Execution moved from install to import. The flag everyone added after the last campaign is still set, and no longer covers anything.
A missing authentication check on a table query endpoint. One defect, and a different blast radius inside every tenant.
Exploitation is arriving before organisations can deploy. Patching in twenty days is worth less than surviving a compromised appliance.
1,596 disclosed, 97 patched. Discovery is now a capital expenditure; fixing is still one person in their own time.
Check-in, boarding and baggage degraded across four capitals through one shared platform. Manual fallback is what kept it to queues.
A six-month window on a small-business lending product, in one of the most heavily monitored environments in commercial technology.
An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.
Everyone scans repositories for committed secrets. Almost nobody scans the ticket system, which accumulates the same material indefinitely.
A state capital did not have the capacity to respond without help. For a city, the failure to invest was not a choice against an alternative.
Per-capita recovery falls as the class grows. The largest incidents in this database have the weakest claim on the mechanism.
The factor held. Being known to use it became the attack surface.
The portal checked that the caller was a partner. It never checked whose records they could see.
Every record was already public. The endpoint added the one thing that was not: confirmation.
No vendor to patch and no version to check. Every implementation had to fix it separately.
An interface that answers yes or no about a person is a service for whoever asks it a few million times.
Reset exists to let a user in without the credential. That makes it an alternative route to everything.
The alert fired in ten minutes. The device stayed on the network for 58 hours.
Six weeks to notice, one day to fix. Time to fix is almost never the constraint.
There was no exploit. The endpoint answered anyone who asked, because nothing asked who was calling.
For a pseudonymous account, a phone number is not contact data. It is the link to the person.
A remedy that fitted the harm and could not reach the party holding it.