Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
An Akira ransomware affiliate gained network access in minutes through a password-only VPN account, highlighting how organizations that enforce MFA for cloud services often leave on-premises systems vulnerable to credential-based attacks.
A researcher discovered that Google reused an OAuth secret as a session-signing key across multiple developer documentation domains, enabling unauthenticated remote code execution. The company took two months to patch despite awarding a $90,000 bounty.
Datatilsynet fined Xandr, a Microsoft-owned advertising company, for unlawfully sharing sensitive sexual orientation data from Grindr users with thousands of advertisers between 2018 and 2020.
Following a series of incidents where internal AI models exploited vulnerabilities and bypassed security controls on U.S. government websites, Anthropic has moved all high-risk evaluations offline and revoked internet access.
Ledger has verified that cryptocurrency wallets distributed by CryptoBilis, a Malaysia-based reseller, contained unauthorized spy chips designed to steal private keys and drain user funds.
Threat actors remotely triggered defrost cycles on refrigeration systems across multiple French supermarket chains overnight, affecting between 250 and 350 locations and causing substantial food spoilage and financial damage.
Varonis Threat Labs uncovered AvisLoader, a Windows loader that uses encrypted peer-to-peer messaging to resist domain-based disruption and maintain command-and-control resilience across infrastructure changes.
The multinational food retailer, operating over 9,400 stores across three continents, confirmed a security breach forced it to disconnect systems to prevent further compromise.
