WhatsApp’s 2022 Ring-Phase RCE: Code Execution Before You Answer
CVE-2022-36934 gave WhatsApp a CVSS 9.8 integer-overflow RCE that could execute during the video-call ring — before the victim answered. Zero interaction.
GTA VI Leak: When Your Slack Workspace Is the Vault
A Lapsus$-linked teenager allegedly reached Rockstar's Slack via helpdesk social engineering and posted 90+ GTA VI dev clips. The collaboration suite was the vault.
Optus 2022: 9.8M Records, One Unauthenticated API, Zero Exploits
Australia's second-largest telco exposed ~9.8M customer records via an API left unauthenticated in production. No zero-day, no phishing — just enumeration.
Uber’s 2022 Hack: A Bought Password, a Flood of Pushes, and vSphere
An 18-year-old bought a contractor's Uber password, bombarded them with MFA pushes until one was approved, then roamed to vSphere via hardcoded credentials.
LastPass 2022: The Dev-Environment Breach That Came Back
August's 'contained' developer-account compromise returned in December as stolen vault backups. Inside the two-act breach.
Plex’s 15M Credential Leak: When Your Forum Post Becomes a Combo List
A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.
Solana’s 9,000-Wallet Drain: Who Logged the Seed Phrases?
Slope's telemetry backend held plaintext seed phrases, and attackers harvested them. The chain saw only valid signatures — and that is the whole lesson.
0ktapus: The SMS Phishing Wave That Hit 130+ Companies
Fake Okta pages, real-time MFA relay, and one crew harvesting 10,000 identities. Why Cloudflare walked away clean and Twilio didn't.
Nomad Bridge: The $190M Config Bug That Became a Mob Looting
A routine upgrade left message proofs rubber-stamped. Hundreds of copycats drained the bridge in crypto's most chaotic heist.
Twitter’s 5.4M Scrape: When an API Becomes a Breach Oracle
A patched OAuth endpoint answered one question too honestly: which phone belongs to which handle. The dataset sold for $30k — the class lesson is still with us.
LockBit 3.0’s Bug Bounty: When Ransomware Ran Its Own QA
A criminal franchise paid up to $1M for flaws in its own malware, website, and Tor infrastructure — Silicon Valley tactics inside the ransomware economy.
Predatory Sparrow: The OT Hack That Melted Steel on Camera
Furnaces halted, footage released, workers warned. How a state-aligned group turned industrial sabotage into broadcast messaging.