A Traefik Shortcut Could Let a Stranger Inherit Your Login
A specific Traefik HTTP/3 and NTLM configuration could let one client reuse a backend connection authenticated as someone else. Fixed releases and a public test are available.
Identity security
An Impostor Used a Real Government Email to Get Revolut’s Customer Records
A fraudulent request from a genuine government email domain persuaded Revolut to disclose sensitive customer records. The failure was in verifying who had authority to ask.
Root on One Kubernetes Node Could Become Every Workload on It
Cryptographic workload identities cannot prove which process asked for them if an attacker controls the node making that claim. Unit 42 demonstrated the risk in SPIFFE/SPIRE.
One Police Login on a Personal Device Was Enough to Breach Florida’s DMV
Florida identified one compromised police login, improperly stored on an employee's personal device, as the route into its systems. The claimed scale of exposure remains unconfirmed.
One Contractor Session Exposed Data Tied to 4.1 Million People
One compromised contractor session opened cloud applications, patient systems and external health-record portals. HHS says the AdaptHealth breach affected 4,115,802 people.
The Vendor Credentials Opened One API. Patient Social Security Numbers Left Through It.
The attacker did not need broad network access. Veradigm says credentials stolen from a third-party vendor were enough to copy patient data through one customer-service API.
The Helpdesk Asked You to Upgrade Your Passkey. Then the Quiet Download Began.
The passkey was only the pretext. Microsoft says attackers are calling personal phones, capturing cloud sessions and quietly collecting files and email for hours or days.
The Phishing Site Was Never Online. It Was Built Inside Your Browser.
The attacker did not need to host a conventional phishing page. Microsoft redirects, a blob URL and a service worker assembled the fake login inside the victim’s browser.
One User Was Enough: Two Law-Firm Breaches Exposed Client Files, SSNs and Health Data
Separate social-engineering breaches at Quinn Emanuel and McDermott show how one compromised identity can expose exceptionally sensitive legal records.
Hasbro Shut Down the Account. The Identity Data Was Already Gone.
Hasbro says a compromised employee account exposed personal and financial information. Massachusetts records identify 436 affected residents, while the worldwide total remains undisclosed.