Over 16,000 Supabase Databases Exposed Due to Misconfiguration
September 29, 2026
Security researchers found more than 16,000 misconfigured Supabase databases with publicly readable tables exposing PII, passwords, and tokens.
Data Security
Over 16,000 Supabase Databases Exposed Due to Misconfiguration
Security researchers found more than 16,000 misconfigured Supabase databases with publicly readable tables exposing PII, passwords, and tokens.
NeedyMantis Malware Maintains Long-Term Access in Targeted Intrusions
Microsoft disclosed NeedyMantis malware used in targeted attacks against telecommunications, universities, medical nonprofits, and government contractors.
Bitget Attributes $388M Theft to Third-Party Security Product Flaw
Bitget disclosed that attackers exploited a third-party security product vulnerability to steal $388 million on September 24. North Korean actors suspected.
Infostealer Logs Expose AI Credentials from 80,000+ Organizations
Stolen infostealer data exposed AI service credentials from over 80,000 corporate domains, enabling account takeover and LLMjacking attacks.
Former US Soldier Gets 70 Months for Hacking AT&T and Verizon
Cameron John Wagenius sentenced to 70 months in prison for hacking 10 U.S. technology and telecommunications companies while on active duty.
Carbonato Botnet Hijacks Docker Hosts to Deploy Telegram-Controlled AI
Carbonato malware installs Hermes Agent AI framework on exposed Docker daemons, then controls the agent via Telegram with a modified 39-line prompt.
DC Health Agency Exposes 400,000 Medicaid Beneficiary Records Online
Washington D.C. Department of Health Care Finance exposed approximately 400,000 Medicaid beneficiary records through a misconfigured web portal accessible without authentication.
Suspected North Korean Hackers Steal $351.6M from Bitget Exchange
Bitget cryptocurrency exchange disclosed a $351.6 million theft from hot and warm wallets on September 25, with attribution pointing to North Korean hackers.
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in May.
Cloudflare Containers Flaw Exposed Leftover Customer Disk Data
Cloudflare disclosed a vulnerability allowing customers to read leftover disk data from other customers' previous containers, violating tenant isolation controls.
NeedyMantis Malware Maintains Long-Term Access in Targeted Intrusions
September 29, 2026
Microsoft disclosed NeedyMantis malware used in targeted attacks against telecommunications, universities, medical nonprofits, and government contractors.
Bitget Attributes $388M Theft to Third-Party Security Product Flaw
September 29, 2026
Bitget disclosed that attackers exploited a third-party security product vulnerability to steal $388 million on September 24. North Korean actors
Infostealer Logs Expose AI Credentials from 80,000+ Organizations
September 29, 2026
Stolen infostealer data exposed AI service credentials from over 80,000 corporate domains, enabling account takeover and LLMjacking attacks.
Former US Soldier Gets 70 Months for Hacking AT&T and Verizon
September 29, 2026
Cameron John Wagenius sentenced to 70 months in prison for hacking 10 U.S. technology and telecommunications companies while on active
Carbonato Botnet Hijacks Docker Hosts to Deploy Telegram-Controlled AI
September 29, 2026
Carbonato malware installs Hermes Agent AI framework on exposed Docker daemons, then controls the agent via Telegram with a modified
DC Health Agency Exposes 400,000 Medicaid Beneficiary Records Online
September 29, 2026
Washington D.C. Department of Health Care Finance exposed approximately 400,000 Medicaid beneficiary records through a misconfigured web portal accessible without
Suspected North Korean Hackers Steal $351.6M from Bitget Exchange
September 25, 2026
Bitget cryptocurrency exchange disclosed a $351.6 million theft from hot and warm wallets on September 25, with attribution pointing to
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
September 25, 2026
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in
Cloudflare Containers Flaw Exposed Leftover Customer Disk Data
September 25, 2026
Cloudflare disclosed a vulnerability allowing customers to read leftover disk data from other customers’ previous containers, violating tenant isolation controls.
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.