Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 4 items in Data exposure. Show all 52 items

October 2026

1 item

  • Data exposure

    DigiCert discloses unauthorised access to internal archive exposed by migration

    DigiCert disclosed in a preliminary incident report on Mozilla's Bugzilla, filed on 20 October 2026, unauthorised access to an internal business system that stores information customer representatives provide to validate their identity. Its full report, posted on 1 November, says a February 2025 infrastructure migration moved the system from a VPN-restricted segment to an externally accessible availability zone, where an account self-registration feature let accounts be created without MFA and read archived data. DigiCert says the data access window ran from 27 June to 2 July 2026, that most of the data was business contact information while a small minority of customer accounts included a document such as a driver's licence, passport or utility bill, and that no certificates were issued, modified or revoked. The Register reported that DigiCert has not disclosed how many customers or individuals were affected.

    • Database security audit
    • Cloud configuration review
    • Network & infrastructure testing

March 2026

1 item

  • Data exposure

    Salesforce warns of mass scanning of Experience Cloud sites with open guest access

    On 7 March 2026 Salesforce warned that a known threat actor group was using a modified version of Aura Inspector, an open-source tool originally developed by Mandiant, to mass-scan public-facing Experience Cloud sites and extract data where guest user profiles had been given access to objects and fields not intended to be public. Salesforce said the activity 'relates to a customer-configured guest user setting, not a platform security flaw.' ShinyHunters claimed responsibility and told The Register it had stolen data from almost 400 websites and about 100 high-profile companies; a Salesforce spokesperson declined to say how many customers were affected or whether ShinyHunters was behind the access.

    • Cloud configuration review
    • Application security audit
    • Database security audit

January 2026

2 items

  • Data exposure

    Misconfigured Supabase backend exposed Moltbook agent tokens, emails and messages

    Moltbook, a social network for AI agents, exposed its production Supabase database to anyone holding the public API key embedded in its client-side JavaScript, because Row Level Security policies were missing. 404 Media first reported the exposure on 31 January 2026, saying it let anyone take control of any AI agent on the site. Wiz, which found the issue independently and published its findings on 2 February, said the misconfiguration allowed full read and write access and exposed 1.5 million API authentication tokens, 35,000 email addresses and private messages between agents, some containing plaintext OpenAI API keys. Wiz said Moltbook secured the database within hours of its report, over several rounds of fixes.

    • Database security audit
    • Web application testing
    • Application security audit
  • Data exposure

    Flare: 1,416 of 3,100 fully exposed MongoDB servers found wiped with ransom notes

    Cybersecurity company Flare reported on 26 January 2026 that its analysis found more than 200,000 publicly discoverable servers running MongoDB, of which slightly over 100,000 disclosed operational information and 3,100 were fully exposed without access restrictions. Of those 3,100, Flare said 1,416 (45.6%) had already been compromised, with their databases wiped and replaced by a ransom note; in nearly all cases the demand was approximately $500 in Bitcoin. BleepingComputer reported the findings on 1 February 2026, quoting Flare's warning that 'there is no guarantee the attackers have the data, or will provide a working decryption key if paid.'

    • Database security audit
    • Network & infrastructure testing
    • Cloud configuration review

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works