Index
Search
Search the public record. Drafts and scheduled notes are not included.
defi
A $20,000 vote took over Astroport and Drop on Neutron. Here is what the post-mortem says
On 22 September 2026 an attacker bought about 31.6M NTRN for roughly $20,199, passed Neutron governance proposal 9 and took admin control of 11 contracts belonging to Astroport, Drop and Neutron's investor vesting. Ten were emptied. The post-mortem counts about $6.24M taken and about $4.01M secured.
Published 3h ago
defi
Hemi lost 124.5M unclaimed HEMI to a claim contract bug, says its post-mortem
Hemi says an attacker drained about 124.5 million unclaimed HEMI from its legacy Genesis Drop claim contract on 7 September 2026 by calling back into the contract before it updated its balances. The tokens sold for about $255,000. HEMI, veHEMI and bridges were not affected.
Published 4h ago
threats
Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) has a public PoC and one honeypot hit
Four Plex Media Server CVEs form the Plex2Shell chain, which a researcher says gives unauthenticated remote code execution. A public repository covers it. One researcher saw the published code used against a honeypot on 17 October 2026 and a cryptominer dropped. Fixed in 1.43.3.10861. Not in CISA KEV as of check.
Published 7h ago
news
Camel Quarkus XXE is CVE-2026-88789
Apache disclosed CVE-2026-88789 in Camel Quarkus: the Xalan-backed XSLT support factory drops JAXP external-access hardening, enabling XXE that can read local files or reach internal hosts. CVSS 3.1 8.6 from Apache. Fixed in 3.33.3 and 3.40.0. A public reproducer exists. Not in CISA KEV.
Published 5 Oct 2026
CVE-2026-88789
Camel Quarkus Xalan TransformerFactory drops XXE hardening
Other
Published 1 Oct 2026