September 2026

Internet Archive Breach and DDoS: 31M Accounts, One Pop-Up

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

On October 9, 2024, visitors to the Internet Archive’s Wayback Machine were greeted by an injected JavaScript pop-up announcing the compromise of 31,081,179 user accounts — the HIBP-confirmed count of the organization’s authentication database, loaned from a September exposure of its Zendesk support portal. A concurrent DDoS attributed to SN_BlackMeta compounded the disruption; days later, archived XSS attempts confirmed the org’sJavaScript security debt. This account traces the initial access, the pop-up’s evidence chain, and the funding-and-fragility story of a library built on hope.

Cisco SSM On-Prem Flaws: CVSS 10.0 and a CLI Zero-Day in One Week

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

In early October 2024, Cisco’s disclosure cadence stacked two unrelated but equally urgent problems: CVE-2024-20419, a CVSS 10.0 unauthenticated password-change flaw in Smart Software Manager On-Prem that let anyone with network access reset the admin API account, and CVE-2024-20399, a CLI command-injection bug in NX-OS already being exploited in the wild per the CISA KEV catalog. This account reconstructs both flaws’ mechanics, the patch timelines, and what this pairing says about authentication surface area in management tooling.

Kia’s Web Portal: Register Any Car’s Account, Control It From Your Phone

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Web & API Security

On September 25, 2024, researchers Karan Saini and Sam Curry published an access-control flaw in Kia’s dealer and consumer web infrastructure: given only a license plate, an attacker could register an account with remote lock, unlock, start, stop, locate and horn control over 2014-2025 connected vehicles they did not own. Kia patched in August before disclosure. This account walks the plate-to-command chain, the ownership-verification gap, the threat model for tracking and theft, and the automotive-API authorization lesson that outlasts the brand.

KnowBe4 vs a Fake North Korean IT Worker: The AI-Era Insider Case Study

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:AI & Agent Security Identity & Phishing Security

In July 2024, security-awareness firm KnowBe4 hired a remote principal software engineer who turned out to be a North Korean IT worker using an AI-groomed persona, a US PPPoE front, and a stolen identity. Detected within 32 minutes of suspicious activity and fully rigged with granular session logging, the case became the definitive inside look at DPRK pension applicantFraud — from laptop farms to paycheck revenue streams funding weapons programs. This piece reconstructs the fraud chain, the detection story, and the hiring controls that failed.

Google AI Overviews: Prompt Injection Hits the Homepage of the Internet

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:AI & Agent Security Security

When Google rolled AI Overviews into US search in May 2024, satirical sources got quoted as fact at national scale — glue on pizza, rocks as vitamins — and security researchers reframed the comedy as indirect prompt injection: retrieved content steering the answer in Google’s own voice. This piece tracks the launch-week failures, the overview-bait SEO economy that followed, the manual-removal treadmill, provenance-aware retrieval as the real fix, and why RAG systems inherit the trust profile of their worst-cited source.

Sisense Breach: CI Credentials, AWS Keys and a CISA Advisory

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 24, 2024, CISA and the FBI advised every Sisense customer to rotate credentials after attackers compromised the BI vendor’s development environment — and by week’s end, Sisense-issued AWS keys were circulating publicly. This piece reconstructs the five-day arc from detection to contained, explains why business-intelligence platforms are credential funnels that turn vendor CI/CD breaches into customer incidents, and extracts the third-party-risk doctrine the episode left behind for every embedded-analytics supply chain.

Ray AI Framework’s ‘Won’t Fix’ CVEs: A Control-Plane Debate

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:AI & Agent Security Cloud & Infrastructure Security

When Protect AI disclosed five Ray vulnerabilities in March 2024 — including critical RCE via the unauthenticated control plane — Anyscale’s ‘won’t fix, trusted-networks design’ stance ignited the year’s sharpest debate over AI infrastructure responsibility. This piece unpacks the job-submission RCE, the exposed-cluster census, the bounty economics, what Anyscale later shipped anyway, and the hardening playbook that became standard for every exposed ML control plane.

Change Healthcare ALPHV: The Ransomware That Broke US Healthcare

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

One ALPHV/BlackCat intrusion in February 2024 froze claims and pharmacy payments across US healthcare for weeks — the single most consequential ransomware attack of the year. This account covers the nine-day dwell time, the $22 million ransom payment and the exit-scam double-cross that brought RansomHub back for seconds, the eventual disclosure of hundreds of millions of records, and why one processor’s central position converted a single encryptor into a national healthcare liquidity crisis.

BGP Hijacking’s 2023 Resurgence, and What RPKI Fixed

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Emerging Tech & Architecture Security

All through 2023, route leaks and suspected BGP hijacks kept redirecting chunks of internet traffic — events touching Rostelecom-linked infrastructure, financial services, and a persistent streak of cryptocurrency-targeting interception paths. None matched the famed mass redirections of prior years, but the pattern of brief, deniable, hard-to-attribute incidents kept routing security in the research headlines. This year-end review explains how BGP trust fails, walks the 2023 incident ledger with appropriately hedged attribution, and covers the defensive state of the art: RPKI signing crossing majority coverage, MANRS norms, and external route monitoring.

Cisco BroadWorks CVE-2023-20237: The SSO Bypass Scare

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Security Web & API Security

In September 2023 Cisco rushed out patches for CVE-2023-20237, a critical authentication bypass in BroadWorks’ single-sign-on flows that could let attackers authenticate as any user. With evidence of active scanning, carrier admins ran an emergency patch marathon.

MGM, Caesars, and Scattered Spider: The Vishing Fall of 2023

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

In September 2023 Scattered Spider vished the MGM helpdesk, pivoted through Okta to ESXi, and detonated ALPHV ransomware — a $100M quarter for MGM while Caesars paid up. The reference incident for helpdesk verification, MFA fatigue, and pay-vs-rebuild economics.

Discord.io Breach: When Brand Adjacency Becomes Attack Surface

Post author:Prabhu Kalyan Samal
Post published: September 5, 2026
Post category:Identity & Phishing Security

Roughly 100,000 Discord.io user accounts were dumped for sale in August 2023 — and the confusion with Discord itself proved that brand-adjacent third parties are breach surface for your users even when your systems are never touched.