ServiceNow Says a REST API Bug Left Customer Data Reachable Without Logging In
ServiceNow disclosed a security incident in which an unauthenticated REST API endpoint let users query data inside a subset of customer instances with...
Breach Intelligence & Articles
825 articles on data breaches, ransomware, incident response, and threat intelligence.
Qilin Burns a Check Point VPN Zero-Day: CISA Gives Federal Agencies Three Days to Patch CVE-2026-50751
Check Point confirmed a critical authentication-bypass zero-day in its Remote Access VPN (CVE-2026-50751, CVSS 9.3) was exploited in the wild by a Qil...
The Unit That Ate Cybersecurity: From Stuxnet to a $32 Billion Exit, How Israel's 8200 Became the Backbone of Global Cyber Defense — and a 'Critical' Threat
Stuxnet was the opening act: a US–Israel cyberweapon that physically wrecked Iran's centrifuges. Sixteen years later, the same military unit that help...
Operation Grim Beeper: How Mossad Turned Hezbollah's Supply Chain Into a Weapon — and Rewrote the Rules of Hardware Trust
On September 17–18, 2024, thousands of pagers and walkie-talkies carried by Hezbollah members detonated simultaneously across Lebanon — 42 dead, up to...
Spyware on the Negotiators' Phones: The DIA Just Rated Israel a 'Critical' Counterintelligence Threat — Its Highest Designation for Any Ally
The Defense Intelligence Agency quietly elevated Israel to 'critical' — the same counterintelligence tier reserved for adversaries like China and Russ...
Charter Confirms Spectrum Breach After ShinyHunters Vishing Attack Exposes Millions of Customers
ShinyHunters phoned a Charter Communications employee, talked their way into a Microsoft Entra account, and exported millions of Spectrum customer rec...
Lithuania Probes Theft of 600,000 State Registry Records as Officials Point to Russian Intelligence
Attackers used compromised credentials belonging to Lithuania's Migration Department to siphon more than 600,000 records from the state Centre of Regi...
HTTP/2 Bomb: AI-Discovered Flaw Lets One Attacker Crash NGINX, Apache, IIS, Envoy and Cloudflare
A remote denial-of-service flaw dubbed the HTTP/2 Bomb (CVE-2026-49975) lets a single attacker on a home connection exhaust 32GB of server memory in 2...
Just Ask the Bot: How Hackers Talked Meta's AI Into Hijacking the White House's Instagram
No malware. No zero-day. Attackers simply opened a chat with Meta's AI support assistant, asked it to bind a new email to a target account, and let th...
Disruption Week: DOJ and Tech Giants Erase 1.4 Million Scam Accounts in Strike on Southeast Asian Fraud Empires
In a four-day operation in Washington, the DOJ's Scam Center Strike Force fused federal agents, five-nation law enforcement, and nine tech companies —...
The Doorman Gets 81 Months: Yanluowang Access Broker Aleksei Volkov Sentenced for Selling the Keys to Dozens of US Networks
Aleksei Volkov didn't deploy the ransomware — he sold the way in. As an initial access broker for the Yanluowang crew and other groups, the 26-year-ol...
74 Warrants and a Thonglor Condo: German DDoS-for-Hire Kingpin Behind Fluxstress Arrested in Bangkok
Noah Christopher, a 26-year-old German wanted on 74 cybercrime warrants, ran the Fluxstress and Netdowner DDoS-for-hire platforms — letting anyone wit...