Electrum disclosed a vulnerability on Oct 24 allowing malicious servers to trick users into signing payments to attackers. Two reports in October included a case where funds were stolen after a fee increase.