45
45
45
Security Incident – BGP Hijacking
Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.
Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.
57
45
45
45
45
45
45
45
45
45
45
45
45
45
Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
Attackers stole a METR API key via an exposed agent-run EC2 instance and consumed about $600,000 in public model credits over three weeks.
AI evaluation nonprofit METR disclosed two incidents. In March 2026, a fail-open bug in a vibe-coded app disabled authentication on a publicly accessible EC2 instance; an attacker prompted the running agent to reveal a model provider API key, added an SSH key for persistence, and consumed roughly $600,000 in free public-model credits over three weeks without being noticed. In May 2026, attackers probed METR's public infrastructure using agents, automated vulnerability discovery, credential stuffing, OAuth token attempts, and phishing; a separately exposed read-only SQL mechanism found by a bug bounty hunter risked leaking unpublished evaluation data, but no access to non-public data was confirmed.
58
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.
METR, the AI model evaluation non-profit, disclosed two 2026 security incidents. In March, attackers found a publicly exposed EC2 instance behind a fail-open authentication bug, prompted an agent to reveal its API key, added SSH persistence, and consumed roughly $600,000 in inference credits over three weeks. In May, a likely financially motivated actor systematically probed METR's public infrastructure using agents for vulnerability discovery, credential stuffing, OAuth token grants and staff phishing, with no confirmed access to non-public data.
52
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
Mozilla revoked the Firefox and Thunderbird Linux RPM signing subkey after an unencrypted copy landed in a private repo; no unauthorized access found.
Mozilla revoked the OpenPGP signing subkey (fingerprint 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256) used for Firefox and Thunderbird Linux downloads after an unencrypted copy was committed to one of its private repositories, citing reason code 2, 'key material has been compromised.' Audit records showed no sign of unauthorized access, and a replacement subkey (827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) valid until August 5, 2028 was published. Users who verify signatures manually or install from Mozilla RPM packages may need to import the new key and remove the old one. The rotation came roughly seven months ahead of Mozilla's usual two-year subkey cycle.
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45