Odaily reports: Lookonchain posted on X platform that on October 21, Bitcoin ETFs recorded a single-day net outflow of 403 BTC, approximately $33.88 million; over the past 7 days, there was a net inflow of 2,528 BTC, approximately $212 million. Ethereum ETFs recorded a single-day net outflow of 12,700 ETH, approximately $31.42 million; over the past 7 days, there was a net outflow of 155,100 ETH, approximately $384 million.

Odaily: OpenAI stated that given the severity of the recently discovered PHP security vulnerabilities and the widespread use of PHP, the company considers this one of the most significant security vulnerability incidents in recent years. According to OpenAI, frontier AI models discovered these vulnerabilities before attackers did. In addition, OpenAI has pledged $1 billion to provide subsidies to frontline cybersecurity defenders through the Daybreak program, supporting their use of Daybreak-related services.

Odaily: Binance Wallet has announced the listing of the pre-market perpetual contract trading pair PREDICTUSDT for the prediction market platform Predict.fun (PREDICT), supporting up to 5x leverage. Eligible users can, after enabling Multi-Assets Mode, use tokenized stocks bStocks in Binance Wallet as collateral, with the relevant assets counted toward collateral value at up to 90% of their market value, enabling users to hold tokenized stocks while trading perpetual contracts.

Odaily reports: Google has responded to PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619. Google stated that the Google Cloud platform itself is not affected by these two vulnerabilities, but users running PHP on the platform may still be at risk. Google also stated that Gemini 4 Argon participated in vulnerability discovery, exploit development, attack detection, and patch verification.

Odaily: Bitget Launchpool project AXIS is now open for staking. As of press time, its BGB lock-up pool yield is 65.42% APR, and the AXIS lock-up pool yield is 33,970.04% APR.

Odaily Report: Due to a severe security vulnerability exposed in the widely used PHP programming language, multiple government websites across Europe and other regions were forced offline on Wednesday, with website operators taking emergency measures to protect system security. The PHP development team announced the discovery of two severe security vulnerabilities on Tuesday local time, urging users to update immediately once fix patches are released. The PHP team stated on Wednesday that new versions addressing the vulnerabilities have been officially released.

However, as reports emerged that hackers were exploiting the vulnerabilities to breach websites, government agencies in countries including the Netherlands and Finland had already proactively shut down some websites before the patches were released. PHP is one of the most widely used programming languages on the internet, powering website platforms such as WordPress, Drupal, Joomla, and Magento.

According to data from website technology tracking firm W3Techs, approximately 75% of websites whose programming languages can be identified use PHP. About 43% of websites worldwide are powered by WordPress, spanning blogs, small business sites, government portals, e-commerce platforms, and news websites. This security incident has caused widespread disruptions to websites across multiple European countries. The Port of Rotterdam in the Netherlands, the government portal Overheid.nl, the Royal Dutch Football Association (KNVB), the websites of the country's five major political parties, and multiple hospital websites have all been temporarily shut down.

Odaily reports: The Polkadot Community Foundation has issued a security advisory stating that versions 3.0.1, 3.0.3, 3.0.4, and 3.0.5 of the third-party wallet Fearless's browser extension contain malicious code that may send private keys to attacker servers when users unlock their wallets. The relevant code was active during various periods between February 2025 and October 10, 2026.

Currently, 8 users have reported unauthorized transactions potentially related to this vulnerability, involving 17,286 DOT.

The Polkadot Foundation reminds users who have used the above extensions since February 2025 to treat all accounts within them as compromised, generate new keys using other wallets, and transfer assets as soon as possible. Simply switching wallet applications, changing passwords, or reinstalling the extension will not eliminate the risk.

Upon inspection, no related malicious code was found in the Fearless Android and Apple mobile versions; however, if the mobile wallet has previously imported the same keys used by the browser extension, those keys should still be considered compromised.

Odaily reports that, according to monitoring by on-chain analyst Ai Yi, the whale rotating from UBTC into ETH converted BTC into 3,038.73 ETH through three addresses in the past hour, worth $7.5 million; since October 11, the cumulative rotation has exceeded 46,100 ETH, with the amount surpassing $115 million, at an average rotation price of $2,513.11.

Odaily reports that Solana's first major consensus upgrade, Alpenglow, went live on mainnet around 13:54 UTC on Wednesday. The upgrade aims to reduce transaction finality time from approximately 12.8 seconds to about 150 milliseconds, a reduction of roughly 99%.

In the first phase of the upgrade, Votor will replace the existing voting and finality confirmation mechanism with direct validator voting and a certificate-based system; subsequent phases will introduce the Rotor block data dissemination protocol, replacing Turbine. At the time the upgrade launched, Solana mainnet transaction finality was 6.6 seconds, with throughput of 4,721 transactions per second.

Alpenglow will replace Solana's existing TowerBFT consensus model. Validators are expected to continue developing Agave 4.5, an upgrade plan that would increase the number of accounts supported by versioned transactions from 64 to 96, currently scheduled for launch in December 2026. (Cointelegraph)

According to MSX.COM data, SpaceX shares rose 10.56% to $163.390 per share, with a total market cap of $2.22 trillion. TSMC shares rose 0.34% to $426.535 per share, with a total market cap of $2.21 trillion.

Odaily: Bankless founder David Hoffman posted: "You thought ZEC's rally was over? ZEC's gains this cycle will reach 10% of BTC's, and next cycle it could reach 25%."

According to the official announcement, OKX will list the AXISUSD-margined X-Perp (X-Perp) on its website, App, and API. Trading for AXISUSD UM (X-Perp) will open at 22:30 (UTC+8) on October 21, 2026.

Odaily reports: Blockchain security firm CertiK stated that although Google, Apple, and Microsoft have blocked 8 affected certificates issued by Indian digital certificate authority eMudhra, crypto trading bots and exchange applications may still be exposed to related vulnerability risks, as browser remediation measures may not cover software that uses independent security systems.

Peiyu Wang, Senior Director of Digital Asset Security at CertiK, noted that attackers could exploit compromised certificates to impersonate exchanges, wallet interfaces, and APIs, replace deposit addresses, or trick users into approving malicious transactions. However, such attacks would also require intercepting or redirecting network traffic, and the compromised certificate authority keys alone cannot expose wallet private keys. Crypto service operators should update their software and certificate trust stores, and confirm that their applications reject the affected certificates. (Cointelegraph)

Odaily reports that ARK Invest's Q3 2026 DeFi report shows tokenized equities became the main driver of the rebound in on-chain trading activity during the quarter. Spot DEX trading volume for tokenized equities reached approximately $50 billion, about 9x the previous quarter, with its share of total spot DEX trading volume rising from about 1% to about 9%. Overall DEX spot trading volume grew approximately 13% quarter-over-quarter to $571 billion, marking the first increase in nearly four quarters.

Robinhood Chain achieved approximately $65 billion in DEX trading volume and $51 million in network revenue in its first quarter live, with network revenue approaching BNB Chain's level over the same period. ARK Invest expects recent gas mechanism adjustments to bring the chain's revenue down from current levels. Total stablecoin supply fell approximately 3% quarter-over-quarter to $309 billion, but adjusted transaction volume grew approximately 16% quarter-over-quarter to $781 billion, while average monthly active addresses increased approximately 39% to 73 million. Perpetual DEX open interest grew approximately 76% quarter-over-quarter to $24 billion, while quarterly trading volume fell approximately 16% to $1.4 trillion; of that, Hyperliquid accounted for approximately $13 billion in open interest, or about 53%.

According to MSX.COM data, SpaceX stock has extended its gains to 10%, marking its largest increase since August.