Hackers exploited a cross-chain bridge tied to liquid restaking protocol Kelp DAO on Saturday, draining about $290 million in rsETH and sending shockwaves through decentralised finance markets as the losses spread into lending platforms and renewed questions over the security of multichain infrastructure. Bloomberg reported the theft at nearly $300 million, while market and on-chain reports put the value at roughly $292 million to $294 million. […]
Polkadot’s token regained some ground after Hyperbridge sharply raised the estimated damage from its April 13 Token Gateway exploit to about $2.5 million, a revision that deepened scrutiny of cross-chain infrastructure even as the network behind DOT moved to contain concern by stressing that native DOT was not compromised. Hyperbridge said the breach was confined to bridged DOT and related pools on Ethereum, Base, BNB Chain and […]
Anthropic’s Claude Opus has been thrust into a fresh security debate after researcher Mohan Pedhapati said he used the model to help build a working V8 exploit chain that achieved code execution against an outdated Chromium build bundled with Discord. Pedhapati, CTO of Hacktron and known online as s1r1us, said the exercise ran over about a week, consumed 2.3 billion tokens, cost $2,283 in API fees and […]
OpenAI has moved deeper into the scientific market with the launch of GPT-Rosalind, a specialist artificial intelligence model designed for biology, drug discovery and translational medicine, marking the company’s first dedicated push into life sciences as pharmaceutical groups and research institutes race to test whether advanced reasoning systems can shorten the slow and costly path from laboratory insight to new treatments. Announced on April 16, GPT-Rosalind is […]
Commercial artificial intelligence models are advancing quickly in vulnerability research and exploit development, sharpening concern across the cybersecurity industry that tools built for productivity and defence could also lower the barrier for offensive misuse. A study by Forescout’s Vedere Labs found that commercial systems now outperform open-source and underground alternatives in identifying software flaws, while more than half of the models tested were able to generate exploits […]
Hackers are probing older TP-Link home routers in an effort to turn them into Mirai-style botnet nodes, using a known command-injection flaw tracked as CVE-2023-33538. Security researchers say the activity targets discontinued router models and appears to be automated, with scanning and exploit attempts designed to fetch and run malware on exposed devices. The flaw itself is genuine and serious, even though some of the attack traffic […]
Tether has moved to support a $150 million recovery package for Solana-based Drift Protocol after the trading platform was hit by one of the biggest crypto exploits of the year, with the plan aimed at repaying affected users over time and helping relaunch the protocol under tighter security controls. Drift said the package would include up to $127.5 million from Tether and a further $20 million […]
The dispute sits inside a broader U. S. tariff reset. In March, the USTR opened Section 301 investigations into structural excess capacity in manufacturing across 16 economies, including Singapore, and launched another set of probes into whether about 60 economies have failed to prohibit or effectively enforce bans on imports made with forced labour. Reuters reported that the Trump administration moved down this route after a Supreme Court ruling in February struck at the legal basis of a large part of its earlier tariff framework, prompting Washington to search for narrower but still forceful trade instruments. USTR said comments were due by April 15, with hearings on forced labour beginning on April 28 and on overcapacity from May 5.
Singapore’s central argument is that the U. S. portrayal of the bilateral trade balance is flawed. In its submission, the Ministry of Trade and Industry said the United States has run a consistent overall trade surplus with Singapore for more than two decades. Data cited by Singapore from U. S. agencies show America posted a goods trade surplus of US$1.9 billion and a services trade surplus of US$25.1 billion with Singapore in 2024, with those surpluses rising in 2025 to US$3.6 billion and US$29.6 billion respectively. Singapore also said the U. S. recorded sectoral surpluses in semiconductors and electrical equipment as well as petrochemicals, undercutting the suggestion that exports from Singapore into the American market are being fuelled by a broad pattern of manufacturing distortion.
That matters because Washington’s overcapacity inquiry is built around the idea that some trading partners maintain large or persistent surpluses, idle production or both, allowing them to push artificially cheap goods into world markets. Singapore’s reply does not deny that the U. S. is entitled to examine trade imbalances, but it says its own industrial base does not fit that template. Officials pointed to manufacturing-space occupancy holding around 90 per cent over the past five years, which they said is consistent with advanced-economy norms and inconsistent with the claim of large underused capacity. Singapore further argued that, given land scarcity, it would run against policy and economic logic for industrial land to be left substantially idle.
On the labour side, Singapore’s response is equally direct. The government said it does not condone forced labour in supply chains and has legal and enforcement mechanisms to address such practices. Channel NewsAsia reported that Singapore told U. S. investigators it has a comprehensive domestic framework against forced labour and against the importation of goods produced through it. That is an important distinction, because the U. S. probe is not confined to labour abuses inside a country’s own factories; it is also examining whether governments adequately prevent tainted goods from entering their markets and then moving through global trade channels.
The business implications extend beyond Singapore. The U. S. investigations cover major manufacturing and export economies across Asia and Europe, and any eventual remedies could include new duties or other restrictions before temporary tariffs expire in July, according to Reuters and trade-law analyses tracking the dockets. For companies, that raises the prospect of higher compliance costs, closer supply-chain screening and a wider blending of trade policy with labour-rights enforcement. Singapore’s case is being watched because it is a high-value manufacturing and logistics hub with deep exposure to electronics, pharmaceuticals, petrochemicals and re-export trade, sectors where even modest tariff changes can alter sourcing decisions.
Politically, the row is awkward for both sides. Singapore is not only a long-standing U. S. economic partner; its free-trade agreement with Washington remains America’s only such pact with a South-east Asian trading partner. Singapore has said bilateral trade and investment support around 350,000 jobs in the United States, while its direct investment stock there reached US$71.7 billion in 2025. That does not shield it from a more aggressive U. S. trade climate, but it does give Singapore a stronger basis than many others to argue that the relationship is balanced, rules-based and mutually beneficial.
Attackers are exploiting trust in Adobe’s brand to deliver covert remote access, using a fake Acrobat Reader download page to install ConnectWise ScreenConnect through a fileless, memory-heavy attack chain that is designed to leave few traces on disk and make forensic analysis harder. Security researchers who uncovered the campaign said the operation began with a phishing site made to resemble Adobe’s official software page, where victims were […]
Splunk has disclosed a high-severity security flaw that can allow remote code execution in affected Splunk Enterprise and Splunk Cloud Platform deployments, raising concern for organisations that rely on the software to collect, search and analyse machine data for cyber defence, compliance and operations. The issue, tracked as CVE-2026-20204, was published on April 15 and carries a CVSS score of 7.1. Splunk said the weakness affects Splunk […]
Comcast customers notified about the company’s 2023 Xfinity data breach are being offered cash payments, reimbursement for documented losses and identity-protection services under a proposed $117.5 million class-action settlement, opening what could become one of the largest consumer redress exercises tied to a telecom cyber incident in the United States. The settlement applies to people in the United States and its territories who were sent individual notice […]
Attackers are exploiting a critical flaw in nginx-ui, an open-source web interface used to manage Nginx servers, exposing organisations to unauthorised server control through a weakness in the product’s Model Context Protocol integration. The bug, tracked as CVE-2026-33032, carries a CVSS severity score of 9.8 and allows an unauthenticated attacker on the network to invoke privileged functions that can rewrite configuration files, reload services and alter how […]
OpenAI has launched GPT-5.4-Cyber, a new version of its frontier model tailored for defensive cybersecurity work, moving quickly to answer growing concern that ever more capable AI systems could help both defenders and attackers in a widening digital arms race. The release came a week after Anthropic disclosed Claude Mythos Preview under its tightly controlled Project Glasswing programme, setting up a new contest over who can best […]
Europe’s cybersecurity agency has moved to strengthen its influence over the global system used to identify and catalogue software flaws, with ENISA no longer merely seeking a bigger role in the Common Vulnerabilities and Exposures programme but already holding Root status in a shift that gives the EU a stronger hand in how vulnerabilities are coordinated across borders. The development matters because the CVE system remains a […]
More than 30 WordPress plugins tied to the developer Essential Plugin were taken offline after a hidden backdoor was found in code distributed to live websites, exposing site owners to unauthorised access, malware installation and search-spam abuse. The campaign, traced by security researchers to code inserted in August 2025 and activated in April 2026, is being treated as a serious software supply-chain breach rather than an ordinary […]
Google has issued an emergency-style security update for Chrome after disclosing 31 vulnerabilities in the desktop browser, including five rated critical, in a release that underlines how quickly memory-safety flaws in widely used software can become a serious risk for consumers, businesses and public institutions. The stable desktop channel moved on April 15 to version 147.0.7727.101/102 for Windows and Mac, and 147.0.7727.101 for Linux, with the rollout […]
Losses from hacks, phishing and other Web3 security incidents climbed to about $482.6 million in the first quarter of 2026, even as projects expanded audits, compliance work and other defensive controls. The biggest change was not simply the amount lost, but where attackers found success: away from pure code exploits and deeper into off-chain operations, user manipulation and privileged access. Data published by security firm Hacken shows […]
A newly disclosed security flaw in Axios, one of the most widely used HTTP client libraries in the JavaScript ecosystem, has raised concern across software and cloud security teams after official advisories warned it could be chained into remote code execution or a broader compromise of cloud infrastructure. The issue, tracked as CVE-2026-40175, affects Axios versions earlier than 1.15.0 and was published through GitHub’s advisory system on […]
Adobe has issued an emergency update for Acrobat and Reader after confirming that a zero-day vulnerability tracked as CVE-2026-34621 is being exploited in the wild, putting Windows and macOS users on notice to install the patch quickly. The company assigned the update a Priority 1 rating, its most urgent category for product security bulletins, and said successful exploitation could lead to arbitrary code execution. The flaw affects […]
A critical security flaw in the User Registration & Membership plugin for WordPress has exposed thousands of websites to the risk of full administrative takeover, after researchers disclosed that versions up to and including 5.1.2 could allow attackers to gain elevated privileges without valid credentials. The issue, tracked as CVE-2026-1492, stems from improper privilege management during membership registration, creating a path for unauthorised users to register with […]
Apache Tomcat users are being urged to move quickly after the Apache Software Foundation disclosed a set of security flaws that could let attackers undermine encrypted traffic protections, slip past certificate checks in some scenarios and exploit a defect introduced by an earlier fix. The most urgent concern centres on Tomcat’s EncryptInterceptor, where one vulnerability was followed by a second flaw in the remedy itself, creating a […]
GitHub Copilot Chat has been shown to carry a serious prompt-injection weakness that allowed a researcher to demonstrate how secrets, private source code and other sensitive repository data could be siphoned out of trusted development workflows without planting malware in the victim’s environment. The issue, dubbed CamoLeak, was disclosed by Legit Security researcher Omer Mayraz after he said he found it in June 2025, reported it through […]
More than 5,000 Rockwell Automation and Allen-Bradley programmable logic controllers are exposed to the public internet, sharpening concern across United States critical infrastructure as federal agencies warn that Iran-affiliated cyber actors are actively targeting such devices. Security researchers at Censys said they identified 5,219 internet-exposed hosts globally that responded as Rockwell or Allen-Bradley systems, with nearly three quarters of them located in the United States. The warning […]
Millions of Android users, including a large share of cryptocurrency wallet customers, were exposed to a software supply-chain weakness after a flaw in the widely used EngageSDK library was found to allow hostile apps on the same device to break through normal app boundaries and reach sensitive data. The issue centred on an “intent redirection” vulnerability inside the third-party Android kit, which is used for push notifications […]
