Daily Security

A very detailed Balancer hack post-mortem (unofficial): https://x.com/officer_secret/status/1985961846805843984?s=46 #security

🔴 Balancer Exploit Update The project team commented on the incident:

We’re aware of a potential exploit impacting Balancer v2 pools. Our engineering and security teams are investigating with high priority. We’ll share verified updates and next steps as soon as we have more information.

🫡 Atoms Research | ✈️ Boost | 💬 Chat

🚨 Balancer potentially exploited $70.9M moved to a fresh wallet. Tokens moved: - 6.85K $OSETH - 6.59K $WETH - 4.26K $wSTETH Source 🫡 Atoms Research | ✈️ Boost | 💬 Chat

State of MCP Server Security 2025: 5,200 Servers, Credential Risks - https://astrix.security/learn/blog/state-of-mcp-server-security-2025/ We analyzed over 5,200 unique, open-source MCP server implementations to understand how they manage credentials and what this means for the security of the growing AI agent ecosystem. - 88% of MCP servers need credentials to function - 53% rely on static API keys and Personal Access Tokens (PAT) - Only 8.5% use modern OAuth authentication - 79% store API keys in basic environment variables #MCP #ModelContextProtocol #AIAgents #AgentSecurity #CredentialSecurity #SecretsManagement #OAuth #APIKeys #PATs #SecretRotation #LeastPrivilege #AstrixSecurity

👀 https://open.substack.com/pub/wublock/p/opinion-is-this-crash-an-attack-on?r=35gba4&utm_medium=ios

A Security Engineer's Guide to MCP https://semgrep.dev/blog/2025/a-security-engineers-guide-to-mcp/

In Kazakhstan, the largest crypto exchange that worked for the drug trade was closed The service was considered «respected» in the underground environment and cooperated with 20 largest «Darknet»-marketing, where total audience exceeded 5 million users. More than 200 drug trafficking sites from Kazakhstan, Russia, Ukraine and Moldova passed through it. The total turnover of «RAKS exchange» exceeded 224 million USD. https://sozmedia.kz/94819/

A series of attacks on Hyperliquid today targeted Hyperdrive.fi: https://x.com/hyperdrivedefi/status/1971943575559852327 https://x.com/hyperdrivedefi/status/1971955057823531196

Two malicious crates have been identified in the crates.io https://blog.rust-lang.org/2025/09/24/crates.io-malicious-crates-fasterlog-and-asyncprintln/

How Cross-Chain Bridges are Hacked? Link: https://officercia.mirror.xyz/IvG5yxJrLviq0bT9CXMx8lQ-ZGOBomYbeizMEzp6n40

Hopefully, it will be okay soon Scandal around dYdX over $25M - DEX dYdX closed the bridge for ethDYDX migration — the native network since June 13. - According to influencers, 45k+ holders are "stuck" with tokens worth over $25 million. - Now ethDYDX cannot be exchanged, deposited to CEX, or converted.

It appears the Solana project 'Aqua' has likely rug pulled 21.77K SOL ($4.65M) after being promoted by teams such as Meteora, Quill Audits, Helius, SYMMIO, Dialect, and many influencers. A few hours ago the funds were split four ways and transferred between intermediary addresses before being sent to multiple instant exchanges. The team has since turned off replies on X (Twitter) for all posts. Presale address 4Ea23VxEGAgfbtauQZz11aKNtzHJwb84ppsg3Cz14u6q

Attention, please https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised

So, the smart contract audit benchmarks tooling is completely finished, from dataset generation to reporting. The only thing that's missing is creating comprehensive baselines using the best available models. If anyone wants to sponsor this or has infinite API credits available lmk 🙂 https://github.com/muellerberndt/scabench

🚨DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft Source 🚨Until fixes are available, it's advised that users disable the auto-fill function in their password managers and only use copy/paste. "For Chromium-based browser users, it is recommended to configure site access to 'on click' in extension settings," Tóth said. "This configuration allows users to manually control auto-fill functionality." ❗️Note: The Bitwarden team released a fix of clickjacking in their recent patch

Update with a fix for an actively exploited vuln(s): macOS Ventura 13.7.8 For: macOS Ventura Released: 20 Aug 2025 Security Document

Update with a fix for an actively exploited vuln(s): macOS Sonoma 14.7.8 For: macOS Sonoma Released: 20 Aug 2025 Security Document

Update with a fix for an actively exploited vuln(s): macOS Sequoia 15.6.1 For: macOS Sequoia Released: 20 Aug 2025 Security Document

Update with a fix for an actively exploited vuln(s): iPadOS 17.7.10 For: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation Released: 20 Aug 2025 Security Document