Click any tag below to further narrow down your results
Links
This daily roundup covers Fortinet’s FortiBleed campaign exposing 86,000 device credentials, a Texas hunting-license vendor breach affecting 3 million records, and an unpatchable BootROM exploit on Apple A12/A13 chips. It also highlights GitHub’s context-aware secret scanning, the Novo Nordisk code leak via a stolen GitHub token, and other emerging tools and vulnerabilities.
- FortiBleed exposed 86,000+ valid Fortinet credentials across 194 countries via 1.16 billion login attempts against 320,000 FortiGate devices, with hashes cracked on a 45-GPU cluster.
- A Texas hunting/fishing license vendor breach leaked driver's license and passport numbers for 3.09 million people, already being sold by a threat actor linked to a prior Virginia wildlife breach.
- The unpatchable "usbliter8" BootROM exploit affects Apple A12/A13 chips (iPhone XS to iPhone 11), installing a restart-persistent handler that downgrades security and boots unsigned code.
- GitHub's new context-aware LLM secret scanning cuts false positives by over 75% by isolating code paths where secrets feed into API calls, auth headers, or database clients.
- FulcrumSec stole a GitHub PAT to exfiltrate 1.3 TB from Novo Nordisk, including the Ozempic formula and clinical-trial data for 11,500 patients, leaking 264 GB after a refused $25 million ransom.
This daily roundup covers a 40 GB data breach at the University of Nottingham, a lost-drive incident exposing 10.9 million Japanese utility customers, and a proof-of-concept Exchange spoofing flaw. It also highlights automated AI-driven attack research, supply-chain toolkits on GitHub, and new product launches for dependency patching and taint analysis.
- ShinyHunters exploited a zero-day gadget chain in University of Nottingham's PeopleSoft to steal 40GB of data on 454,600 students, including passport numbers and disability details.
- Kyushu Electric Power lost a physical backup drive exposing personal and usage data for 10.9 million customers.
- InfoGuard's "Ghost-Sender" exploit spoofs any Exchange Online address (even CEO/noreply) via a one-line PowerShell script, bypassing SPF, DKIM, and DMARC.
- A researcher earned over $500,000 in bug bounties using an AI-driven fuzzer to scrape thousands of Google API keys and find leaky internal-only endpoints.