Fireworks AI Breach Exposes Billing Data and Model Weights
Fireworks, the AI startup behind a popular model hosting platform, has disclosed its second breach in under a month. Attackers came in sideways this time. They first hit a third-party cloud provider, then used that access to reach the company’s own build machines. The Fireworks AI breach confirmed on Monday exposed billing records, account metadata and partial model weights, though
Chainalysis Data Breach Exposed Every User’s Credentials
Blockchain forensics firms trace stolen crypto for police forces, banks and exchanges. Chainalysis is the biggest of them. So the Chainalysis data breach disclosed in late October landed awkwardly, because the firm that traces money for everyone else spent a week chasing an intruder through its own network. Its first notice, published on 30 October, sounded contained. Five days later
OpenSSH Vulnerability Opens Locked Alpine Linux Accounts
A single asterisk in /etc/shadow tells Linux that an account takes no password at all. For about a decade, on one branch of the Linux family, it told attackers something very different. Researchers disclosed an OpenSSH vulnerability on November 5 that opens locked accounts to anyone typing a password longer than 256 bytes. No key, no credential and no prior
DreamHost Data Breach: Two Months of Stolen FTP Logins
Web hosting sits underneath everything a website does, so trouble at that layer spreads fast. An intruder spent roughly two months inside the server running DreamHost’s browser-based File Manager. The DreamHost data breach handed that attacker the FTP and SFTP logins of every customer who used the tool, along with webmail session data for a smaller group. With 400,000 paying
WorkOS Data Breach: AI Framework Hit Internal Sales App
Sales tools rarely get the same security attention as production systems, and attackers have worked that out. In late October, an intruder reached an internal app at developer infrastructure company WorkOS and pulled out CRM records plus summaries of customer calls. The WorkOS data breach spared production services. It still handed the attacker the kind of material that makes a
Chainalysis Data Breach Blamed on AI Attack Agents
Blockchain analytics sits at the heart of modern financial work, so a break-in at a top vendor matters. Chainalysis has now confirmed a data breach that exposed customer names, emails and job role labels. The company blames an attacker using what it calls “offensive agentic techniques.” That phrase points straight at AI agents, and it has pulled more attention than
Android SMS of Death Flaw Leaves Older Phones Exposed
A single text message can now knock an Android phone off the mobile network before its owner sees anything arrive. Security researcher Mark Blah released working exploit code for a flaw nicknamed the Android SMS of Death, tracked as CVE-2026-58882. The attack asks nothing of its target: no tap, no link, no download. Android parses the text before it lands
Hugging Face Malware Hijacks GPU Servers Days After Takedown
Fake AI models now work as a delivery system for crypto mining code. Hugging Face malware came back within days of a takedown, under fresh accounts and new repos. One fake model pulled more than 28,000 downloads while scans kept marking it clean. This Hugging Face malware goes after the GPU server itself, so anyone running self-hosted AI on their
Discord Starts Indexing Messages: How to Opt Out Now
Millions of people treat big Discord communities as a back room, somewhere between a group chat and a forum. That comfortable assumption now has an expiry date. Discord will begin indexing messages from its biggest public servers so they turn up in Google and other search engines. The first phase starts on November 16, and more than 63,000 communities fall
Convertr Card Skimmer Stole Cards From Dozens of Brands
Shoppers at dozens of Brazilian fashion brands handed their card details to criminals this month. They clicked nothing suspicious. The Convertr card skimmer sat inside an analytics file that every store on the platform already trusted and loaded on its own payment page. From October 24, those checkouts copied card numbers, security codes and taxpayer IDs, then shipped them to
