Security – Page 18

The ChatGPT Redis Bug: Cross-Tenant Leaks in One Line

Post author:Hmmnm
Post published:March 24, 2023
Post category:AI & Agent Security Cloud & Infrastructure Security

A redis-py cancellation bug plus a disabled key-prefix let some ChatGPT users see strangers' chat titles and billing data. Multi-tenant cache lessons.

Bing Chat’s Sydney: The System Prompt Extraction Era

Post author:Hmmnm
Post published:March 18, 2023
Post category:AI & Agent Security Security

Researchers pulled Bing Chat's hidden rules with polite overrides, revealing the codename Sydney and confidential guidelines. Prompt-injection's big bang.

Namecheap/SendGrid Hijack: Phishing With Perfect DMARC

Post author:Hmmnm
Post published:February 27, 2023
Post category:Identity & Phishing Security Supply Chain Security

Phishers compromised a SendGrid supplier account and sent MetaMask-themed mail through Namecheap's legitimate pipeline — SPF, DKIM, and DMARC all passed.

Reddit’s Phishing Breach: When MFA Codes Get Phished Too

Post author:Hmmnm
Post published:February 18, 2023
Post category:Identity & Phishing Security

A cloned intranet page harvested an employee's password and MFA code, opening hours of internal access. Phishing-resistant MFA and self-report lessons.

GoDaddy’s Multi-Year cPanel Breach: 2.5 Years of Dwell

Post author:Hmmnm
Post published:February 16, 2023
Post category:Cloud & Infrastructure Security Supply Chain Security

GoDaddy's 2023 filing admitted intermittent intruder access since 2020, malware in cPanel servers, and email interception affecting ~6.95M customers.

ESXiArgs: The Ransomware Wave That EncryptEd Whole Estates

Post author:Hmmnm
Post published:February 4, 2023
Post category:Cloud & Infrastructure Ransomware & Malware Security

ESXiArgs hit thousands of unpatched VMware ESXi hosts via old OpenSLP bugs in February 2023. Hypervisor ransomware and recovery-script lessons.

git-credential Risks: When Helpers Leak What They Cache

Post author:Hmmnm
Post published:January 25, 2023
Post category:Cryptography & PKI Security Supply Chain Security

Git's January 2023 advisory flagged plaintext credential stores and verbose logs echoing 2FA tokens. Developer tooling is production security surface.

T-Mobile API Scraping 2023: 37M Accounts, One Credential

Post author:Hmmnm
Post published:January 19, 2023
Post category:Identity & Phishing Security Web & API Security

A single compromised API credential let an actor scrape ~37 million T-Mobile accounts over six weeks. Machine-identity governance lessons from a repeat offender.

Royal Mail vs LockBit: The $80M Ransom Refusal

Post author:Hmmnm
Post published:January 18, 2023
Post category:Emerging Tech & Architecture Ransomware & Malware Security

LockBit encrypted Royal Mail's international sorting operations in January 2023 and demanded $80M. Royal Mail paid nothing and kept the letters moving.

KeePass Plaintext Export ‘Flaw’: The Trust-Boundary Debate

Post author:Hmmnm
Post published:January 13, 2023
Post category:Cryptography & PKI Identity & Phishing Security

CVE-2023-24055 showed a config-planted trigger could export KeePass vaults in plaintext after unlock. The debate: feature, flaw, or threat model?

LastPass Vault Theft Confirmed: The December Reckoning

Post author:Hmmnm
Post published:December 27, 2022
Post category:Cloud & Infrastructure Identity & Phishing Security

LastPass confirmed attackers copied encrypted vault backups after pivoting through a DevOps engineer's endpoint. KDF legacy and unencrypted metadata set the real risk.

Guardian Ransomware: The Newsroom That Kept Printing

Post author:Hmmnm
Post published:December 25, 2022
Post category:Emerging Tech & Architecture Ransomware & Malware Security

Ransomware forced the Guardian's newsroom off its networks for weeks in late 2022 — yet print and web kept publishing. Editorial continuity lessons.