Articles
Breach breakdowns with hands-on fixes, newest first. Also available as an RSS feed.
-
Your host got breached. Now check your own servers.
Japan just had a bad two weeks: JAL via Amadeus, Sony's So-net, GMO's Desktop Cloud with malware on customer VMs. The useful lesson is not "Japan has a problem." It is what you do when the people who run your box get broken into.
-
A vendor app made itself Global Admin in five minutes. Here's how to check your tenant.
The ConnectWise Cloud Backup credential theft, the AI agent Microsoft says was steering it, and a read-only check you can run on any Microsoft 365 tenant today.
-
CISA Says Assume Your Cold Storage Is a Target. Here's How to Check Today.
A same-day US advisory after supermarket freezers, military commissaries and blood banks were hit. Confirmed facts, open questions, and the eight checks operators should run.
-
Barclays Named AI in 5,000 Job Cuts. Here's What the Bank Actually Said.
The bank's own call script tells two stories at once. Today's US layoff numbers help explain why that matters.
-
That Google alert is real. The phone number inside it isn't.
Scammers are typing fake invoices and fake support case numbers into a Google settings field, and Google's own security email delivers the text for them. Here's how to read one of these without getting pulled into a call.
-
You Connected Gmail to Google's AI Mode. Here's What It Can See, and Who Else Might.
The ads change got the headlines. Google's own help page says a lot more.
-
Thousands of AI-Built Apps Left Their Database Open. Here's How to Test Yours Like a Stranger Would.
The key in your page is public on purpose. The rules behind it are the only thing between a visitor and your users' data.
-
Checking the hash is not enough. Check who built the download.
A SHA256SUMS file from the same release as the binary proves the two agree with each other. It does not prove who produced either one. Here is what I run instead, and how releasedrift finds the downloads that never get that far.
-
Your registrar login is a production admin account
Name.com domains were pointed at wallet drainers over one weekend. Here is the access review I'd run on every domain that matters.
-
The safe word only works if they let you ask. Plan for the call you can't hang up on.
A mother spent five and a half hours on a fake kidnapping call with what she believes was a cloned voice of her daughter. Here's the plan I'd want my family to have before that phone rings.
-
The agent reading your inbox can now run shell commands. Check which MCP servers you have installed.
VulnCheck published nine MCP server CVEs in two minutes on October 27. Eight have no fix. Six of the records name prompt injection as a way in, and one names email and SMS as the place the payload arrives. Here is how I would inventory mine.
-
The Claude Code extension backdoor: check every profile, not just yours
A tampered build sat in Cursor's marketplace for about 11 hours on Oct 29. The public checks look at one user. Here is how I'd sweep a whole machine, or a whole fleet, before Monday.
-
The box that records your admin sessions can be your attacker's best host
CyberArk's Privileged Session Manager and PSMP let a low-privileged authenticated user run code on the broker. Okta Access Gateway and Vault Enterprise had their own fixes in the same layer. If that broker sits between every admin and every server, treat the patch like a VPN emergency.
-
Polymarket got drained through a page-speed script. Does your site load one?
A monitoring script that Polymarket loaded from its vendor DebugBear was swapped for a wallet drainer for about an hour on October 29. Hundreds of wallets were hit, by one count about 710 deposit addresses, though that is not the same as the number of victims. Here is what is confirmed, what is still open, and how to check your own site for the same weak spot.
-
Breach Notes, Oct 24 to 30, 2026: Binance's record theft and a week of logins nobody was watching
Eight incidents from the past seven days, what is confirmed, what isn't, and the one or two things I would do about each before the weekend.
-
Warp lost some agent traces. Here is how I would find the keys that were in mine.
Warp says someone broke into one of its vendors and got at agent traces and telemetry belonging to as many as 1% of its users. Nobody outside Warp knows yet what those traces held. Your laptop keeps its own copy of a lot of it, and you can read that copy today.
-
26,400 working keys were sitting in public Gitee repos. One scanner would have caught about half.
A researcher cloned 7.25 million public repositories on Gitee and found 26,400 credentials that still worked. The number is big, but the detail I keep coming back to is smaller: the two scanners he used mostly found different keys. If you scan your own repos with one tool and call it done, this is a good week to stop.
-
Your firewall is a Linux box. Check it before Oct 31.
CISA put Fragnesia on its exploited list with a three-day deadline. Dream says one crew used PHP2Shell, then Fragnesia, to root 25 firewalls. Here is what I would check on mine tonight, before anybody reboots.
-
A coffee chain's 5.7 million account leak ran through Metabase. Check your own instance today.
Fore Coffee says attackers got into its Metabase. If your team runs Metabase too, here is how I would check version, logs and the app database this afternoon.
-
Someone is password-spraying FileMaker Servers. Here is how I'd check mine tonight.
A FileMaker hosting company pulled every server offline on October 25. If you run FileMaker Server yourself, here is what I would check first, and which keys I would change.
-
A Vendor Left a Live Database Key on a Public Website for 14 Months. Check Yours Today.
A health analytics vendor put a working key to a member database on the open web and nobody on its side noticed for over a year. Here is what is known, and how to check your own sites and vendors.
-
The PingCAP Breach Went Through Support Tickets. Here's How to Find What You Pasted.
Some customers handed AWS keys and database passwords to PingCAP in support tickets. Here is how to find what you pasted and what to rotate.
-
The OVHcloud CLI Was Swapped for a Stealer, and the Checksums Still Matched
How to check your machines without running the binary, what to rotate, and the one GitHub setting that would have stopped this.
-
Someone Spent a Week Raiding Hosting Platforms for AI Keys. Here's How to Check Yours
Railway, Zeabur and OpenCode all lost customer secrets between October 14 and 21. What each one confirmed, and the rotation order I'd follow if my keys were on any of them.
-
The LiteLLM Hack Started With a Key Nobody Revoked in May
How to check your machines for the poisoned 1.107.0 release without setting it off again, and what to fix in your own GitHub org.