30
Search: “General Services Administration”
222 stories
HackerOne and Singapore Government tapping the skilled hacker community to approach security testing
30
45
Hackers Got Inside a Flock Camera. Its Data Shows How the System Really Works
Hackers stole a Flock Safety camera, copied its storage, and recovered an encryption key exposing vehicle surveillance data and system internals.
Hackers from the collective stegan0gram removed a Flock Safety license plate reader from a roadway, copied its storage, and recovered an encryption key stored in an unencrypted partition, unlocking videos of thousands of vehicle detections. The data, shared with 404 Media, WIRED, and Distributed Denial of Secrets, shows the camera generated roughly 1.6 million images of about 50,200 vehicles over 21 days and detects people, bicycles, and bumper stickers in addition to license plates. The dump follows 2025 research by Jon 'GainSec' Gaines documenting flaws enabling root access, which Flock downplayed. Flock's national network makes camera records searchable by more than 2,000 agencies, fueling controversy over police and immigration lookups.
60
30
30
30
30
30
45
45
30
30
30
30
30
30
30
30
30
30
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.
GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.
55
30
30
50
30
VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability
ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.
CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.
32
30
35
30
30
30
30
30
35
45
30
30
30
30