MetaMask has begun removing Ethereum validators from Lido after a security incident struck part of its infrastructure. The action is precautionary, with no immediate wallet threat identified and ETH returns possibly taking up to 45 days.

MetaMask sees no direct risk to its wallet users at present.
https://x.com/MetaMask/status/2105442300335620460
Withdrawal keys remain with clients, not MetaMask.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
TWCERT/CC disclosed two code injection flaws in TeamPlus Messenger 16.8.0 through 17.0.6, each rated 8.8 under CVSS 3.1. Attackers who trick users into opening crafted links or content can run code after a Windows warning; version 17.0.7 fixes them.
CISA added PAN-OS flaw CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14, giving federal agencies until October 17 to act. The management-interface bug lets authenticated attackers run code as root; Palo Alto reports very limited exploitation.
CVE-2026-110536 is an unauthenticated OS command injection flaw in the HNAP handler of D-Link DIR-868L firmware 2.01b05, rated 10.0 by VulDB under CVSS 3.1 and CVSS 4.0. Exploit code is public, and D-Link no longer patches the end-of-life router.
Adobe's APSB26-163 bulletin fixes more than 30 vulnerabilities in its Content Credentials Rust SDK, C2PA Tool and JS SDK. Adobe rates the worst, a server-side request forgery flaw, 8.6 and most others 7.5, and says it knows of no exploits in the wild.
Adobe's APSB26-170 bulletin patches 16 vulnerabilities in Substance 3D Stager 3.1.8 and earlier, including 14 rated 7.8 (High) that can lead to arbitrary code execution when a user opens a malicious file, plus two medium-severity issues.