https://www.threatwire.tech/news/infinity-core-linux-kernel-exec-timer-bug-cve-2026-98260-has-public-root-pocThreatWireen2026-10-19T06:55:00.000ZInfinity Core: Linux kernel exec timer bug CVE-2026-98260 has a public root PoC https://www.threatwire.tech/defi/defi-hacks-september-2026-recap-post-mortemsThreatWireen2026-10-19T03:28:00.000ZDeFi hacks, September 2026: the worst month of the year, read through the post-mortems https://www.threatwire.tech/defi/symbiosis-bitcoin-bridge-46-billion-sybtc-mint-330-satoshiThreatWireen2026-10-19T03:28:00.000ZSymbiosis's Bitcoin Bridge minted 46 billion syBTC from a 25-cent deposit. Real losses were about 9.97 BTC https://www.threatwire.tech/defi/the-20000-dollar-problem-oracles-governance-votes-cheap-inputsThreatWireen2026-10-19T03:28:00.000ZThe $20,000 problem: when a protocol's input is cheaper than what it controls https://www.threatwire.tech/defi/unbacked-mints-five-incidents-same-question-liquid-near-meter-symbiosisThreatWireen2026-10-19T03:28:00.000ZUnbacked mints: five 2026 incidents, one question the code forgot to ask https://www.threatwire.tech/defi/uncx-vesting-v2-share-accounting-exploit-four-chainsThreatWireen2026-10-19T03:28:00.000ZUNCX Vesting V2 was drained on four chains. The headline said $1.49M, UNCX's own count says about $808K https://www.threatwire.tech/defi/flashloopadapter-safe-module-aave-114-eth-spoofable-caller-checkThreatWireen2026-10-19T03:20:00.000ZFlashLoopAdapter: how a spoofable caller check cost two Safe wallets 114 ETH https://www.threatwire.tech/defi/meter-passport-bridge-unbacked-mint-2-3m-september-2026ThreatWireen2026-10-19T03:20:00.000ZMeter's Passport bridge minted about $2.3M of unbacked tokens, then the chain was paused https://www.threatwire.tech/defi/neutron-governance-takeover-astroport-drop-proposal-9ThreatWireen2026-10-19T03:20:00.000ZA $20,000 vote took over Astroport and Drop on Neutron. Here is what the post-mortem says https://www.threatwire.tech/defi/payy-forged-zk-proof-bridge-exploit-1-9m-usdcThreatWireen2026-10-19T03:20:00.000ZPayy's bridge paid out $1.9M after its verifier accepted a forged proof https://www.threatwire.tech/defi/pragma-vesu-4-september-oracle-incident-47-liquidationsThreatWireen2026-10-19T03:20:00.000ZPragma's 4 September oracle error halved major prices on Starknet and set off 47 liquidations https://www.threatwire.tech/defi/hemi-genesis-drop-merklebox-reentrancy-exploit-postmortemThreatWireen2026-10-19T02:46:00.000ZHemi lost 124.5M unclaimed HEMI to a claim contract bug, says its post-mortem https://www.threatwire.tech/defi/limit-break-payment-processor-v2-forged-sender-exploitThreatWireen2026-10-19T02:46:00.000ZLimit Break Payment Processor V2 was abused through a forged sender, taking about $2.8M https://www.threatwire.tech/defi/liquid-network-4000-btc-unbacked-lbtc-proof-cache-bugThreatWireen2026-10-19T02:46:00.000ZLiquid Network lost about 4,000 BTC to a proof cache bug, says Blockstream https://www.threatwire.tech/defi/near-intents-3-8m-ghost-funds-deposit-notification-bugThreatWireen2026-10-19T02:46:00.000ZNEAR Intents lost about $3.8M to a deposit notification bug, says its postmortem https://www.threatwire.tech/defi/nostra-finance-nstr-oracle-manipulation-pragma-postmortemThreatWireen2026-10-19T02:46:00.000ZNostra Finance lost about $3.5M after a thin pool price fooled its oracle https://www.threatwire.tech/defi/notional-v1-legacy-escrow-integer-overflow-exploitThreatWireen2026-10-19T02:46:00.000ZNotional V1 lost about $1.7M from a deprecated escrow contract, says its post-mortem https://www.threatwire.tech/news/apache-airflow-ssh-and-sftp-providers-skip-host-key-checks-cve-2026-94134-94135ThreatWireen2026-10-19T00:32:00.000ZApache Airflow SSH and SFTP providers skip host key checks by default (CVE-2026-94134, CVE-2026-94135) https://www.threatwire.tech/news/apache-kylin-5-0-5-fixes-21-cves-including-critical-cve-2026-64959ThreatWireen2026-10-19T00:32:00.000ZApache Kylin 5.0.5 fixes 21 CVEs, including critical CVE-2026-64959 https://www.threatwire.tech/threats/plex2shell-chain-cve-2026-96652-96654-96655-96656-has-public-pocThreatWireen2026-10-19T00:14:00.000ZPlex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) has a public PoC and one honeypot hit https://www.threatwire.tech/news/drupal-core-field-ui-rce-is-cve-2026-108097ThreatWireen2026-10-18T08:50:00.000ZDrupal core Field UI RCE is CVE-2026-108097: update to 11.4.10, 11.3.19 or 10.6.19 https://www.threatwire.tech/threats/opencode-console-breach-exposes-saved-ai-provider-keysThreatWireen2026-10-18T05:10:00.000ZOpenCode Console breach may have exposed saved AI provider keys