LastPass Vault Theft Confirmed: The December Reckoning
LastPass confirmed attackers copied encrypted vault backups after pivoting through a DevOps engineer's endpoint. KDF legacy and unencrypted metadata set the real risk.
Guardian Ransomware: The Newsroom That Kept Printing
Ransomware forced the Guardian's newsroom off its networks for weeks in late 2022 — yet print and web kept publishing. Editorial continuity lessons.
InfraGard Portal Breach: Account Takeover Inside the Vetted
USDoD hijacked a chapter president's InfraGard account and listed 87,000 members' PII for sale. Identity lessons for trusted-community portals.
Rackspace Hosted Exchange Ransomware: The Outage That Killed a Legacy
Rackspace's December 2022 ransomware incident took Hosted Exchange down for weeks, ended the product's life, and cost $12M+. Legacy platform lessons.
FortiOS SSL-VPN Heap Overflow: Pre-Auth Emergency
CVE-2022-42475 was a CVSS 9.8 pre-auth heap overflow in FortiOS SSL-VPN, patched silently then confirmed exploited. Edge memory safety lessons.
ChatGPT’s Launch and the Dawn of Prompt Injection
ChatGPT landed November 30, 2022 and hit 100M users in two months — and immediately made prompt injection a practical attack class. Still unsolved in 2026.
FTX Collapse: The Wallet Drains Custody Controls Never Defined
As FTX fell, hundreds of millions moved from its wallets — later attributed mostly to insiders per trial testimony. Custody without governance is the vulnerability.
ProxyNotShell: Exchange Zero-Days Auctioned Before the Patch
Two Exchange zero-days chained SSRF-to-RCE were sold on a forum before Microsoft's November 2022 patch — and mass-exploited in the gap. Assume-the-edge lessons.
BNB Chain 2022: The $570M Forgery Contained by a Chain Pause
An attacker forged a bridge proof to mint 2M BNB (~$570M), then validators halted the chain mid-launder. Only ~$100M escaped before the freeze.
Medibank 2022: The Ransom Refusal That Published Patients
Criminals entered Medibank via a contractor's VPN credentials on a gateway without MFA, then dumped 9.7M customers' health data after the ransom refusal.
Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell
CVE-2022-42889 in Apache Commons Text scored CVSS 9.8 but needed apps to interpolate attacker strings — most never did. The reachability-triage lesson.
Fortinet CVE-2022-40684: Admin Access Without a Password
A CVSS 9.8 authentication bypass let attackers add their own SSH keys to FortiOS admin accounts via crafted HTTPS requests. Exploited at disclosure.