October 2022

BNB Chain 2022: The $570M Forgery Contained by a Chain Pause

Post author:Hmmnm
Post published:October 25, 2022
Post category:Cryptography & PKI Security

An attacker forged a bridge proof to mint 2M BNB (~$570M), then validators halted the chain mid-launder. Only ~$100M escaped before the freeze.

Medibank 2022: The Ransom Refusal That Published Patients

Post author:Hmmnm
Post published:October 18, 2022
Post category:Emerging Tech & Architecture Ransomware & Malware Security

Criminals entered Medibank via a contractor's VPN credentials on a gateway without MFA, then dumped 9.7M customers' health data after the ransom refusal.

Text4Shell: The 9.8 Severity Score That Wasn’t Log4Shell

Post author:Hmmnm
Post published:October 13, 2022
Post category:Security Supply Chain Security

CVE-2022-42889 in Apache Commons Text scored CVSS 9.8 but needed apps to interpolate attacker strings — most never did. The reachability-triage lesson.

Fortinet CVE-2022-40684: Admin Access Without a Password

Post author:Hmmnm
Post published:October 10, 2022
Post category:Cloud & Infrastructure Security Web & API Security

A CVSS 9.8 authentication bypass let attackers add their own SSH keys to FortiOS admin accounts via crafted HTTPS requests. Exploited at disclosure.