InfoSecBulletin Cybersecurity for mankind
OWASP has released the Smart Contract Top 10: 2026, a guide to help Web3 developers, security auditors, and protocol owners identify critical vulnerabilities in smart contracts.
This edition, part of the OWASP Smart Contract Security initiative, uses security incidents and survey data from 2025 to identify the most impactful risks ahead.
Daily Cyber security update for 25. 10. 2026
By infosecbulletin
/ Sunday , October 25 2026
Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...
Read More
Daily Cyber security update for 24. 10. 2026
By infosecbulletin
/ Saturday , October 24 2026
Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...
Read More
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
By infosecbulletin
/ Friday , October 23 2026
The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain...
Read More
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
By infosecbulletin
/ Friday , October 23 2026
Major US banks have detected unauthorized access to customer accounts by third-party AI agents, with some systems taking actions beyond...
Read More
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
By infosecbulletin
/ Thursday , October 22 2026
Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated...
Read More
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
By infosecbulletin
/ Wednesday , October 21 2026
Hacker offers to sell Rajasthan Government’s Department of Information Technology & Communication (DoIT&C) data in a underground forum. The threat...
Read More
Update now! PHP2Shell: Critical PHP vulnerabilities patched
By infosecbulletin
/ Wednesday , October 21 2026
The PHP team released urgent security updates to fix PHP2Shell, two serious flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run...
Read More
Trump says data centres should pay dividends to local community
By infosecbulletin
/ Wednesday , October 21 2026
US President Donald Trump said on Wednesday that companies ​building data centers should pay a "dividend" to the communities ‌where...
Read More
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
By infosecbulletin
/ Tuesday , October 20 2026
Ransomware groups are using a flaw in Palo Alto Networks GlobalProtect VPN to get around multi-factor authentication and access corporate...
Read More
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
By infosecbulletin
/ Tuesday , October 20 2026
The U.S. Department of Homeland Security (DHS) ordered federal agencies to stop using DeepSeek products and remove it from all...
Read More
The 2026 ranking shows that attackers are evolving. They are now combining different vulnerabilities, such as linking flash loans with oracle manipulation and exploiting poor upgrade governance, to cause more financial harm.
2026 Ranking
| Rank | Vulnerability | Description |
|---|---|---|
| SC01:2026 | Access Control Vulnerabilities | Flaws that allow unauthorized users or roles to invoke privileged functions or modify critical state, often leading to full protocol compromise. |
| SC02:2026 | Business Logic Vulnerabilities | Design-level flaws in lending, AMM, reward, or governance logic that break economic or functional rules, enabling value extraction even when low-level checks appear correct. |
| SC03:2026 | Price Oracle Manipulation | Weak oracles and unsafe price integrations that let attackers skew reference prices, enabling under-collateralized borrowing and mispriced swaps. |
| SC04:2026 | Flash Loan–Facilitated Attacks | Attacks using large, uncollateralized flash loans to amplify small logic, pricing, or arithmetic bugs into large drains within a single transaction. |
| SC05:2026 | Lack of Input Validation | Missing or weak validation of user, admin, or cross-chain inputs that allows unsafe parameters to reach core logic, corrupting state or enabling fund loss. |
| SC06:2026 | Unchecked External Calls | Unsafe interactions with external contracts where failures, reverts, or callbacks are not safely handled, often enabling reentrancy or inconsistent state. |
| SC07:2026 | Arithmetic Errors | Subtle bugs in integer math, scaling, and rounding — especially in share, interest, and AMM calculations — that can siphon value when paired with flash loans. |
| SC08:2026 | Reentrancy Attacks | External calls that re-enter vulnerable functions before state is fully updated, allowing repeated withdrawals or state changes from outdated contract views. |
| SC09:2026 | Integer Overflow and Underflow | Dangerous arithmetic on code paths without robust overflow checks, leading to wrapped values, broken invariants, and potential liquidity drains. |
| SC10:2026 | Proxy & Upgradeability Vulnerabilities | Misconfigured or weakly governed proxy, initialization, and upgrade mechanisms that let attackers seize control of implementations or reinitialize critical state. |
Over $2.2 billion has been lost to crypto hacks recently, highlighting the need for a structured vulnerability framework in the blockchain ecosystem.
The OWASP Smart Contract Top 10: 2026 is designed to work with other OWASP resources like the SC Weakness Enumeration, Checklist, and Top 15 Web3 Attack Vectors to create a full framework for secure smart contract development, auditing, and compliance.
