543,699 working keys are sitting in public GitHub repos. Half of them are the kind GitHub’s alarm never checks. Truffle Security crawled 224 million public GitHub repositories and 58 billion files. The count that came back: 543,699 credentials still live and working as of July 2026. Not leaked-and-burned. Not revoked. Live. The median one had…
A nonprofit that hunts other people’s vulnerabilities got breached, and the intruder wrote its own next step The Dutch Institute for Vulnerability Disclosure (DIVD) runs on volunteers. They scan the internet for exposed systems, find the owners, and tell them how to fix things. Seven years without a serious incident. Then late last week the…
Bitget reopened Bitcoin withdrawals after North Korean-linked attackers drained $387.5 million from its wallets last week. The breach never touched a private key. It went through the exchange’s own authorization pipeline. The exchange paused all withdrawals on Thursday, September 24, after monitoring flagged unauthorized transfers leaving a small number of wallets. CEO Gracy Chen said…
Before the CVE numbers existed, the phone calls started. That tells you more about the Citrix NetScaler situation than either severity score does. Citrix confirmed on September 27 that two NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, are being exploited in the wild as zero-days. Both score 9.5. Both allow remote code execution on unauthenticated, internet-facing appliances….
The patch you skipped, and the WAF rule that never held ShinyHunters, the extortion gang that has made a business of breaching organizations running unpatched enterprise software, found a way through a web application firewall that many security teams believed was holding. The trick costs the attackers nothing: one character in the URL, changed from…
A secure file-sharing vendor just told every customer, everywhere, to power down at the same moment. Six hours, globally synchronized, on a Saturday morning. That is not maintenance. Kiteworks, the secure file-transfer and communications platform used by government organizations, banks, and enterprises, emailed customers this week with advice you essentially never see: shut your servers…
An open Docker socket used to be a server breach. Now it also comes with a robot. ThreatDown disclosed Carbonato on 24 September, a botnet that spreads by finding Docker hosts with the daemon API exposed on port 2375, no password, no TLS. The exposed port itself is old news; that same misconfiguration has been…
An unauthenticated remote-code-execution bug in F5’s BIG-IP Access Policy Manager is being exploited in the wild right now, and the trigger is a configuration most security teams never treated as an attack surface: OAuth. F5 published an advisory this week for CVE-2026-94127, a critical flaw scoring 9.8 on the CVSS scale. The company confirmed that…
A Chinese-linked hacking group has compromised almost 1,000 ZyXEL office switches across 48 countries. The number that should worry African IT teams is 564. That is how many of the breached devices were still running factory default credentials. On Monday, threat intelligence firm GreyNoise published observations of a Chinese-speaking, state-affiliated actor exploiting CVE-2026-7273, a stack-based…
The flaw A pre-authenticated remote code execution chain in WordPress Core now has full technical details and a working proof-of-concept in public. It goes by “Click2Shell,” and BleepingComputer wrote it up on September 21. The good news is that it’s already fixed, in version 7.1.1. The bad news is that most of the internet’s WordPress…