#credentials
- News · Nov 4, 2026Apache OFBiz 24.09.08 fixes a hard-coded JWT key, a password reset takeover and default-open REST auth
Apache OFBiz 24.09.08, announced November 4, fixes a batch of authentication flaws: a hard-coded JWT key giving unauthenticated admin access, a password reset flaw allowing account takeover, a reusable login key not bound to a session and REST operations open by default.
- News · Nov 4, 2026DreamHost says File Manager attacker took FTP passwords and webmail sessions for about ten weeks
DreamHost's breach notice, filed with California's attorney general, says an attacker who exploited its web File Manager captured the FTP/SFTP credentials of everyone who logged in from about August to October 23, 2026, and may have exposed webmail session data, emails and files.
- News · Nov 3, 2026Chainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached production on October 29 and accessed customer names, emails and password hashes before being cut off on October 31.
- News · Nov 3, 2026Password manager mSecure tells users to change passwords and remove passkeys, without saying what happened
mSecure's developer emailed current and former customers on November 3 about suspicious activity linked to the password manager, advising them to change passwords, reset two-factor authentication and possibly remove passkeys. It has not said what happened or whether vault data was exposed.
- News · Oct 29, 2026Malicious Claude Code extension on Cursor's marketplace planted an attacker SSH key on developer machines
Cursor said on October 29 that tampered versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were on its marketplace for about 11 hours. They tried to add an attacker SSH key named svc-telemetry, enable SSH and open a reverse tunnel.
- News · Oct 28, 202626,400 working cloud and AI credentials found in public Gitee repositories
A researcher scanned 7.25 million public repositories on Gitee, China's largest Git platform, and found 26,400 unique credentials that still worked, led by Alibaba Cloud access keys. One was an active organization-admin credential for a major enterprise AI platform.
- News · Oct 27, 2026Bank of America tells customers not to give AI agents their banking password
Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to act on their behalf, and reminded them they are responsible for activity from shared credentials. A spokesperson confirmed the email to TechCrunch on October 27.
- News · Oct 27, 2026Sony's So-net says an intruder took 2.6 million member records and 54,401 email passwords
Sony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala records plus 54,401 email addresses with their passwords. It reset those mail passwords the same day.