60
57
57
57
45
60
60
60
60
60
57
60
45
60
60
60
I Think the Military Commissary Freezers Were Hacked
Refrigeration failures at six-plus US military commissaries prompt speculation of a cyber attack on DeCA's remote monitoring systems; Pentagon acknowledges possible disruption.
The author documents near-simultaneous freezer and refrigeration failures at confirmed installations including Fort Huachuca, F.E. Warren AFB, Fort Irwin and Travis AFB on August 26-27, with freezers entering defrost mode that heated and spoiled food. DeCA's Remote Monitoring Control System controls defrost across roughly 182 locations, and an unverified comment attributed the Fort Huachuca failure to a network issue. Stars and Stripes and Military Times independently reported the multi-base failures, and the Pentagon acknowledged a 'possible refrigeration disruption,' though no evidence of hacking has been confirmed.
45
60
60
60
60
60
57
60
Flaws in CyberPower solutions expose data centers to hacking
60
60
60
45
60
60
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
Hunt.io found an attacker holding root access inside Thai ISP 3BB via a MeshCentral backdoor, targeting subscriber RADIUS credential databases.
Hunt.io discovered an exposed attacker server on June 3, 2026 revealing an ongoing intrusion at 3BB, one of Thailand's largest broadband providers. The attacker maintained hidden MeshCentral agents reporting to www.ayuthayatech[.]com (device group TH-3BB) and held root on internal servers. Recovered scripts sprayed passwords over SSH against more than 55 internal machines, planted web shells, added SSH keys, searched for stored credentials, and targeted RADIUS subscriber credential databases, though exfiltration was not confirmed. The toolkit included a full exploit for FortiGate SSL-VPN flaw CVE-2024-21762 against mail.3bb.co[.]th, but the initial access vector is unestablished, and a cleanup script erased logs while preserving the backdoor.
70
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
SafePal disclosed an order-tracking plug-in authorization flaw exposing names, emails, addresses and purchase details of 39,798 hardware wallet customers; no wallet credentials affected.
Hardware wallet maker SafePal disclosed that an authorization flaw in an order-tracking plug-in exposed names, email addresses, shipping addresses, phone numbers and purchase details of approximately 39,798 customers. No seed phrases, private keys, wallet credentials or financial information were exposed, and SafePal found no evidence of wallet or fund compromise. A separate configuration error left a data-cleanup process broken between September 2025 and April 2026, extending the affected order window back to March 2025. A threat actor has advertised a matching dataset on a cybercrime forum, and the company has fixed the flaw, cut data retention to 90 days, purged affected records, engaged third-party validators and taken down over 30 phishing sites.
48
SafePal Says 39,798 Customers Hit by Data Breach
Crypto wallet maker SafePal disclosed a breach exposing order data of 39,798 customers via a plugin authorization flaw; keys and seed phrases unaffected.
SafePal, a Singapore-based cryptocurrency security company, said an authorization flaw in an order-tracking plugin let attackers access order records placed between March 2, 2025 and April 11, 2026. Exposed data includes names, emails, addresses, phone numbers, and purchase details for about 39,798 customers, while seed phrases, private keys, wallet passwords, and payment data were not exposed. A threat actor advertised the same dataset on a cybercrime forum, and affected customers were notified by email on August 16. The company patched the flaw, reduced data retention to 90 days, and removed over 30 fraudulent phishing websites.
55
60
60
60
60
60
60
57