30
30
30
30
30
30
45
30
Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works
Hackers stole a Flock Safety camera, copied its storage, and recovered an encryption key exposing vehicle surveillance data and system internals.
Hackers from the collective stegan0gram removed a Flock Safety license plate reader from a roadway, copied its storage, and recovered an encryption key stored in an unencrypted partition, unlocking videos of thousands of vehicle detections. The data, shared with 404 Media, WIRED, and Distributed Denial of Secrets, shows the camera generated roughly 1.6 million images of about 50,200 vehicles over 21 days and detects people, bicycles, and bumper stickers in addition to license plates. The dump follows 2025 research by Jon 'GainSec' Gaines documenting flaws enabling root access, which Flock downplayed. Flock's national network makes camera records searchable by more than 2,000 agencies, fueling controversy over police and immigration lookups.
60
50,000 Stripe Secrets Leaked in Public Code
Over 50,000 Stripe merchant API keys leaked via public code and logs; 659 merchant accounts' data offered on trading forum.
Ransomnews researchers identified over 50,000 unique Stripe merchant API keys exposed in public GitHub repositories, GitHub Actions logs, and misconfigured web servers. A dataset on a data-trading forum dated August 18, 2026 contained live keys for 659 merchant accounts plus roughly 35 GB of customer and payment data. Researchers demonstrated a leaked key enabled accessing customer lists, creating fraudulent payment links, and making test charges within 17 hours. Stripe itself was not compromised; over 3,000 misconfigured web servers revealed Stripe-related strings, with about 12% containing working keys.
60
30
30
30
30
30
30
30
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
Unauthenticated attackers can forge Apache ZooKeeper operational log lines via newline injection in crafted ensemble authentication requests.
CVE-2026-84501 (moderate severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The forged entries could mislead operators or corrupt log-based monitoring and forensics.
30
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
Apache ZooKeeper audit logs are vulnerable to arbitrary field injection by unauthenticated attackers via tab characters in digest auth requests.
CVE-2026-84439 (important severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6 when audit logging is enabled (zookeeper.audit.enable=true). An unauthenticated attacker can inject arbitrary fields into the audit log by sending a digest authentication request with embedded tab characters, undermining audit trail integrity and potentially enabling log-analysis evasion or spoofing.
35
CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output
Apache Syncope's CVE-2026-87779 exposes AES secret keys in log output when keys use non-standard lengths, rated important.
CVE-2026-87779 is an important-severity insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16, 24 or 32 bytes) is used, the secret key can be disclosed via log output. Affected versions are syncope-core-spring 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, and 4.1.0-M0 through 4.1.2.
28
North Korea-linked Hackers Hide a Backdoor Inside HAProxy
Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.
Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.
60
LG smart TVs caught logging audio with screen off and snooping on local devices
Gamers Nexus found LG smart TVs record microphone audio in standby, scan home networks, and feed LG Ad Solutions ad targeting.
A 135-minute Gamers Nexus investigation with Level1Techs and independent researchers found retail LG OLED TVs running webOS sweep local networks, gather device names and Wi-Fi metadata, and run Automated Content Recognition. Tests showed the TVs capture clean microphone audio while appearing powered down and store it offline, uploading once reconnected. The team also found RCE vulnerabilities in webOS now moving through responsible disclosure; LG claims 216 million smart TV sales, and its ad unit claims access to 363 million addressable devices in the US.
40
30
30
30
30
35
30
30
30
30
30
30
CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Apache Storm Nimbus and Client expose ZooKeeper topology credentials to read-only users and logs, fixed in 3.1.0.
CVE-2026-82434 affects Apache Storm Nimbus (storm-server) and Storm Client (storm-client) versions 3.0.0 before 3.1.0. When ZooKeeper authentication is configured, Storm retains storm.zookeeper.topology.auth.payload in the topology configuration because workers need it, but Nimbus serves that configuration verbatim to callers holding only read-only access. The credential also leaks into logs.
38
30
30
30
30
30
45