Fakturownia breach exposes data on Polish invoicing platform
Polish invoicing provider Fakturownia says an attacker exploited a flaw to reach servers holding account data, password hashes, bank details and tokens; 'Fingerprint' claims 6 TB.
Newsroom
Truffle: 543,699 live credentials sitting in public GitHub repos
Truffle Security scanned 224M public GitHub repos and found 543,699 credentials that still authenticated in July 2026 — including 69,041 valid Google Cloud service-account keys.
KillSec ransomware leak site seized in Operation KillSwitch
Europol's Operation KillSwitch seized KillSec's leak site and 110 TB of stolen data; a 16-year-old suspected administrator was among those detained in Spain.
Kiteworks patches max-severity RCE in Email Protection Gateway
CVE-2026-54154, scored 10.0, chains path traversal, code injection and missing auth into unauthenticated root RCE on Kiteworks Email Protection Gateway before 9.4.1.
MetaMask exits Lido validators after staking-infrastructure incident
MetaMask is pulling its Lido-operated Ethereum validators after an 'ongoing security incident' hit part of its infrastructure. It says wallets face no immediate threat.
OFAC sanctions Ploutus ATM-malware network behind $40M theft
OFAC sanctioned 10 targets in a Tren de Aragua ATM 'jackpotting' network — including Ploutus developer 'Prometheus' — after $40.73M was stolen across 1,500+ US attacks.
OpenAI disrupts model-distillation campaign extracting reasoning
OpenAI says operators copied encrypted reasoning traces and had a model decrypt them in a separate chat; it ties a core cluster to Moonshot AI but publishes no technical evidence.
Pentagon DMDC breach exposes data on 3 million people
The Defense Manpower Data Center says unauthorized users held access to a file-sharing server for nine months, exposing SSNs and military records on more than 3 million people.
WordPress 'SC' malware self-heals via eight footholds, blockchain C2
Sucuri details 'SC,' a WordPress backdoor that rebuilds itself from eight files plus a DB drop-in and shared memory, and reads C2 instructions from Ethereum smart contracts.