💥 BREACHES & INCIDENTS
- MetaMask discloses infrastructure security incident, exits Ethereum validators from Lido MetaMask disclosed a security incident affecting part of its staking infrastructure and is exiting its Ethereum validators from Lido as a precaution.
- Affects MetaMask Staking (formerly Consensys Staking) clients and Lido stETH holders; MetaMask says no immediate threat to MetaMask wallets.
- Part of MetaMask's infrastructure was compromised; the company has not disclosed which systems, how attackers got in, or how many validators/ETH are affected.
- MetaMask is proactively exiting affected validators in its non-custodial staking operations, with all Lido validators expected exited by end of October 7, 2026.
- Staking is non-custodial — MetaMask does not hold withdrawal keys — so the main risk is slashing via misused signing keys, not theft of staked ETH.
- Lido expects foregone rewards and possible downtime penalties, with ETH re-entering the protocol over up to ~45 days due to Ethereum's extended entry queue. 📄 Source: metamask.io · 📎 Coverage: cyberkendra.com · 👁 via BleepingComputer, The Hacker News
🕵️ RESEARCH & DEEP DIVES
- Acer NitroSense/PredatorSense flaw CVE-2026-50610 lets standard users gain SYSTEM Intrinsec researchers disclosed a local privilege escalation (CVE-2026-50610) in Acer's NitroSense/PredatorSense software that lets any standard user become SYSTEM.
- Affects Acer laptops running NitroSense/PredatorSense, built on the shared Acer System Monitor engine and its AcerSysHardwareService.exe SYSTEM service.
- The named pipes systemmonitoring_hardware_service_ and predatorsense_hardware_service_ are writable by all authenticated users.
- The pipe's SDDL grants read/write/execute to any authenticated user, and the service does not verify or impersonate the caller's privileges.
- Commands sent over the pipe execute as NT AUTHORITY\SYSTEM, yielding local privilege escalation from any standard user account. 📎 Coverage: intrinsec.com · 👁 via r/netsec