Bitget’s $388 Million Breach Now Points to a Third-Party Security Product
Bitget says its $388 million breach may have begun in a third-party security product, exposing credentials used to send fraudulent withdrawal commands.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
One Browser Extension Can Secretly Command Five AI Assistants
The extension did not need to persuade the model. It impersonated the channel the browser’s privileged assistant was built to trust.
The Form Submission Was Data Until Drupal Executed It
The dangerous path begins with ordinary submitted data and ends when a vulnerable custom format renders it as template code.
One Request Could Make Adobe AEM Forms Run Code Without a Login
The bulletin contains six separate vulnerabilities. The most urgent crosses the authorization boundary before an attacker has any account.
The Fake TV App That Can Watch Your Screen, Steal Your PIN and Stop You Removing It
A fake TV app can cut Google Play Protect off from the network, watch a victim’s screen, steal banking PINs and resist removal.
Attackers Are Trying to Turn a WordPress Template Bug Into Code Execution
WordPress fixed a conditional code-execution path on 22 September. Within hours, attackers were trying to turn the flaw into PHP file writes.
The FBI Confirms Its Jobs Portal Was Compromised but Not What Was Taken
The compromise is confirmed. The route in and the alleged theft of employee data are not. The distinction matters because recruitment systems hold unusually revealing records.
Attackers Are Exploiting the System That Manages the Rest of Your Network
A compromised orchestrator is not just another vulnerable server. It is the trusted control point for the edge devices around it.
EvilTokens Compromised 12,000 Inboxes and Let AI Choose the Next Victim
The AI did more than write convincing phishing messages. It read stolen mailboxes, mapped trust and told criminals which relationships were most valuable to abuse.
One OAuth Profile Can Turn BIG-IP APM Into a Remote Code Execution Target
F5 says attackers are already exploiting a critical BIG-IP APM flaw. The first job is not simply to patch, but to preserve evidence and find out whether the gateway has already been touched.