57 posts
On September 19, 2026, SlowMist together with OKX's security team disclosed that iOS app FomoPeek versions 1.1 and 1.2 shipped with an iOS kernel exploit framework, able to break out of the sandbox and read and decrypt the system Keychain — exposing private keys, seed phrases and login credentials. Affected iOS versions: 12.0–18.7 and 26.0–26.1.
GitLab has notified users that it will stop serving accounts in Mainland China, Hong Kong and Macao, and plans to delete those accounts after September 7, 2026. If you got the email, back up your code, project data and CI configuration as soon as possible.
Some Coldcard firmware releases seeded keys from a predictable software pseudo-random number generator, which means private keys could be brute-forced offline.
After 1Password raised prices by 33%, I nearly switched to Bitwarden — but one critical problem made me stay. This post compares the mainstream password managers, analyzes the risks of Passkey lock-in, and shares how to boost security with a YubiKey and successfully negotiate a 25% renewal discount.
Swiss-based crypto asset management platform SwissBorg has confirmed a major security incident: roughly 192,600 SOL were lost, worth over $41 million. The breach occurred on August 9, 2025, tied to a compromised API provided by its third-party staking infrastructure partner Kiln, which let an attacker access the staking wallet and move the assets without authorization.
Starting at 13:16 UTC on September 8, a series of packages pushed to npm appeared to contain malicious code. The attack is highly targeted — a large-scale campaign aimed primarily at Web3 users.
This afternoon my Ethereum address monitoring suddenly fired off alerts: two outgoing transactions I never made. I was stunned — I hadn't done anything, it wasn't me. Was my wallet stolen? I rushed to check what those transactions actually did. After asking for help on V2EX I learned this is an 'address poisoning' attack, and I'm sharing what I learned so everyone can stay alert.
For the past few days my Aliyun CDN has been alerting constantly — traffic and request counts suddenly spike, triggering automatic shutdown. After analyzing the access logs, I found the requests mainly came from IPs in the following areas, all hitting a single image on my CDN.
Now that Google Chrome has been pushing HTTPS hard, almost every website is served over HTTPS. Have you heard of HSTS (HTTP Strict Transport Security)? It makes your website more secure and faster to load.
Recently a new extortion scheme targeting webmasters has emerged from the black/gray industry, and even Baidu is powerless against it — no fix yet. Today I'm exposing how it works from a technical angle.
