CCyber Knight·17h agoThe Bank Watchdog Got Hacked: A Fake Regulator Account Breached South Korea's Financial Security InstituteThe institute that grades every bank's security lost more than 130 files to an account that shouldn't have existed.4 min read·nulltrace.hashnode.dev
CCyber Knight·1d agoThe Password Was Inside the App You DownloadedWyndham's Android app carried the keys to its own customer database — and the company can't say whether anyone else used them first.5 min read·nulltrace.hashnode.dev1D
4404 Founders·2d agoWorkOS Breach: An AI Pentest Agent, a Dev Credential and Five Quiet DaysA researcher's ARTEX agent left its lab, found an exposed API that accepted a dev credential and pulled customer records in bulk.11 min read·404-founders.com
CCyber Knight·4d agoYour Crypto Was Safe. Your Identity Wasn't.Gnosis Pay lost no funds in its November breach — and that is exactly why the story matters.5 min read·nulltrace.hashnode.dev1D
DDamiano Bianda·5d agoThe Chainalysis Breach: From "No Credentials Accessed" to "All Users Exposed" in Five DaysChainalysis said no credentials were touched. Five days later: password hashes and live tokens for all users. The timeline and the lesson.6 min read·damianobianda.hashnode.dev
CCyber Knight·5d agoThe Doors Are Open. The Books Can't Leave.Ransomware hit New York's Queens Public Library this week — 66 branches open, every system dark. The ransom was never the point.5 min read·nulltrace.hashnode.dev
CCyber Knight·6d agoThey Were Inside DreamHost Since August. The Passwords Were the Least of ItA web host found an intruder in its file manager on October 23 — three months after the break-in began. What the attacker took wasn't just passwords. It was the sessions themselves.5 min read·nulltrace.hashnode.dev
CCyber Knight·Nov 4The Attacker Didn't Break Into Production. It Walked In Through DevelopmentChainstack's breach started in a dev environment, reached production five days later, and stayed quiet — until the company said the honest thing about its customers' keys.4 min read·nulltrace.hashnode.dev
CCyber Knight·Nov 3The AI Agent Didn't Break the Product. It Walked Into the Sales Tool.WorkOS builds the login layer for thousands of companies. The breach it disclosed on 2 November didn't touch that product — it reached an internal sales app instead, and what that app held is exactly what makes the next phishing email believable.5 min read·nulltrace.hashnode.dev
KKazem Mortazavi·Oct 29Dark Web Monitoring: Finding a Data Leak Before the Extortion Email DoesMost organizations reassure themselves with one sentence: "we have not been hacked." But that sentence only describes what happens inside the network. Dark web monitoring answers a different question:3 min read·securityland.hashnode.dev
