Oct 29, 2026
0 new incidents, 2 with updates.
Updated
- LiveHighNo patch yet
zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root
An attacker drained about $779K to $786K in ETH and 11 ERC-20 tokens (mostly pufETH) from zkLink Nova's Ethereum escrow and ERC-20 bridge in a single transaction on Oct 28 at 22:21 UTC. Blockaid says the attacker used a public relayer to inject a forged batch root and then finalized withdrawals to addresses they chose. SlowMist traces the root cause to the Arbitrator contract's claimMessage function, which did not clear a stored message hash or require a fresh authenticated callback, letting the publicly callable SyncL2TxHashRelayer make ZkLink.syncBatchRoot run as the legitimate Ethereum gateway. Blockaid called the attack ongoing and the main escrow still showed as unpaused hours later; zkLink had not commented.
zkLink Nova bridge (Ethereum L1 escrow and ERC-20 bridge)Since Oct 28, 2026
- LiveCriticalPartly patched
PHP2Shell: critical unauthenticated RCE in PHP core
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (QNAP shipped NAS firmware fixes Oct 24; other appliance vendors are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
PHPSince Oct 17, 2026
