The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

Concentrated liquidity depends on exact delta math. @DecurityHQ audited those calculations and the calldata bounds on VM hook paths. One of 8 independent Aqua and SwapVM audits.

Have you heard about ERC-7715? It allows a dApp to request human-readable permissions from a user's smart account to act on their behalf. E.g. stream fixed amounts of tokens or revoke approvals. So it made me thinking what if it could allow a watcher service like @DefimonAlerts to withdraw a position from your wallet if a threat is detected? Operational 24/7 on its own, without a hurry to open your wallet to submit a withdraw tx. The only wallet that supports this kinda experimental tech is @MetaMask (new users get 7710 smart accounts by default). However MetaMask supports only a limited set of permissions that do not allow fixed calldata (which makes sense). That's why I decided to expand the allowed permissions with `erc20-token-swap` which allows to swap your DeFi positions into safe stablecoins in the event of a protocol hack. PR: github.com/MetaMask/snap-771… Inspired by revoke.delegate by @ayushbherwani ethglobal.com/showcase/revok…

1/ Many DeFi hacks aren't atomic. We reconstructed per-tx timelines for 10 exploits where the drain ran for minutes to hours to ask one question: how much could have been saved after the first malicious tx? 🧵

Real-time DeFi monitoring is how anomalies get caught early. @DefimonAlerts is building not only an alert system, but also a white hat rescue bot that can protect defi in real time. Learn more: youtube.com/watch?v=ioGtupYR… Support: qf.giveth.io/project/defimon…

How we cut block latency 4x and scaled exploit detection to 8 chains: our CTO @theRaz0r shares insights on how @DefimonAlerts works under the hood on the @Quicknode blog 👇

The market is still underrating the gap between finding bugs and actually proving exploitability. A lot of companies argue that vulnerability discovery is becoming commoditized, that multiple models can now spot bug patterns, and that results like Anthropic Mythos are reproducible. That misses the real technical bottleneck. Finding the bug is not the hard part anymore. In many cases, that’s close to a solved problem. What matters is whether a model can turn that finding into a real exploit: chaining primitives, building a working test case, and demonstrating that the issue is actually exploitable without a human carrying it across the finish line. That capability matters on both sides: - offensively, because exploitability is what separates signal from noise - defensively, because you need a credible proof case to build the right fix We’re probably heading into another market correction where a lot of “AI companies” that are really just UI wrappers get washed out. The next winners won’t be the ones with the nicest interface. They’ll be the ones with real underlying capability.

1/ Since inception, Decurity has focused on real-time threat prevention. Our flagship product @DefimonAlerts has prevented hacks with direct impact exceeding $20M. But in 2025-2026, the world changed. AI is disrupting cybersecurity - and we had to adapt. 🧵

⚡ Every second matters when a DeFi exploit hits onchain. That's why we moved @DefimonAlerts from self-managed pipelines to @QuickNode Streams and went from 3 chains to 8, cut latency 4x, and freed us to focus on what actually matters - detection.

⛑ $512K rescued by Defimon after infinite approvals were granted to @squidrouter multicall The SquidMulticall contract's run() function allows anyone to execute arbitrary external calls with no access control. A wallet 0xacc0 mistakenly approved the multicall contract instead of the router contract and did it across multiple chains. It didn't take a long time before first attack - a MEV-bot called run() with a crafted Call struct that executed transferFrom() on the WETH contract, transferring just 1 WETH from a victim. In fact the victim user had around $800K approved to the mulitcall contract on various chains. After we detected the first attack our whitehat bot identified the vulnerable cross-chain approvals and managed to rescue around $512K. We contacted the person via Blockscan chat and returned all the rescued funds. We learnt that it was an operational mistake: "we were supposed to only approve to the Squid router address". Although some funds were lost, 0xacc0 was happy that the majority of the funds was rescued! First attack: bscscan.com/tx/0x81d0c429ee7… Victim: bscscan.com/address/0xaCc0c1… SquidMulticall: bscscan.com/address/0xaD6Cea… Rescued funds consolidation address: debank.com/profile/0xF50DbED…

Had a pentest done by @AikidoSecurity over the last few days. Looks like it’s about 100x as effective as any other pentest we’ve had done in the last 5 years.

🫡 Our monitoring system saved $120K for a protocol after an initial attack was detected.