A video call reaches the Android kernel on three Unisoc chipsets, and the vendor has not replied.
A CVSS 10.0 flaw in a reporting tool that stores the credentials for every warehouse behind it.
Rotating the stolen key is the fix. It is also what erases the proof anyone used it.
Around 32% of K-12 breaches originate at a vendor. Districts outsourced the technology and kept the accountability.
967,000 accounts at a lending platform. Underwriting assembles identity, income and obligations — including for people who were declined.
A six-month window on a small-business lending product, in one of the most heavily monitored environments in commercial technology.
Sixty institutions down through one provider. Pooling technology is what lets small member-owned banks exist, and it concentrates the risk.
Three technology estates in one company. The research attention is on the vehicles; the billion-pound losses are in enterprise IT.
A hospital carries the operational-technology problem of a utility alongside the data-protection problem of a bank.
Nokia was right that its systems were not breached. Its code was published anyway.
A private company placed monitoring code on machines it did not own, and published that it had.
Whatever does not survive a migration is removed silently, and nobody is told.
The factor held. Being known to use it became the attack surface.
The portal checked that the caller was a partner. It never checked whose records they could see.
A member looking up a condition is not browsing. The page is what reveals the worry.
Ransomware has to announce itself. Malware that only copies succeeds by staying unremarkable.
Every record was already public. The endpoint added the one thing that was not: confirmation.
No lookalike domain and no spoofed sender. The message came from a real colleague’s real account.
Reporting follows interest. The harm that is interesting gets recorded; the harm that is serious sometimes does not.
Nobody is fined for being breached. People are fined for what they said beforehand.
A HAR file does its job by capturing exactly the material an attacker needs.
No vendor to patch and no version to check. Every implementation had to fix it separately.
Nobody attacked anything. A sharing mechanism offered a wider scope than the task needed.
Once the seeds live in an account protected by the same identity, there is one factor wearing two names.
An interface that answers yes or no about a person is a service for whoever asks it a few million times.
Nobody decided to remove the isolation. It was lost while moving the servers.
The blast radius was tiny because the targeting was precise, not because the access was limited.
The only demand in this database attaching a condition unrelated to payment. Nobody repeated it.
People write to support when something has gone wrong, and they explain it.
Nobody assessing a phone-system vendor thinks to ask about its staff’s trading software.
High privilege, low attention, reachable. The vulnerable thing is rarely the one anyone would name.
Personal cloud storage is sold on one promise. For eleven days the product did not exist.
Code signing answers "did this come from the vendor". Here the answer was yes, and it was the wrong question.
A conversation title is a list of what somebody asked a machine in private.
The corporate boundary turned out to run through a domestic living room.
Costly to the refuser, costless to everyone else. The only one in the database like that.
The credential that mattered was not the password. It was the thing issued after the password.
The vaults were encrypted. Offline, with no lockout and no clock, that is a timer rather than a wall.
The stopgap became the destination. Hosted Exchange was retired rather than restored.
Cloudflare was not saved by the metal. It was saved by origin binding — and this key was not doing that.
No credential stolen, no flaw exploited. Somebody wanted to understand how patients used the portal.
The concealment ran through a control rather than around one. That is what made it work.
Blocking a URL pattern encodes the exploit you have seen, not the defect that allows it.
The second factor was not bypassed. It was delivered to the right person, who said yes.
Everything the company said in August was true. In December none of it helped.
1,900 is the exposure. Three is the objective. No notification scheme has a field for that.
Three Cloudflare employees typed their password into the attacker’s page. Nothing happened.
Duration and severity are independent axes. Only one of them gets published as a headline.
For a pseudonymous account, a phone number is not contact data. It is the link to the person.
Collected from a child, retained past the relationship, past the product, past recognition.
Ten years of telling people not to enable macros, and this one did not ask.
The browser did nothing wrong. It carried a work password into a personal account, exactly as designed.
A remedy that fitted the harm and could not reach the party holding it.
The security of a system is the security of everyone it has delegated to — a set nobody enumerates.
The encryption step was always optional. Drop it and you keep the reputational leverage for a fraction of the work.
The alert fired on day one. The customers heard on day sixty-one, from the attackers.