that's a secret, but you can guess
Newsletter
Today’s thread is “trusted third parties, trusted defaults.” iRhythm’s breach is a reminder that attackers don’t need your core systems if they can reach your hosted apps, your vendors, or your employee HR stack. Plus: Frontline’s K-12 ripple, Live Nation’s silent filing, and a critical Atlassian Da
Newsletter
Credential theft is back on top: Oracle Health’s Cerner blast radius jumps to nearly 20M, utilities lose 400K accounts via a portal, and ASOS gets popped by straight-up impersonation. Plus: Atlassian file-read scans, FortiBleed lockouts, and a CVSS 10 SonicWall SSRF.
Newsletter
A bad day for “trusted third parties”: an IR vendor allegedly paid ransoms in secret, a forgotten analytics box leaked 1M emails, and ccTLD operators let attackers mint Google TLS certs. Plus: Atlassian exploitation, SonicWall SSRF, and fresh pods.
Newsletter
Arizona courts say 1.3M people had data copied after one click. ASOS pushes “HACKED” alerts via its own app stack. Atlassian drops a critical file-read across eight Data Center products. Plus: Citrix SAML NetScaler DoS and npm malware that hid for years.
Newsletter
Identity data keeps leaking through “trusted access” and “trusted login” paths: Denmark’s CPR registry, Nikkei’s M365 mailbox, and a medical school ransomware case. Plus: Citrix SAML DoS zero-day, Rejetto HFS RCE scanning, and Google pauses OSS bug bounties due to AI spam.
Newsletter
Today’s theme is “control-plane trust.” One stolen user mailbox, one unauth API endpoint, one edge appliance feature, and one WAF rule gap are all it takes to turn “we’re fine” into “we’re filing notices.”
Newsletter
Identity systems keep failing loud and wide: a Danish university IAM breach hits 200,000, K-12 staff SSNs spill via a vendor flaw, and a hospice manager loses PHI for 35,916 Texans. Meanwhile, law enforcement squeezes extortion crews, and AI features ship with command execution footguns.
Newsletter
Big breaches keep landing in the “verification” layer: identity docs and SSNs on one side, and enterprise cloud control planes on the other. Today’s thread is trust reuse, attackers hiding in systems you already allow.
Newsletter
KillSec’s leak site gets seized with 110TB of stolen data. Keio says ransomware hit its servers. Meanwhile, Zimbra command injection gets a detailed exploitation writeup, and Vault/OpenBao chains show how “one unauthed endpoint” can become full takeover.
Newsletter
AI agents quietly turned dev laptops into public leak pipelines. Plus: Cisco SD-WAN Manager auth bypass hits KEV, CISA flags a MikroTik pre-auth root RCE, OpenSSL DTLS bug, and TeamViewer’s “patch now” moment.
Newsletter
A year of quiet access beats a loud ransom note. Today’s stories rhyme: identity systems, file-sharing corners, and “trusted” UX surfaces turning into attacker-controlled funnels. Also, Spectre is not dead, it just took a long nap.
Newsletter
Zero-days are back in the quietest place possible: your endpoints’ file parsers, your ERP edge, and your “harmless” public reports. Today’s common thread is control-plane trust being treated as data-plane reality, and attackers cashing that check.