eMudhra's intermediate ECC certificate authorities were found to have effectively guessable private keys, reportedly single-byte values (one of them literally "4"), traced to a flaw in the KGC script used on a specific day to create those ECC issuers. Browser vendors responded by revoking trust in the affected intermediates, while non-browser TLS clients that do not use modern revocation tooling remain exposed.

Because the intermediate CAs were publicly trusted, anyone who could guess the keys could have forged certificates for arbitrary domains, and that risk falls unevenly across the ecosystem. A Mozilla engineer said Firefox users were protected automatically within a couple of hours via OneCRL, with Chrome, Apple and Microsoft operating similar tooling, but "for the rest of the ecosystem, there has been little to no investment in revocation."

In Mozilla bug 2083449, eMudhra said its preliminary assessment found "a flaw in the KGC script that was used on that specific day to create these ECC issuers," and that review of the KGC code and HSM keys so far indicates a set of original ECC keys was created onboard as expected plus an approved deviation to its usual KGC. Community reports describe eight affected CAs, and one commenter said the keys were allegedly found at a public repository URL, while noting uncertainty about whether the artifacts show stolen keys or a weak generation process.

The US Department of Homeland Security issued an order, filed Monday and published Tuesday, directing federal civilian agencies to remove DeepSeek products, its affiliates, and any third-party products or services built using DeepSeek technology from their IT systems. The directive took immediate effect and also bars affected agencies from making new purchases.

The order extends restrictions that had previously applied to the Commerce Department and parts of the defense, security and intelligence community to the whole federal civilian workforce and its contractors. DHS warned that employee and contractor use of DeepSeek could expose sensitive information to China.

DHS invoked the Federal Acquisition Supply Chain Security Act of 2018 and cited DeepSeek servers located in China as well as security vulnerabilities identified in DeepSeek's iOS application. The department said the technology could reveal details about US citizens and federal programs.

Mastercard has opened early access to a system called Agent Pay for Machines, which lets autonomous software agents discover services, agree to terms and pay for them within human-set spending limits. The company unveiled the milestone at Cloudflare's Connect conference, where Mastercard's Jorn Lambert demonstrated a live transaction.

Mastercard frames the system as a fix for a specific friction: paid online services typically require an account, API key or billing relationship with each provider, which breaks down when an agent selects services on the fly. The launch follows end-to-end pilots with Cloudflare, Ant International, AWS, BVNK and Coinbase.

Agent Pay for Machines builds on the open x402 protocol: when an agent hits a paid service returning a "402 Payment Required" response, it generates a digitally signed payment voucher that the provider verifies before delivering the service, with vouchers batchable for later redemption. In the demo, an agent for marketing agency Hype ran a protein-bar campaign across nine payments to two independent merchants on a single budget, with Coinbase supplying the wallet, Base providing on-chain settlement, and BVNK handling fiat or stablecoin settlement through Mastercard's Global Money Platform; Mastercard is also releasing buyer- and seller-side APIs, a developer toolkit and a testing environment.

Online investment platform Webull (NASDAQ: BULL) will begin offering perpetual futures trading to eligible US customers starting in November, with Bitcoin and other crypto assets among the first products, and plans to widen access before the end of the year. The contracts will be listed on KalshiEX, a CFTC-designated contract market, and cleared by Kalshi Klear, a CFTC-regulated derivatives clearing organization, and can be traded directly through existing Webull futures accounts.

The launch gives futures-approved US retail clients access to crypto perpetual futures through CFTC-regulated venues, a product that has largely traded on offshore platforms for US users. Access is limited at first to customers already approved for futures trading.

Webull said the rollout starts in November with a planned expansion of eligibility by year-end; trading runs through existing Webull futures accounts rather than a new crypto-specific product line. The products are listed on KalshiEX and cleared by Kalshi Klear.

Strive, a Nasdaq-listed Bitcoin treasury company chaired by Matt Cole, closed an upsized IPO of its SATS preferred stock on Oct. 20, selling 7 million shares at $90 each for $630 million in gross proceeds and listing the stock on Nasdaq. The preferred carries a 15% annual fixed dividend on its $100 stated amount, is cumulative, and is scheduled to be paid each business day starting Nov. 9, subject to board declaration.

The deal gives public-market investors a daily-paid, 15%-yielding instrument issued by a Bitcoin treasury company, and Strive has said proceeds may fund additional Bitcoin purchases alongside working capital and income-generating assets. However, the company has not specified how much of the proceeds will actually go to Bitcoin.

Strive estimated net proceeds of about $608.15 million after underwriting discounts, commissions and expenses; at an illustrative Bitcoin price of $82,500, that amount could buy roughly 7,372 BTC, which would lift reported holdings from 36,818 BTC to about 44,190 BTC and potentially exceed Metaplanet's reported 44,000 BTC. At the $90 IPO price, the $15 annual stated dividend equals about 16.67% of the purchase price, and chief risk officer Jeff Walton said the company carries no debt or maturities and is focused on a single obligation: paying dividends.

Liquid said it has restored Bitcoin swap trading on its network, but peg-outs remain frozen, leaving users unable to redeem L-BTC for BTC on the Bitcoin mainchain amid an ongoing security incident.

The continued peg-out freeze means service restoration is only partial: users can trade on Liquid, but the path for moving value back to Bitcoin’s mainchain remains closed.

Liquid’s peg-out mechanism converts L-BTC back to BTC on the Bitcoin mainchain; restoring swaps does not by itself reopen that redemption channel.

Coinbase will automatically convert German users' USDT, DAI and PYUSD balances into USDC on October 30. Because the exchange is converting the assets on users' behalf, the swap is treated as a taxable event under German law rather than a neutral balance change.

The policy forces affected German users to hold USDC and, per the source, leaves them with a tax liability attached to a conversion they did not initiate. It also shows an exchange steering stablecoin balances toward its own preferred dollar token in a single jurisdiction.

The conversion is scheduled for October 30 and applies to three third-party stablecoins — Tether's USDT, MakerDAO's DAI and PayPal's PYUSD — while leaving USDC untouched. The source frames the resulting tax treatment alongside Germany's one-year holding-period rule for private crypto holdings.

J.P. Morgan Asset Management's 2027 Long-Term Capital Market Assumptions, released Monday, Oct. 19, included bitcoin for the first time, projecting a 10% compound annual return over the next 10 to 15 years. That tops its forecasts for US large-cap stocks (7.5%), US REITs (8.2%), gold (5.5%) and a classic 60/40 stock-bond portfolio (7%), with an arithmetic mean return of 20.9% and 55% annualized volatility.

Bitwise Chief Investment Officer Matt Hougan framed the inclusion as a sign of traditional financial institutions' shifting stance toward crypto. The forecast comes from the asset management arm of the largest US bank, putting bitcoin on the same table as mainstream assets in a report institutional allocators use as reference.

JPMorgan said that "for the first time, we put a range on bitcoin returns, though we do not yet include bitcoin in our main covariance matrices," and instead built a separate, smaller comparison matrix, citing volatility and unstable correlations. The report also pushed back on a popular bull case, calling the idea that currency debasement will spark a rush into crypto "wide of the mark."

Meta said it has paused a Muse feature that lets users share conversations with its AI assistant, after researchers at security firm Claroc found more than 6,800 publicly accessible Muse chat links through public DNS records, Ars Technica reported. Claroc published its findings in a report this week.

The pause is a product-level response to a privacy exposure involving conversations users may have assumed were shared narrowly.

According to the reporting, the links were located through public DNS records rather than through any internal disclosure by Meta. Meta describes the sharing feature as paused, not permanently removed.

Google has open-sourced TorchTPU, a native PyTorch backend that lets PyTorch workloads run directly on its Tensor Processing Units (TPUs). Google detailed the project on its developer blog, describing an "Eager First" design and XLA integration intended to simplify migrating models to TPU infrastructure.

PyTorch is the dominant framework for model development, so first-party support removes a long-standing barrier that forced teams to bridge through XLA or stay on TensorFlow/JAX to use TPUs. Community commenters framed the release as accelerating the shift away from TensorFlow and widening the set of accelerators PyTorch code can target.

The project was first reported by Reuters in December, and Google has now officially confirmed and detailed it; The Stack reports that multiple Google staff were dedicated to building the backend. Google's developer blog highlights XLA integration and peak-efficiency execution on TPU infrastructure as core goals.

OpenAI announced Tuesday that it has acquired Orchestra Bio, a San Francisco startup whose AI agents track and coordinate drug development programs, and will fold its team and platform into Rosalind, OpenAI's suite of AI models and tools for biologists and chemists. Financial terms were not disclosed.

OpenAI said the goal is to help scientists make discoveries and manage the work needed to turn them into treatments that reach patients sooner, and that the combined team will build agents connecting scientific findings with the decisions and follow-up studies required to turn a promising result into a medicine.

Orchestra's agents map how setbacks such as a failed manufacturing batch ripple through a drug program and compare possible responses, while scientists and program leaders keep the final decision. Founded in the fall of 2022, Orchestra raised a seed round from Andreessen Horowitz, Definition Capital, Insight Partners and 8VC totaling about $20 million; it is unrelated to Nasdaq-listed medical device maker Orchestra BioMed (ticker OBIO).