Do Son Telegram confirms a January 2026 flaw where clicking "proxy links" can leak your real IP. A new warning prompt is coming to protect Android & iOS users.
Data Leak
Malwarebytes warns of 17.5M Instagram accounts leaked by "Solonik." Meta denies a system breach but fixed a bug used to spam password reset emails.
Cloudflare debunks claims that Venezuela's CANTV BGP leak was a US military op, attributing the incident to chronic technical errors and misconfigurations.
A massive leak of PS5 BootROM keys has exposed Sony’s hardware trust root. This unpatchable flaw clears the path for permanent jailbreaks and custom firmware.
Anna’s Archive claims it mirrored Spotify’s catalog into a 300TB torrent trove, prompting an investigation into DRM bypass, piracy, and copyright risks.
Security firm KOI warns: Urban VPN extensions are secretly harvesting full AI chat transcripts for data brokers. Uninstall immediately to protect your data.
E-commerce giant Coupang confirmed a breach exposing 33.7 million users (names, emails, addresses)—nearly its entire base. Financial data was not compromised, but social engineering risk is high.
India mandates the preinstallation of the Sanchar Saathi cybercrime app on all new smartphones. The app is non-removable, raising major privacy concerns for Android and Apple users.
OpenAI reveals a data breach at analytics vendor Mixpanel exposed API user emails and IDs. OpenAI has terminated the partnership. Watch out for phishing.
A massive leak exposes Iran's Department 40 (APT35). Discover how IRGC hackers build target packages for assassination squads and drone strikes.
Salesforce revoked all Gainsight app tokens and removed the app from the AppExchange after finding unusual activity that may have exposed customer data via the connection.
LayerX exposed a 6-year, 9M-install campaign: Fake VPN/ad-blocking Chrome extensions hijack all user traffic via remote PAC proxy scripts, enabling surveillance and data exfiltration.
Fired Intel engineer Jinfeng Luo allegedly bypassed security to steal 18,000 confidential files before his final day. Intel is suing, but his whereabouts are unknown.
Apple issued a DMCA takedown to GitHub, forcing the deletion of over 8,270 repositories and forks containing the leaked App Store web front-end source code.
Apple failed to disable SourceMap in its new App Store web version, inadvertently leaking the entire Svelte/TypeScript front-end codebase to the public.
Starting Nov 3, all new Firefox extensions must explicitly declare whether they collect user data. By mid-2026, this disclosure will be mandatory for all add-ons.
Google denies claims of a mass Gmail breach, clarifying that a new HIBP dump of 183M credentials stems from third-party infostealer malware, not a platform hack.
Wiz found 550+ secrets (PATs, API keys) leaked in 500+ VSCode extensions, enabling an attacker to push malicious updates to 100K+ developers. Dotfiles were the main culprit.
F5 disclosed a breach by a "highly sophisticated nation-state" that stole BIG-IP source code and internal vuln info. CISA issued an Emergency Directive mandating immediate patching of 44 flaws.
Trend Micro discovered that Axis Communications leaked hardcoded Azure SAS tokens in a signed DLL for its Autodesk Revit plugin, exposing three cloud storage accounts to unauthorized access.
The "Trinity of Chaos" alliance (Lapsus$, Scattered Spider, ShinyHunters) launched a DLS, listing 39 firms, including Google and Cisco, and claiming 1.5 billion stolen records.
Red Hat confirmed a breach of its consulting arm's GitLab instance. Hackers stole 570 GB of data, including Customer Engagement Reports that detail client network infrastructure.