Newsletter
A leak-site claim says Expedia’s loyalty data is exposed at enormous scale, while defenders juggle a stealthy CWP backdoor, SSHole exploitation scans, and AI coding agents spilling real credentials into public repos.
Newsletter
Today’s pattern: edge auth keeps failing quietly, while extortion crews keep naming brands faster than victims can confirm anything. Plus, a SonicWall SSL-VPN bypass is already being exploited, and CISA is paying attention.
Newsletter
Today’s theme is “accidental internet exposure, intentional blast radius.” A credit union breach hits 67,487 people, WorkOS says an AI agent escaped a sandbox, Queens Public Library loses Wi‑Fi across 66 branches, and Node‑RED exploitation is already live.
Newsletter
Token theft is the new “data breach.” Chainalysis says live tokens for all users were exposed, DreamHost’s File Manager spill put FTP/SFTP creds at risk, and OpenSSH on musl Linux got a weird password-bypass surprise.
Newsletter
The week’s theme: third parties and “old” bugs keep becoming today’s blast radius. A 1.3M-device Android TV botnet gets dismantled, airlines disclose an Amadeus-linked breach, a Russian hoster loses cloud data, and WordPress exploitation goes KEV.
Newsletter
Supply chain is the new perimeter. OpsShield says ~2,950 Linux servers pulled a malicious cPGuard update. Europe’s refrigeration controllers got hit again, and Android patched a no-click Framework RCE. Plus: Node-RED exploitation, Barracuda root paths, AWS JDBC RCE.
Newsletter
A mail-service breach pivoted into 97 client servers and ballooned to 77M emails. BTCPay hot wallets got swept on outdated instances. GitLab and Ivanti exploitation keeps punishing “we’ll patch later” teams. Plus: a real-world cyber hit on supermarket refrigeration.
Newsletter
Retail ransomware is now throwing punches at infrastructure, not just files. Today: a 26,739-server scare in Japan, a federal court contractor intrusion, and a fresh crop of “AI-adjacent” bugs that fail in boring, predictable ways.
Newsletter
Today’s leaks are not “data dumps,” they are credential inventories. Zeabur lost 3.2M env vars and is shutting down. Northflank told customers to assume secrets were decrypted. Chainalysis confirmed customer data exposure. Bunny rotated TLS certs after a provider incident.
Daily newsletter for CISOs
Breach notices are landing with real counts, while “weird” software keeps turning into a front door. Today: Marathon Health’s 234K-Texas filing, Hugging Face model repos running code, camera-management compromise chains, and a Linux kernel TCP RCE advisory.
Two patterns collided overnight: regulated breach notices are landing while exploit chains get shorter. Del Monte filed a CA breach notice, PHP2Shell operators popped 25 servers, and CISA flagged a Linux kernel KEV that helps attackers go from webshell to root.
Japan’s Sony Network Communications says 2.6M customer records were exposed. Volt Typhoon’s “Silent Train” shows how relay chains + zero-days hide operator hands. Plus: bulletproof hoster Virtualine seized, and CISA flags Node2Shell exploitation.
UNM Health diverted ambulances during a cyber event while a ransomware group claimed 36,000 systems. A Japanese survey site warns ~400K records including bank details may be exposed. Genesys confirms internal LMS/CRM access. Plus: Brotli decoder RCE fallout and a new PHP upload-progress CVE.
Today’s theme: trust gets you owned. A Japanese VPS provider shut down after malware landed on up to 26,739 customer servers, SBI confirmed 3,897 leaked customer records, UpdraftCentral keys got abused to backdoor WordPress sites, and AI coding agents got steered by a file dropped into Downloads.
Anonymity is brittle: a “safe tips” program leaked 1.5M submissions, while healthcare and benefits vendors keep turning lawyers and third parties into blast-radius multipliers. Plus: Snort bugs and a leaked Linux KSMBD RCE report with no patch.
This week’s pattern is ugly: high-blast-radius bugs and identity-first intrusions keep colliding with “everyone uses this” platforms. Today: an 18M-file AI data spill, a fresh Capcom account breach, and two KEV-listed exploited enterprise bugs you can’t ignore.
Two themes today: supply chain trust keeps snapping (LiteLLM shipped malware through official channels) and “minor” logic bugs turn into major privacy failures (Signal calls that won’t die). Also, a 6.38M-member disclosure reminds us how fast consumer datasets become phishing fuel.
Healthcare portals, school nonprofits, and your web stack all took hits in the same 48 hours. The theme is simple: attacker-controlled input is everywhere, and “edge” now includes your dependencies.
Edge access is the new perimeter again: SafePay’s 600+ victim runbook, Zeabur’s 3.2M environment-variable spill, and PHP2Shell’s unauth RCE are all the same story. Plus: Collabora RCE backdooring Nextcloud, and SonicWall SMA SSRF exploitation attempts.
When a certificate authority’s intermediate keys are recoverable, the blast radius is everything that forgot to update. Plus: NEC’s vendor account abuse with encryption, Siemens ClickFix abusing a signed app, and a FortiSIEM RCE PoC you can’t ignore.
Today’s theme is “trusted paths betrayed”: media servers exposed for convenience, signed installers used as carriers, and official plugin and CLI distribution channels quietly poisoned. Patch fast, then hunt like you were already late.
