GoDaddy Breach: One Phished Password, 1.2 Million Sites Exposed
Two months of undetected access to managed WordPress hosting, wholesale sFTP and database credential harvesting, and SSL keys in the bargain.
npm Hijacking Wave: coa, rc, node-ipc and Stolen Maintainers
Popular packages with dormant maintainers pushed info-stealers through postinstall scripts. The registry was fine; the accounts were not.
Nobelium’s Password Spray: The Channel Becomes the Supply Chain
The SolarWinds actor returned with no implant at all — sprayed passwords, replayed tokens, and delegated partner admin rights over 609 channel companies.
Twitch Leak: 125GB of Source Code and Payouts on 4chan
No malware, no zero-day — one exposed internal endpoint handed over Twitch's entire codebase and three years of creator earnings.
Facebook’s BGP Outage: Six Hours, Self-Inflicted, Total
One maintenance command withdrew Facebook's backbone routes, took DNS with it, and locked engineers out of the fix. The outage defended itself.
Apache Path Traversal: CVE-2021-41773 Broke in 24 Hours
A single encoded GET walked out of Apache's docroot, and the first patch didn't hold. Inside the October 2021 traversal zero-day scramble.
REvil Takedown: How 14 Arrests Killed Ransomware’s Worst Brand
October 2021's FSB operation ended REvil with arrests, asset seizures, and infrastructure capture. The talent lived on elsewhere.
FORCEDENTRY: The Zero-Click iMessage Exploit That Beat BlastDoor
NSO's FORCEDENTRY turned a PDF font parser into a tiny computer and owned iPhones with no tap. The Citizen Lab anatomy and Apple's Lockdown Mode response.
Poly Network: The $611M Bridge Hack That Got Returned
A forged keeper-list substitution drained $611M across three chains. Then the attacker gave it all back. The bridge bug class that defined Web3's worst year.
T-Mobile 2021: 76.6 Million Records Through One Unprotected API
No zero-days, no malware — just weak router credentials, a flat network, and an internal API with no authentication. The Binns breach rewrote telecom disclosure playbooks.
ProxyShell: The August 2021 Exchange Pillage After Hafnium
Three patched-but-unapplied Exchange bugs chained into unauthenticated RCE. Webshells, mailbox theft, and ransomware followed at population scale within two weeks.
PetitPotam and ESC8: The NTLM Relay Chain That Owned Active Directory
PetitPotam coerced Windows machines to authenticate, AD CS web enrollment happily minted a DC certificate, and domains fell in an afternoon. The relay class is still with us.