stock had surged over 500% year-to-date, the market had already priced in high expectations for the vaccine’s efficacy and future commercial prospects. Institutions including UBS noted that the recent decline is more akin to a typical "sell the news" move, as investors began reassessing whether the clinical results can justify the earlier valuation gains.