Malicious servers swapped just-sent transactions for look-alikes paying an attacker, with addresses ground to match the last 4 characters. Bumping the fee signed the fake. One confirmed loss. Update and check full addresses.
Don't launch an agent in Downloads or a fresh clone before reading its instruction files, and approve package installs and global config edits step by step.
Stream your GitHub audit log off-platform, keep workflow scope off tokens, require review for .github/workflows changes, and prefer OIDC over long-lived secrets.
Enclave showed a zero-permission app could pose as Teams and obtain work-account tokens for mail, files and calendar. Fixed in 6.2606.4246; confirm fleet deployment.
VP of Engineering says fixes are in progress. No bulletin, CVE or fixed release yet. Tighten Tailscale SSH rules and forwarding meanwhile.
Sent from Foundation's real domains via stolen Cloudflare API keys, with real names and order details. Keys revoked; devices and funds unaffected. No recall ever asks for a seed phrase.
Capital going into its own funding stack, not a call on BTC by itself. One paused week isn't a trend.
Issuing is easy; 24/7 redemptions, key custody and on-chain monitoring on batch-era core banking is hard. Expect vendors, and vendor risk.
With GTA 6 reportedly needing recent firmware on Nov 19, most players were updating anyway.