💥 BREACHES & INCIDENTS
- Qubic halts blockchain after attacker drains 1,404 wallets via weak seed randomness
An attacker brute-forced weakly generated Qubic wallet seeds to steal ~$1.4 million from 1,404 wallets, prompting the network to halt.- Affects Qubic wallets whose seeds were created in any browser on iPhone/iPad before Oct 18, 2026, in Safari on Mac before that date, or in the Qubic iOS app before July 2025.
- Wallet seeds were generated with insufficient randomness (JavaScript Math.random()), letting attackers enumerate possible seeds and drain 1,404 wallets of ~2.94 trillion QU (~$1.3-1.4M) between Oct 17 23:42 UTC and Oct 18 01:26 UTC.
- The flaw was in wallet seed generation, not the Qubic protocol; validators halted the network at tick 85,371,949.
- 87.1% of stolen funds remain frozen on-chain; 12.9% (~379 billion QU) went to MEXC, which froze the receiving account within an hour.
- Fixed in web wallet version 4.26.4, which replaced Math.random() with crypto.getRandomValues().
🕵️ RESEARCH & DEEP DIVES
- Heartbreaker: undetected metamorphic ransomware targeting macOS Apple Silicon Macs
A previously unknown macOS ransomware sample called Heartbreaker encrypts files using a hard-coded AES key and can metamorphically rebuild itself.- Targets macOS users, specifically ARM64 (Apple silicon) Macs; sample first uploaded to VirusTotal in May 2025 and remains undetected by all AV engines
- Encrypts files in the user's Downloads folder with AES-256-GCM using a hard-coded key, appends a .heartbreaker extension, and drops a README.txt ransom note demanding 0.003 BTC
- Unusually for ransomware, it persists via mimicore::add_to_startup() and attempts to metamorphically rebuild itself by rewriting its Rust source and recompiling with cargo
- Files can be decrypted without paying because the same hard-coded key is reused for every file
- Written in Rust; sample available in Objective-See's malware collection (SHA-256 6bdf42a5...90d18)
🔓 CVEs & KEV
CVE-2026-105299 — Cloudflare https://github.com/cloudflare/pingora — CVSS 8.7 — Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, all...
CVE-2026-102438 — ASUS Armoury Crate — CVSS 8.5 — An uncontrolled search path element vulnerability in ASUS Armoury Crate allow...
CVE-2026-12489 — Zyxel EX3501-T0 firmware — CVSS 6.5 — An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zy...