SlowMist's PHP Vulnerability Report: Affects Web3 Off-Chain Infrastructure, Project Teams Should Immediately Upgrade to the Latest Version

Beating AI Express: Vercel announced it will phase out long-term static keys from its Marketplace. Starting November 30, third-party services that still rely on long-term keys and do not support Vercel OIDC authentication will be marked as "insecure". By January 2027, non-compliant providers will be delisted, with Vercel’s own APIs and native integrations required to follow the same standards. Long-term keys are non-expiring credentials, often stored in environment variables to enable apps or AI Agents to access services like databases. If leaked, attackers can exploit them indefinitely. Vercel’s OIDC, by contrast, allows programs to obtain short-lived credentials based on their own identity, with restricted access scopes and permissions. After credentials expire, the SDK automatically refreshes them, and caching reduces extra requests, eliminating the need for developers to manually rotate keys repeatedly. Vercel has faced such risks before: in April this year, third-party AI tool Context.ai was hacked, letting attackers breach Vercel’s internal systems and access some customers’ environment variables. The company only announced full remediation on October 16. Vercel also disclosed that past key rotation efforts consumed thousands of engineering hours. The company surveyed over 1,000 SaaS providers and found only 8.4% support the more secure authentication method. Long-term keys are widely used for their simplicity, while short-lived credentials are safer but more complex to configure and may increase network latency. Vercel is mitigating these costs via SDK and automatic caching, and using Marketplace listing eligibility to push providers to adopt more secure authentication practices.

According to Reuters citing Bloomberg, SpaceX is in talks with U.S. cellular infrastructure companies to gain access to at least 80,000 cell tower sites nationwide. Insiders said the relevant deal could solidify its path to become the fourth national wireless carrier, challenging AT&T, Verizon, and T-Mobile. The report noted SpaceX is acquiring national low-frequency spectrum and has held negotiations with tower firms including Crown Castle. Data from the Wireless Infrastructure Association shows 80,000 sites are roughly half of the total dedicated cellular towers in the U.S. last year, which stood at around 158,500. Public records show Crown Castle operates about 40,000 towers in the U.S., American Tower has roughly 42,000 U.S. sites, and private firm Vertical Bridge owns around 18,000 towers. When asked at Wednesday’s earnings call whether it was in lease talks with satellite communications players like SpaceX and Amazon, Crown Castle CEO Christian Hillabrant said, "You can consider we are in discussions with all parties," but declined to name specific clients. TD Cowen estimates building a national terrestrial network could cost over $80 billion, requiring years of additional capital investment, with related lease transactions potentially running into billions of dollars. Crown Castle, American Tower, Vertical Bridge, and SpaceX did not immediately respond to Reuters’ request for comment. Separately, SpaceX recently reached an agreement to acquire a portfolio of approximately 800MHz low-frequency spectrum across the U.S. held by Grain Management, pending FCC approval. This week, the FCC also approved SpaceX’s plan to launch around 15,000 second-generation direct-to-phone satellites. CEO Elon Musk said at an earnings call that SpaceX will build a terrestrial network to achieve wide coverage in areas where SpaceX and Starlink are licensed to operate. Following the news, AT&T, Verizon, and T-Mobile saw post-market declines ranging from 4.2% to 5%.

According to data from Farside, U.S. spot Bitcoin ETFs posted a net outflow of $635 million yesterday. Among them, BlackRock’s IBIT saw a net outflow of $254 million, Fidelity’s FBTC recorded a net outflow of $217 million, and ARK’s ARKB had a net outflow of $109 million. Additionally, U.S. spot Ethereum ETFs reported a net outflow of $110 million yesterday, with BlackRock’s ETHA seeing a net outflow of $75.5 million and BlackRock’s ETHB recording a net outflow of $17.2 million.

According to official sources, Bitget has launched two stock perpetual contracts: DHR (Danaher) and TSTOCK (American Telephone & Telegraph). The contracts are settled in USDT, support up to 20x leverage, and are available for 24/7 trading. As of now, Bitget supports a total of 376 stock contract underlyings.

According to TradingBeats data, the largest short position address for crude oil (xyz:CL) on Hyperliquid is on the verge of liquidation. The address uses an aggressive 20x leverage to trade crude oil contracts, holding a position worth $12.63 million, with an entry price of $96.7 and a liquidation price of $102.85. At the current oil price of $100, it only needs to rise 2.85% more to trigger liquidation. Recently, oil prices have climbed again, driven by a combination of surging Middle East geopolitical risks and persistent tight supply. Escalating U.S.-Iran tensions in the Strait of Hormuz, increased clashes between Iran’s Revolutionary Guards and U.S. forces, and ongoing Houthi attacks on Saudi oil facilities have collectively lifted the risk premium for crude oil supply disruptions.

Beating AI News Flash: CCTV's "Yuyuan Tan Tian" program disclosed that after China launched AI technology export registration management on October 16, DeepSeek and MiniMax have successfully completed registration, as well as the open sourcing of related technologies and their overseas authorization. The new catalog is currently in public consultation, with a temporary registration system in effect. The Ministry of Commerce previously clarified that technologies that have entered the public domain via open source are not included in the management scope. New technology open sourcing also has convenient measures such as automatic licensing, basically enabling "registration and immediate approval". Providing model services to overseas via API, web, and App also does not fall under the scope of this large language model technology export management.