26 Million Requests Per Second: Cloudflare’s Record DDoS
Five thousand cloud VMs, each pushing 5,000 rps of encrypted traffic at one small website. June 2022’s record flood and the edge doctrine it sealed.
Harmony Horizon: $100M for Two Stolen Keys
A 2-of-5 multisig guarding nine figures. Lazarus took the two keys it needed, and the bridge-custody era changed for good.
Follina in the Wild: TA413, Patch Gaps and Zero-Day Economics
Sixteen days between disclosure and patch. Who exploited Follina in the gap, how fast state and commodity actors moved, and the doctrine it forged.
Confluence CVE-2022-26134: OGNL Injection RCE Under Fire
Exploited in the wild two days before the patch existed. How OGNL injection turned Confluence into June 2022’s internet-scale fire drill — and the playbook it left behind.
Heroku Held the Keys: Anatomy of a Vendor-Token Breach
GitHub’s OAuth tokens lived in Heroku’s infrastructure. One compromised CI cache later, an ecosystem learned where vendor tokens really live.
Beanstalk’s $182M Flash-Loan Governance Attack: Thirteen Seconds
No key stolen, no bug exploited — an attacker borrowed a voting majority on Aave, passed his own proposal, and drained the vaults in one block.
Costa Rica’s Conti Emergency: When Ransomware Became a National Crisis
Conti encrypted the treasury during tax season, declared war on the government, and forced the world’s first ransomware state of emergency.
Spring4Shell: The RCE That Wasn’t Log4Shell (but Still Bit Hard)
A JDK 9 property path reopened a 2010-era bug class in Spring’s data binder — and gave every Tomcat admin a very bad 48 hours.
Lapsus$ vs Microsoft: When Teen Hackers Beat a Hyperscaler’s Odds
37GB claimed, one account compromised, no customer data lost — and a DEV-0536 profile that taught the industry how social engineering beats MFA.
Ronin Bridge: The $625M Heist That Ran on Five Keys
North Korea’s Lazarus Group drained Axie Infinity’s Ronin bridge of $625M with five forged signatures and a leftover permission nobody revoked.
Okta’s Weak Link: When Your IdP’s Vendor Gets Pwned
One contractor’s stolen credentials reached super-admin support tooling across 366 Okta tenants. The identity supply chain’s hardest lesson.
Samsung’s 190 GB: Lapsus$ and Source-Code Extortion
One contractor’s credentials, 190 GB of Galaxy bootloader and biometrics code, and the pure steal-and-dump model that outlived encryption ransomware.
- Go to the previous page
- 1
- …
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- …
- 14
- Go to the next page