PHP 核心爆出 PHP2Shell 漏洞(CVSS 9.2),攻擊者不用登入就能遠端執行程式碼。
全球約 2,260 萬個實例可能曝險(據 Unit 42)。台灣約 2.8 萬個網站使用 PHP,其中約 200 個是政府網站。
請升級到 8.5.12、8.4.27、8.3.36 或 8.2.35。
幣安宣布在 PHP 安全漏洞揭露後,其安全團隊已完成了必要的修復工作。
Binance is committed to protecting our users and platform. Following the disclosure of a PHP security vulnerability, our security teams implemented proactive safeguards ahead of the official patch release and completed the necessary remediation.
We continue to monitor developments and strengthen our security measures to help keep our ecosystem secure.
美財長 Bessent:GENIUS Act 是美國金融的「分水嶺」,比肩林肯 1863 年《國家貨幣法》
美國財政部長 @SecScottBessent 在 OCC 發布 GENIUS Act 首則最終規則後表示,該法是美國金融的分水嶺時刻,進一步鞏固美國作為「全球加密之都」的地位。
他類比:正如林肯 1863 年《國家貨幣法》建立了銀行發行貨幣的全國框架,GENIUS Act 則為數位時代的支付型穩定幣確立聯邦框架;OCC 的最終規則把這部里程碑立法往前推進,為民間創新、競爭與美國數位資產領導地位提供清楚可行的基礎。
The GENIUS Act marks a watershed moment in American finance, further cementing the United States as the crypto capital of the world. Just as President Abraham Lincoln’s National Currency Act of 1863 established a national framework for bank-issued currency, the GENIUS Act establishes a federal framework for payment stablecoins in the digital age.
The @USOCC's final rule carries that landmark legislation forward, providing a clear, practical foundation for private-sector innovation, competition, and American leadership in digital assets.
🚨 OpenAI:AI 協助挖出 PHP 重大資安漏洞——影響估計約七成網站
@OpenAI 表示,旗下模型協助「Patch the Planet」計畫研究人員,在開源語言 PHP(官方估計約 70% 網站使用)發現嚴重安全缺陷。
📌重點整理
1️⃣ 過去約兩個月,OpenAI 牽頭維護者、研究員與資安供應商組成聯盟,在公開揭露前先備好修補與防護;因修復複雜、需大幅改動 PHP 引擎,協調時間較長
2️⃣ 官方針對嚴重度與普及率,稱這是近年「影響面最大的漏洞之一」,並稱標誌 AI 能找出「網際網路級」資安缺陷的新階段
3️⃣ 強調「Defender’s Window」:據其所知,前沿 AI 先於攻擊者發現漏洞,讓防守方有時間準備。網站應升級至安全版本,並套用各資安廠商緩解措施
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
Solana 新共識 Alpenglow 上主網 beta:最終確認從 12.8 秒砍到 150 毫秒
@anza_xyz 宣布 Alpenglow 已在 mainnet-beta 上線,由 Anza 打造;官方稱 finality 自約 12.8 秒降至 150 毫秒,並退役舊有 TowerBFT。
📌重點整理(整串)
1️⃣ 官方點名用途:機構可在 150ms 內結算並有密碼學保證;資本市場「不停市、即時交割」;開發者做出接近 web2 的手感;AI agent 能以 agent 節奏做無許可支付
2️⃣ 切換數據:genesis slot 459,653,000;啟用 epoch 1064;654 個驗證者參與;handoff 約 900ms
3️⃣ Anza 喊大家上鏈送交易,親自感受 150ms
$SOL
OpenAI:GPT-Rosalind 挖到藥物發現新線索——恢復膽固醇運輸,能否保護神經元?
@OpenAI 指出,DCTN1 基因與罕見神經退化疾病 Perry syndrome 相關;在小鼠腦部數據中,干擾該基因後,參與「製造膽固醇」的基因表現上升。GPT-Rosalind 提出一種可能解釋:膽固醇或許沒能送到神經元真正需要的位置。
📌重點整理
1️⃣ 這給科學家一個可驗證的機制假設;若獲證實,可能指向神經退化疾病的新治療方向
2️⃣ 與 @perturbai_tx、@scrippsresearch 合作,數千個 GPT-Rosalind agent 並行運作,把數百萬小鼠腦細胞的基因表現結果與科學文獻對接,僅用約 32 分鐘
3️⃣ OpenAI 表示正擴大此合作,以尋找新的藥物靶點
GPT-Rosalind surfaced a new lead for drug discovery: could restoring cholesterol transport protect neurons from degeneration?
DCTN1 is a gene linked to Perry syndrome, a rare neurodegenerative disorder. In mouse-brain data, disrupting it increased expression of genes involved in making cholesterol. GPT-Rosalind suggested a possible explanation: cholesterol may not be reaching where neurons need it.
That gives scientists a specific mechanism to test and, if confirmed, a direction for developing new treatments for neurodegenerative disorders.
With @perturbai_tx and @scrippsresearch, a team of thousands of GPT-Rosalind agents worked in parallel, connecting gene-expression results from millions of mouse brain cells with scientific literature in just 32 minutes. We’re now expanding this collaboration to identify new drug targets.
openai.com/index/scaling-ai-…
Grayscale 上線「實物申購」(in-kind):可用合資格數位資產直接換產品股份
@Grayscale 宣布推出 in-kind investing:投資人可直接以合資格數位資產,交換對應 Grayscale 產品股份。
📌重點整理
1️⃣ 官方列出三大好處:降低自行託管負擔、潛在較低成交成本、更易納入傳統投資組合管理
2️⃣ 目前開放 10 檔產品:$GAVA(Avalanche 質押 ETF)、$BTC(Bitcoin Mini Trust ETF)、$GLNK(Chainlink Trust ETF)、$ETH(Ethereum Staking Mini ETF)、$GDOG(Dogecoin Trust ETF)、$HYPG(Hyperliquid 質押 ETF)、$GSOL(Solana 質押 ETF)、$GSUI(Sui 質押 ETF)、$GXRP(XRP Trust ETF)、$ZCSH(Zcash ETF)
Introducing in-kind investing at Grayscale: contribute eligible digital assets directly in exchange for shares of a Grayscale product.
Benefits for investors include:
- Reduced burden of self-custody
- Potentially lower execution costs
- Incorporation into conventional portfolio management
In-kind is now available for 10 Grayscale products:
- Grayscale Avalanche Staking ETF ($GAVA)
- Grayscale Bitcoin Mini Trust ETF ($BTC)
- Grayscale Chainlink Trust ETF ($GLNK)
- Grayscale Ethereum Staking Mini ETF ($ETH)
- Grayscale Dogecoin Trust ETF ($GDOG)
- Grayscale Hyperliquid Staking ETF ($HYPG)
- Grayscale Solana Staking ETF ($GSOL)
- Grayscale Sui Staking ETF ($GSUI)
- Grayscale XRP Trust ETF ($GXRP)
- The Zcash ETF ($ZCSH)
Learn more about in-kind: grayscale.com/campaign/in-ki…
特斯拉 × SpaceX,合併開談了?
馬斯克:兩邊已設獨立董事特別委員會評估;他因利益衝突不進討論。合併「是個好主意」,但還沒談成條款——當成定局是「說得太過」。
特斯拉需全體股東 50% 同意。你覺得會過嗎?👇
又一次 AI 殺估值,$BTC 相對撐得住
@CoinbaseInsto:過去兩週晶片股再跌雙位數,是 6 月以來第二次明顯下殺;兩次下來,$BTC 表現都明顯優於科技/半導體。
📌重點整理(圖表:6/22–7/29 vs. 自 10/2 起)
1️⃣ $BTC:約 0%/−3%
2️⃣ Nasdaq 100:約 −10%/−4%;半導體 SOX:約 −29%/−14%
3️⃣ Micron 約 −39%/−16%;KOSPI 約 −38%/−21%;SK Hynix 約 −52%/−31%
機構觀點:市場已不再把比特幣當成「科技股的槓桿代理」。
OCC 拍板 GENIUS Act 首則最終規則:既有穩定幣「獎勵/孳息」沒有自動豁免
據 @WuBlockchain,美國貨幣監理署(OCC)發布實施 GENIUS Act 的首則最終規則,涵蓋穩定幣發行、託管與第三方合作,生效日為 2027 年 1 月 18 日。
📌重點整理
1️⃣ 既有收益與獎勵計畫不獲自動祖父條款(grandfathering)或安全港;合規將「個案審查」
2️⃣ 法案禁止發行方「僅因持有、使用或保留穩定幣」而支付孳息;但並非一律禁止所有第三方獎勵——若獎勵至少部分基於其他因素,可能不在禁令範圍
3️⃣ Coinbase、PayPal、Kraken 等既有獎勵方案後續如何認定,目前仍不明朗
OCC 原文:occ.gov/news-issuances/news-…
OCC Finalizes First GENIUS Act Rule: No Safe Harbor for Existing Stablecoin Rewards
The OCC has issued its first final rule implementing the GENIUS Act, covering stablecoin issuance, custody, and third-party partnerships, effective January 18, 2027. Existing yield and rewards programs receive no automatic grandfathering or safe harbor; compliance will be assessed case by case.
The act prohibits issuers from paying yield solely for holding, using, or retaining stablecoins, but does not ban all third-party rewards. The OCC said rewards based at least partly on other factors may fall outside the prohibition. The implications for programs offered by Coinbase, PayPal, and Kraken remain uncertain.
🚨 Drift 駭客又往 Tornado Cash 塞了近 2.5 萬枚 $ETH
據 @lookonchain,竊取逾 2.7 億美元的 Drift Protocol 攻擊者,再度存入 24,885 枚 $ETH(約 6,130 萬美元)至 Tornado Cash;目前仍持有 56,569 枚 $ETH(約 1.393 億美元)。
📌前情(同一來源前一日追蹤)
攻擊者在沉寂約兩個月後開始搬幣:當時約兩小時內已存入 25,700 枚 $ETH(約 6,156 萬美元),餘額約 81,864 枚 $ETH(約 1.95 億美元)。
Arkham:arkm.com/explorer/entity/dri…
The Drift Protocol exploiter, who stole over $270M, deposited another 24,885 $ETH($61.3M) into #TornadoCash and still holds 56,569 $ETH ($139.3M).
xitter.cf/lookonchain/status/211…
JPMorgan 把 SpaceX 目標價直接翻倍:$240 → $500
據 @DeItaone,摩根大通(JPMorgan)將 SpaceX 目標價從 $240 上調至 $500,維持 Overweight(增持)評級。
📌重點整理
1️⃣ 銀行現預估 SpaceX 2027 年營收達 2,540 億美元,並預期年底運算產能達 10 GW;對 2027–2028 預估逾倍上修
2️⃣ 亦提到 SpaceX 與 Tesla 合併在策略上有合理性,但強調並無任何確定交易
$SPCX
$SPCX - JPMORGAN DOUBLES SPACEX PRICE TARGET TO $500
JPMorgan raised its SpaceX price target from $240 to $500, maintaining an Overweight rating.
The bank now forecasts $254 billion in 2027 revenue and 10 GW of computing capacity by year-end, more than doubling its 2027–2028 estimates.
JPMorgan also sees strategic merit in a potential SpaceX–Tesla merger, though no deal is guaranteed.
動區動趨 BlockTempo retweeted
👛 美联储、AI、比特币:年底这场资本大戏,谁将是最后的赢家?
⏰今晚 20:00(UTC+8),金色财经携手@0xTalkingWeb3 @web3Twinkle、@TreeNewsCN,邀请二级市场交易员与分析师,一起复盘美联储政策、AI 行情与比特币走势,研判年底资本行情的胜负走向。
👥 嘉宾阵容
🎤 主持:@JinseFinance 金色财经
👥 共同主持:@web3Twinkle|@TreeNewsCN
🎙️ 嘉宾:
良轩 Mr 蒋|二级市场分析交易员 @Mr57814170
大晖哥|1783DAO & 博链 Founder @Whdysseus
📅 10 月 21 日(周三)⏰ 20:00(UTC+8)
📍 Space 链接:
今晚 20:00,Space 见。 xitter.cf/i/spaces/1nKOLQD…
Elon:Terafab 一座廠的產出價值,能排進全球前 20 大「國家 GDP」
@elonmusk 引用韓國半導體供應鏈報導後寫道:Terafab 產出的價值,將讓它「以單一建築」擠進全球國家 GDP 前 20 名。
📌背景整理
1️⃣ Tesla/SpaceX 的 Terafab 據報在 SEMICON West 頭一天早上就走訪約 10 家韓國攤位,涵蓋製程材料、管件、測試零件等;多家已簽 NDA
2️⃣ 已知進度包括:漢美半導體(Hanmi)談 TC bonder;HPSP 同意供一台高壓氫退火設備給研發線;MiCo 旗下清洗事業約一個月前與 Tesla、SpaceX 簽三方 NDA
3️⃣ 目標據報為 10 年內達到每月約 100 萬片晶圓投產;初期投資約 168 億美元、創造逾 3,000 個工作。SpaceX 本月在德州 Grimes County 動工,首期約 10 萬片/月預計 2030 年前
有人拿 Opus 5.5 在 Blender 裡做完整 3D:說按量計費,比「一人一座」的工具還便宜
@0xWast3 發文稱,在 Blender 裡跑 Opus 5.5,輸入約每百萬 tokens 4 美元、輸出約 20 美元;並用一次產品目錄流程,跟按座位收費的專業工具(如 Photoroom)比成本。
📌重點整理
1️⃣ 對方說法:座位制是「每人訂閱」,token 帳單才是「做多少付多少」;完整目錄跑一輪的費用,可能低過一個座位一個月的錢
2️⃣ 路徑差很大:Photoroom 等工具圍繞既有照片裁切、重打光、換場景;沒有成品照就出不了圖。Opus 路線是先在 Blender 建幾何與材質,再渲染任意角度與背景
3️⃣ 附約 30 秒對比影片;畫面上另有一組數字,把傳統 Blender 流程標到約 640 美元,對上 Opus 5.5 約 18.60 美元(同一隻海怪游泳 loop 演示)
Opus 5.5 inside Blender costs $4 per million input tokens, and it just beat a stack of specialist tools that charge by the seat
Price per seat hides the real comparison. One is a subscription per person, the other is a bill that scales with what you actually make.
> ASSET - a full set of product models built from one brief, geometry and materials included
> SHOT - the same products staged, lit and rendered across a dozen backgrounds
> COST - every tool’s output priced against what the run actually consumed
Photoroom and the rest are built around a photo. They cut, relight and restage something that already exists.
That ceiling shows up fast. No photo means no output, and a product that is not built yet has no photo at all.
Opus 5.5 starts earlier. The model is built in Blender, so every angle, every material and every background is a render away.
At $4 in and $20 out per million tokens, a full catalogue costs less than one seat of the specialist tools per month.
The quality gap is not subtle either. Real geometry holds up under lighting changes in a way a cut-out never does.
The brief, both outputs side by side and the full token bill are laid out underneath.
ChatGPT 上 Locked Chats:敏感對話可鎖進 PIN/生物辨識,今天起陸續開放
@ChatGPT 宣布推出 Locked Chats:把對話移出一般歷史與搜尋,放進受保護空間。網頁與桌面用 PIN 解鎖;支援的手機可用 PIN、Face ID、Touch ID 或裝置解鎖。
📌重點整理
1️⃣ 鎖定聊天裡的新訊息,不會更新你一般對話使用的 memory
2️⃣ 今日起陸續開放給 Free、Go、Plus、Pro、Business、Enterprise、Edu
3️⃣ OpenAI 說明:這不是端到端加密,也不改資料保存期限或「Improve the model」設定;重設 PIN 會永久刪除所有鎖定聊天(官方無法復原)
Keep sensitive conversations out of view with Locked Chats in ChatGPT.
Move chats out of your regular history and search into a protected space you can unlock with a PIN on web and desktop, or a PIN, Face ID, Touch ID, or device unlock on supported mobile devices.
New messages sent in locked chats won't update the memory used in your regular chats.
Rolling out starting today to Free, Go, Plus, Pro, Business, Enterprise, and Edu plans.
OpenAI 買下 Orchestra Bio,要把「新藥開發流程」塞進 Rosalind
@OpenAI 宣布收購 Orchestra Bio:這家平台幫生技/製藥團隊協調複雜的藥物開發流程。團隊與技術將併入 Rosalind(含 GPT‑Rosalind 與 Rosalind Workbench),目標是讓新療法更快走到病人端。
📌重點整理
1️⃣ OpenAI 指出,新藥從靶點發現到美國監管核准平均約需 10~15 年;除了科學本身,還要跨部門、跨外部夥伴調度,系統往往彼此斷開
2️⃣ Orchestra 讓科學家與專案負責人把研究追蹤、時程監控等工作委派給 AI agents,並在製程失敗等事件發生時,標出受影響的活動與時程、整理選項再交由人決策
3️⃣ 官方未公布交易金額;Axios 報導同樣寫「財務條件未揭露」
We’ve acquired Orchestra Bio, a platform that helps biopharma teams coordinate the complex process of drug development.
Together, we’ll build on Rosalind, our AI models and tools for life sciences research, to streamline those operations and help new treatments reach patients sooner.
Welcome @ashokaraj_ and team!
openai.com/index/openai-to-a…
Grok Bot 又推一波更新:電腦快 3 倍、X 私訊、還能在推文裡 @bot
Grok Bot 團隊的 @mattyp 發了約 5 分鐘邊走邊講預告,逐項示範「What's new」清單。畫面上標出電腦速度提升至約 3 倍,並點名 X Chat 私訊、在 X 上標記 @bot 等功能。
📌重點整理
1️⃣ 體驗:聊天卡片改版、草稿修改會高亮標示、通知改成可收合
2️⃣ 連線與通訊:新增 connectors、支援 plus-addressed 郵件別名、可讀 X Chat 私訊與訊息請求
3️⃣ 互動:在 X 上 @bot 叫助手、語音通話加入 memory、可邀請隊友;另有 Android Assistant 按鈕
4️⃣ 工作流:存取名單、未讀、routines(例行任務)、登入流程也一併更新
這波比較像把助手從「聊天框」往「日常通訊入口」再推一層,尤其是 X 私訊跟 @bot。
What's new in Grok Bot
00:00 New chat cards
00:31 Speed
00:53 Draft edits
01:08 Email aliases
01:33 X DMs
01:55 Tag @bot
02:31 Connectors
02:48 Voice calls
03:27 Notifications
03:56 Invites and Android Assistant
04:19 Access lists, unread, routines, sign-in
This team ships!
What's new in Grok Bot - Oct 18, 2026
What's new in Grok Bot - Oct 18, 2026
























