Security
The Defiant Security posts
Top Stories
Lightning Labs Urges Immediate Updates Over Certificate Vulnerability
New binaries block trust in compromised eMudhra certificate keys. Updating Go on a host alone does not patch software already installed.
What Is a Crypto ‘Wrench Attack’?
The name comes from an XKCD comic about a $5 wrench. Hardware wallets isolate keys, while multisig divides signing authority—but neither automatically prevents coerced transfers.
Free newsletters
The Defiant Daily
Independent reporting on crypto and DeFi. The stories that matter, in your inbox.
Monday–Friday. Free. Unsubscribe anytime.
Advertisement
Videos
Recent articles
Lightning Labs Urges Immediate Updates Over Certificate Vulnerability
New binaries block trust in compromised eMudhra certificate keys. Updating Go on a host alone does not patch software already installed.
What Is a Crypto ‘Wrench Attack’?
The name comes from an XKCD comic about a $5 wrench. Hardware wallets isolate keys, while multisig divides signing authority—but neither automatically prevents coerced transfers.
Developer Links $370,000 Theft to Railway Secrets Exposure
Railway restored Enterprise builds late Wednesday, while customers on other plans were still waiting to redeploy with replacement credentials.
Cloudflare CEO Reports Millions of PHP2Shell Exploit Attempts
PHP has shipped fixes for four supported branches. The flaws can let attackers run code on vulnerable web servers without logging in.
How Elliptic-Curve Signatures Work: A Toy ECDSA Example
A deliberately insecure curve makes the signing arithmetic small enough to follow. The verifier needs the message and public key, but neither signing secret.
Obol Urges Immediate Charon Upgrade After CA Key Compromise
The patch updates certificate checks in Go. Obol's mainnet cluster balances totaled 422,862 ETH in its latest daily snapshot.
Railway Urges All Users to Rotate Secrets After Security Incident
Deployments remain paused, preventing customers from updating applications with replacement credentials.
eMudhra's Weak Certificate Keys Prompt Emergency Trust Updates
One recovered private key was just 4. The company says the flaw went undetected through two independent audit cycles.
NSA Urges PHP Users to Patch or Take Systems Offline
PHP has released fixes for two flaws rated 9.2 that can let unauthenticated attackers run code on web servers.
Eclair Patches Lightning Bugs That Could Let Peers Steal Funds
The second security release in five days lets node operators upgrade without closing channels, though Eclair must be stopped and restarted.