GoDaddy Breach: One Phished Password, 1.2 Million Sites Exposed
Two months of undetected access to managed WordPress hosting, wholesale sFTP and database credential harvesting, and SSL keys in the bargain.
All articles published by
Hmmnm
Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths. Every technique is explained, tested, and paired with its mitigation — so you learn the attack and the defense together.
npm Hijacking Wave: coa, rc, node-ipc and Stolen Maintainers
Popular packages with dormant maintainers pushed info-stealers through postinstall scripts. The registry was fine; the accounts were not.
Nobelium’s Password Spray: The Channel Becomes the Supply Chain
The SolarWinds actor returned with no implant at all — sprayed passwords, replayed tokens, and delegated partner admin rights over 609 channel companies.
Facebook’s BGP Outage: Six Hours, Self-Inflicted, Total
One maintenance command withdrew Facebook’s backbone routes, took DNS with it, and locked engineers out of the fix. The outage defended itself.
Apache Path Traversal: CVE-2021-41773 Broke in 24 Hours
A single encoded GET walked out of Apache’s docroot, and the first patch didn’t hold. Inside the October 2021 traversal zero-day scramble.
REvil Takedown: How 14 Arrests Killed Ransomware’s Worst Brand
October 2021’s FSB operation ended REvil with arrests, asset seizures, and infrastructure capture. The talent lived on elsewhere.
OMIGOD: The Root Bug Hiding in Azure’s Invisible Linux Agent
A malformed request header turned OMI into root-level remote code execution on millions of Azure Linux VMs. Most owners never knew the agent existed.
FORCEDENTRY: The Zero-Click iMessage Exploit That Beat BlastDoor
NSO’s FORCEDENTRY turned a PDF font parser into a tiny computer and owned iPhones with no tap. The Citizen Lab anatomy and Apple’s Lockdown Mode response.
ChaosDB: The Azure Cosmos DB Chain That Crossed Tenants
A notebook container bug, an embedded certificate, and a confused gateway let any Cosmos DB customer read every other tenant’s data. Fixed in 48 hours, taught forever.
T-Mobile 2021: 76.6 Million Records Through One Unprotected API
No zero-days, no malware — just weak router credentials, a flat network, and an internal API with no authentication. The Binns breach rewrote telecom disclosure playbooks.
Poly Network: The $611M Bridge Hack That Got Returned
A forged keeper-list substitution drained $611M across three chains. Then the attacker gave it all back. The bridge bug class that defined Web3’s worst year.
ProxyShell: The August 2021 Exchange Pillage After Hafnium
Three patched-but-unapplied Exchange bugs chained into unauthenticated RCE. Webshells, mailbox theft, and ransomware followed at population scale within two weeks.
- Go to the previous page
- 1
- …
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- …
- 33
- Go to the next page