3 casos · pág. 1/1
An actor using the handle Erich claims to have breached an unnamed conference-space company with an estimated $80-100 million in annual revenue. The actor says the compromise came through a support panel and that access is still active. The post cites 24,753 tickets, 387,388 comments, 274,294 system notes, 113,094 real replies, 115,948 at…
The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…
Unit 42 investigated a months-long intrusion against a European bank, which began with unauthorized VPN-based access through a third-party-managed external gateway appliance that did not enforce strict authentication. Using compromised credentials, the attacker ran noisy, high-volume internal reconnaissance and brute-force campaigns again…
