Welcome to Galaxy Research's Weekly Research Brief. Subscribe to get this newsletter delivered to your inbox every Friday morning.
In this week's edition, Alex Thorn explains why some blue-chip companies opted out of the NYSE’s stock tokenization initiative; Thad Pinakiewicz breaks down this week’s top cyber scare; and Lucas Tcheyan revisits Solana’s Alpenglow upgrade, now live.
Find all our past reports and newsletters at galaxy.com/research. Send feedback to [email protected]. We’d love to hear from you.
PHPeril: Never Send a Human to Do a Machine’s Job
WHAT HAPPENED
The team maintaining scripting language PHP rushed out emergency patches Wednesday for two decade-old bugs that let anyone on the internet run code on millions of servers without permission. The rest of the internet spent the day discovering how many other things were also on fire.
The bugs, collectively dubbed PHP2Shell, affect nearly every PHP version back to 5.4 (released in 2012). PHP quietly holds up WordPress, Drupal, Magento, and by some estimates, around 70% of the web. Cybersecurity firms Wiz and Calif found the bugs with help from OpenAI, and OpenAI says Calif found the bug with GPT-5.6 Sol, a generally available model. The plan was a tidy coordinated disclosure, and everyone has a plan until they get punched in the mouth. Details leaked, Amazon's honeypots logged an exploit attempt four days before the disclosure, and Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before the patch release and millions by the evening.
The NSA and FBI told organizations to go offline if they couldn't patch, Japanese PM Sanae Takaichi urged site operators to act that night, Finland and several other European governments pulled sites preemptively, and the St. Louis Fed's FRED site went dark.
PHP was merely the headliner. This week's full lineup of cyber scares included a CVSS 10.0 GitLab bug, Railway pausing all deployments after someone got into its environment-variable store, Node.js patches, Plex servers exploited to mine crypto, SafePay ransomware, and eMudhra, an Indian certificate authority whose private keys were small enough to guess. One of them was the number 4. (Yes, that was the whole private key; easy to remember, but...)
OUR TAKE
The most worrying part of this story is that this internet-breaking exploit didn't come from those scary frontier models.
The PHP Foundation worked with outside firms to scan its code with Anthropic’s Claude Mythos this year, but this exploit was only discovered in early August as part of OpenAI’s Patch the Planet program. Even more shockingly, the exploit was discovered using GPT-5.6 Sol, a model you can pay for today, not one of the unreleased or cyber-specialized variants the labs keep caged up like a James Bond supervillain. Despite earlier testing with Claude Mythos, the vulnerability was identified through separate research using other AI models. Instead, it took a researcher’s intuition guiding a commodity model, and attackers have both.
The pace at which attackers tried to utilize the exploit is like nothing ever seen before. That is the new norm. Announcing a patch in advance is supposed to get administrators ready, but it also fired a starting gun for every bad actor racing to find the bug before the fix landed. That tension between preparing defenders and tipping off attackers was always delicate, and with more cyber-capable open AI models around, the announcement window will continue to compress toward zero. Threat intel and incident response firm Mandiant already puts mean time-to-exploit at negative seven days; attackers typically strike a week before a patch exists. The zero-day clock has struck midnight, and had an integer overflow as it kept going.
What this means is that human-only cybersecurity is truly obsolete, and untenable. Security in an agentic world must also be agentic; Hugging Face was the preview in July, breached by OpenAI’s own models during testing, and this is the new reality with broad access to capable coding agents. Machine-speed attackers need machine-speed defenders.
"Zion, hear me! It is true, what many of you have heard. The machines have gathered an army and as I speak, that army is drawing nearer to our home." – Morpheus ... or your dramatic IT security lead during an all-hands
You should be a little scared, I am. A lifelong nerd, I ran a personal server in high school, and in the late 2000s I had to learn some security practices because my little experimentation box was getting bombarded by automated SSH password-guessing, port-scanning, and general exploit attempts a full decade before the first GPT paper in 2018. The spiders were already probing everything. LLMs cranked that dynamic up to 11, then ripped the knob off.
I turned off my home server on Wednesday and unplugged most of my IoT devices until I have time to use the best available model to help me patch, replace, or reflash each one. If I write something testy about the DPRK, should I worry about them flipping my smart switches until something shorts? Do I have to root my Roomba to keep it from being taken over and trying to boop the power button on my PC? Most IoT software is forgotten after creation (when did you last patch your smart fridge?), and Anthropic's red team just ran a 26-billion-parameter model across 15 $55 Android TV boxes. With a long tail of vulnerable devices, botnets of hacked devices may graduate from DDoS attacks to distributed inference for whoever controls them.
All software stacks have been non-consensually thrown into the Thunderdome, but this is only the beginning of the battle. More exploits are coming, probably worse ones, but every serious patch and every agent-reviewed release strengthens the code the world runs on. A more secure internet is being born from its parents' death, like the Olympians descending to overthrow the Titans.
Some code is already ready for that world. Bitcoin Core is among the most heavily reviewed codebases on earth, and no comparable compromise has been reported. Most of these exploits exist because no human can hold an entire codebase in their head; almost nothing outside TempleOS was written by one person, and even that wouldn't guarantee spotting every step of an exploit chain. Agents, with long context and a shared, eidetic memory, can do the comprehensive reviews that human teams struggle with.
Modern cryptography held: nobody broke the algorithms the internet relies on. eMudhra fell on its face generating keys, not at math. At the peak of the panic, I recommended that our clients verify instructions by signing from their wallets, an additional safeguard against compromised intermediaries.
Security through obscurity is finished. There will be a culling of unmaintained websites, projects, and blockchains. It is not going to be pretty, but what survives will be an internet worth trusting. Just don't make your private key 4.
Educate yourself, protect yourself; it is going to get more dangerous before it gets safer. Put on your helmets, man the trenches with your agents, and hold the line. Don’t give the clankers an inch. – Thad Pinakiewicz
Issuers Object to OKX-ICE’s Stock Tokenization Plans
WHAT HAPPENED
At least 16 issuers opt out of OKX-ICE’s tokenized stock platform. Microsoft, Apple, Google, Goldman Sachs, CoreWeave, and Broadcom are among at least sixteen issuers that have notified OKXICE TSV, a joint tokenized stock venture between crypto-exchange OKX and NYSE parent Intercontinental Exchange, that they object to their stocks being tokenized.
The full list of issuers who have opted out: Microsoft, Apple, Google, Goldman Sachs, CoreWeave, Broadcom, UnitedHealth Group, Rocket Lab, Qualcomm, Caterpillar, McDonald’s, Western Digital, Nasdaq, Verizon, Cerebras Systems, and Applied Optoelectronics.
The Securities & Exchange Commission released its “innovation exemption” on September 17 shortly after the CLARITY Act’s failure to advance in the U.S. Senate. The exemption creates a pathway to allow for legal, regulated secondary trading of tokenized securities outside of the Reg NMS system by allowing for the creation of Tokenized Securities Venues (TSV), a new type of onchain trading venue.
Under the innovation exemption, the TSV must enact trading volume limits, enforce market-wide halts, and ensure that security tokenholders have performed know-your-customer (KYC) onboarding. So far, at least three separate entities have notified the SEC that they intend to launch TSV: Canton (with “TSV LLC”), Perpetuals.com, and OKXICE.
OUR TAKE
For years, crypto and blockchain advocates have pushed for the ability to trade stocks onchain, and in September the SEC finally delivered a pathway, but one that has set up a new battlefield with several fronts.
Third-party sponsored vs. Issuer-sponsored. The issuers who opted out are utilizing an escape valve the SEC allowed when it included the right for third parties to tokenize securities, not just their original issuers. Proponents of third-party tokenization, whether by utilizing swaps, a debt-security structure, or some type of SPV wrapper, argue that they provide what investors want most: access to economic exposure in many investments. Firms like Kraken (xStocks), Ondo Finance, Coinbase, Robinhood, and OKXICE have pursued this path; all but Ondo are exchanges. On the other side, firms like Superstate, Securitize, Figure, and Bullish (Equiniti) argue that third-party issued tokens do not convey all the features of a security, such as legal, economic, and governance rights. We’ve written about this dispute extensively, and the 16 opt-outs from OKXICE’s third-party tokenization is just the latest salvo.
DeFi vs. TradFi. The innovation exemption also draws a fascinating middle ground between DeFi and TradFi. What the innovation exemption allows for is more aptly described as onchain finance than decentralized finance. The TSV, whether comprised solely of one AMM or a conglomeration of AMMs, issuers, transfer agents, or other involved parties, must notify the SEC of its intentions, provide certain reporting, and crucially perform certain responsibilities that can only be performed with a level of control. The TSV is not quite an exchange or an ATS, but it’s also not quite DeFi in the commonly understood sense. Trade halts, KYC, and volume limits are not things that permissionless DeFi can perform today. The requirement that trading be limited to those who have been KYC’d, in particular, will make legal, American tokenized securities substantially less composable in the broader onchain environment, at least in the near term. But the TSV can ultimately allow for trading outside the Reg NMS system and does not need to register as a national securities exchange or alternative trading system (ATS). Not quite DeFi, but not quite TradFi.
An interesting aspect of the approach taken by the SEC is that the “innovation exemption” offers exemptive relief in an unconventional way. The Commission did not look at an entity or set of entities and say “you’re exempt for these reasons.” In fact, the term TSV was invented by the SEC in the order itself, and no “TSV” exists yet. So, rather than a typical exemptive relief, the Commission has presented a new pathway, one that seems to thread the needle between rules, statutory authorities, and a maze of stakeholders. Whether this approach can be successful in promoting an innovative and experimental new environment for securities trading remains to be seen, and the answer to the question will ultimately determine the outcome of the third front in the tokenized securities battle.
Onshore vs. Offshore. Onshore tokenized securities under the innovation exemption face an uphill battle in the market. If they cannot deliver a better product and comparable user experience to an offshore, third-party issued tokenized security that is fully composable in DeFi once accessed via VPN, then the whole experiment could fall flat. It’s very early still in the application of the innovation exemption, and we and many others will have more to say and announce in the coming weeks and months, but it is crucial that the innovation exemption yields tangible benefits, at least in actionable learnings to inform next steps in designing a viable onchain securities market, if that onchain securities market is to be built in the United States and not in Malta, Abu Dhabi, or the Caymans. – Alex Thorn
Solana Alpenglow Upgrade Ships. Adoption is the Real Test
WHAT HAPPENED
On Wednesday, at slot 459,653,000, Solana activated the long-awaited Alpenglow update to mainnet, changing Solana’s consensus protocol for the first time since its launch.
Heralded as “the biggest upgrade in Solana’s history” by Solana’s core developer lab Anza, the upgrade improves both finality and the network’s fault tolerance model. Transactions on Solana are now designed to finalize in roughly 150 milliseconds instead of the 12 seconds required under Solana’s previous TowerBFT consensus mechanism. The upgrade also introduces a new “20 + 20” resilience model, remaining secure against 20% hostile stake while tolerating up to an additional 20% of stake going offline, for a combined 40% of stake that can be unavailable or adversarial. This differs from the traditional Byzantine fault-tolerance assumptions used by many other chains, which are typically resilient only to 33% on both counts.
The Alpenglow update is staged across three phases. Wednesday’s activation introduced phase 1 through Votor, which moves validator voting offchain and removes Proof of History from its previous role in consensus. Moving votes offchain frees up blockspace previously consumed by vote transactions and makes it available for user transactions. Phase 2 is expected to improve the leader handover process so the next leader can begin constructing blocks more quickly, while Phase 3 will implement Rotor, a new block-propagation design intended to replace Solana’s Turbine mechanism and reduce the number of hops required to distribute block data. For a more in-depth overview of the upgrade’s technical details and roadmap refer to our prior coverage here and here.
Alpenglow arrives as part of a broader set of performance upgrades Solana has been rolling out in parallel over the past few months. Most notably, the network recently completed a staged reduction in slot times from 400 milliseconds to 200 milliseconds, increasing the frequency of block production. Together with Alpenglow’s faster finality, the shorter slot times are intended to tighten the gap between transaction submission, inclusion, and irreversible settlement, while later phases of Alpenglow (fast leader handover and Rotor) are designed to reduce remaining sources of latency in block construction and propagation.
OUR TAKE
Protocol upgrades on par with Alpenglow, for example Ethereum's "The Merge," have historically been important milestones that draw external interest in blockchains. They demonstrate novel technical innovation and a level of competency from core developers. That dynamic has shifted as crypto markets have matured. The reason is simple. Technological innovation alone is no longer enough. Adoption and real use are the most important metrics.
That doesn’t mean upgrades like Alpenglow are insignificant. Far from it. General-purpose smart contract platforms like Solana are built to perform on par with centralized financial markets and need to continually evolve to remain competitive. Even the most established smart contract platform, Ethereum, is nowhere close to a place where it can ossify. Doing so would risk leaving any chain in the dust to existing alternatives or new entrants. Protocol updates not only demonstrate core developer technical capability, but the ecosystem’s ability to anticipate and adapt the underlying chain to changing use cases that drive real demand.
In that context, Alpenglow is an important step forward for Solana. Shortening finality improves performance for trading venues, bridges, and payment applications (among many use cases). Coupled with other changes to the protocol across slot times and tokenomics, it continues to position Solana as one of the few high-performance decentralized blockchains with an organic user and developer base. As I wrote following Solana’s Accelerate conference in May, for the past year or so Solana has been “building backwards,” trying to recapture market share in verticals like perpetuals, prediction markets, and DeFi, where others clearly lead. Alpenglow is a step toward reversing that dynamic.
Whether this technical progress translates into real growth depends on where Solana decides to compete. While Solana may be able to regain some market share in verticals where it already lags, it will be incredibly hard to become the default venue. As our quarterly Solana updates show, despite extensive efforts, the chain has largely failed to penetrate perpetuals or prediction markets (although it is still early on that journey). For Solana, the golden ticket so far has largely been the meme economy, which despite poor external optics, has been an incredible success from a fee and revenue standpoint. It is also competing aggressively to be a leader in the tokenization boom. But perhaps the most overlooked vertical is a growing cohort of real businesses that are using the chain for capital formation and as their operational infrastructure. Those are the green shoots that, when complemented with a world-class and driven group of core developers, can accelerate Solana’s adoption and growth.
Devs are shipping. Do not fade them. - Lucas Tcheyan
Other News
🚪 OCC’s final Genius Act rule leaves door open for certain stablecoin rewards
👔 JPM Asset Management sees BTC outperforming stocks, bonds, gold in next 10 years...
🔷... as megabank expands JPM Coin to Ethereum mainnet from Base L2
🕙 NYSE extends options trading hours, plans 23-5 trading in December
✊🧅 Students take to the streets to protest ... 1958 onion futures ban
🧪 Fusion startup claims in paper it’s found way to turn mercury to gold
🔀 a16z to drop ‘crypto’ from name of flagship blockchain fund
☂️ BlackRock files for BTC ETF offering downside protection, upside exposure to IBIT
🐂 Webull to offer perpetual futures starting next month
Charts of the Week: VC Vital Signs
Pre-seed deals’ share of crypto and blockchain venture capital investments grew to 25% in Q3 2026, while later-stage investments slipped to 24% of completed transactions. We track pre-seed transactions’ share to gauge entrepreneurial behavior and investor risk appetite. Later-stage deals’ share of the total remained elevated compared to the historical norm, reflecting the market's growing maturity.
Meanwhile, VC-backed crypto company valuations (bars, left-hand vertical axis in the chart below) rebounded to a new all-time high of roughly $90m in Q3 2026, as valuations across the broader VC complex outside of crypto also rose to a new high. In Q3 2026, the median crypto deal size (feverline, right-hand axis) fell sharply from Q2’s all-time high of $5m to roughly $3m.
For more insights, stay tuned for our quarterly VC report, coming soon. – Thad Pinakiewicz
Legal Disclosure:
This document, and the information contained herein, has been provided to you by Galaxy Digital Inc. and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the stablecoins mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions.
Participants, along with Galaxy Digital, may hold financial interests in certain assets referenced in this content. Galaxy Digital regularly engages in buying and selling financial instruments, including through hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here.
For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including in its Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, filed with the SEC on November 10, 2025, available at www.sec.gov.
Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Copyright Galaxy Digital Inc. 2026. All rights reserved.