Coinbase said that an incident at analytics vendor Amplitude exposed some customers’ contact data, but it found no evidence of unauthorized access to its own systems. Some Coinbase customers’ contact information was exposed in a security incident at analytics vendor…
As part of their overall risk management efforts, many South African organisations commission a penetration test just once a year. They receive a report, close the high-severity findings and file the document for the auditors. Then, for the next 11 months,…
Security researchers at Enclave have detailed a flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097. It let an app with zero permissions pose as an installed Microsoft app, such as Teams, and collect that app’s work-account tokens. Microsoft’s September…
CVE-2026-116685: Cross-Origin Redirect Credential and Request Payload Disclosure in MCP Python SDK Vulnerability ID: CVE-2026-116685 CVSS Score: 5.9 Published: 2026-10-27 CVE-2026-116685 (GHSA-5h93-6whr-6q8j) is a sensitive information disclosure vulnerability in the official Model Context Protocol (MCP) Python SDK (mcp on PyPI). In versions 1.8.0 through…
To help Internet users pick passwords that haven't already fallen into the hands of hackers, the founder of the website HaveIBeenPwned.com has published an impressive list of more than 300 million names and character strings that have been stolen in…
An OTP proves you can read a code sent to you. A passkey proves you hold a key made for this one website, unlocked by your fingerprint or screen lock. That difference is why passkeys are replacing codes for sign-in.
If you inherit a WordPress site, the login URL is often already renamed and the administrator list is often still untouched. The rename takes five minutes and looks like progress in a screenshot. Auditing who can install a plugin takes…
NIST published the final version of Interagency Report 8587, "Protecting Tokens and Assertions from Forgery, Theft, and Misuse", on 15 September 2026, produced jointly with CISA and written for federal agencies and the cloud providers that serve them. It is a dense document…
Object storage holds the copies. Backups, data lake exports, model artefacts, log archives: the set of things an organisation would most want an intruder not to read, gathered behind one API. ZoomEye measurements collected on 28 October 2026 show 261,785 assets matching app…
Scammers are exploiting Google Calendar's default settings to bypass email spam filters and insert fake invitations directly into users' schedules, making the events appear more trustworthy. By Sarah Morland Oct 27 (Reuters) - El Salvador has sent about 1,000 troops to Haiti after…
Second factors and their bypasses.
An article joins this feed when it matches these terms. Each one is also a search of its own.