Jul 4, 2026
TL;DR -- A stale type-tag cache in the Aptos Move VM lets a recycled `StructNameIndex` map to the wrong `StructTag` after a partial cache flush, enabling storage-level type confusion. An attacker aligns a look-alike struct onto a victim resource and reads/writes its storage slot -- draining vaults, stealing capabilities, and forging cross-chain messages. Severity: Critical.
Mar 4, 2026
This is a disclosure of a vulnerability in the Polygon Plasma bridge. The vulnerability has been fixed since July 2024 and the fix has been pushed to the vulnerable library as well.
Feb 18, 2026
TL;DR -- A cache key collision in the Solidity compiler's via-ir code generator causes `delete` on transient variables to emit `sstore` instead of `tstore`, or conversely causes persistent `delete` to emit `tstore` instead of `sstore`. The direction depends on function selector ordering -- neither direction is safe.
