60
42
Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data
Exposed Vietnam-linked APIS database held 220.8 million passenger and crew records with passport and flight data from January 2017 to April 2026.
Kinryū Labs discovered an exposed Elasticsearch cluster named 'pax-info' containing 220.8 million passenger and crew records, about 107 GB across 29 indices, hosted on IP space assigned to Viettel in Hanoi. The records include names, birth dates, nationalities, passport numbers, and detailed flight information from airlines across Asia-Pacific, Europe and the Middle East. Researchers reported the exposure on June 3 and the database was secured by June 8 with Singapore Airlines coordinating; no evidence of theft was found, but missing server logs mean access cannot be ruled out.
82
60
42
42
220 million traveler records exposed in Vietnam-linked APIS leak
Vietnam-linked APIS Elasticsearch leak exposed 220 million passenger and crew records with passport numbers and flight details spanning 2017 to 2026.
Kinryū Labs discovered an exposed Elasticsearch cluster named 'pax-info' holding 210,318,069 passenger records and 10,465,631 crew records (roughly 107 GB across 29 indices) hosted in Viettel-assigned IP space in Hanoi. The database, apparently operated by a Vietnamese organization, was reachable via a chain of two misconfigurations: a cloud-based path that bypassed an HTTP 401 block and acceptance of default credentials. Exposed data included names, dates of birth, nationalities, passport numbers, and detailed flight information for travelers of many nationalities from January 2017 to April 2026. Access was remediated on June 8 after Kinryū Labs notified Vietnamese authorities, airlines, and CERTs, with Singapore Airlines' security team helping coordinate the response; it remains unknown whether any data was copied by malicious actors.
90
55
60
60
60
55
57
57
60
60
Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
60
60
Microsoft SharePoint servers under attack via zero-day vulnerability (CVE-2025-53770)
60
Microsoft fixes critical wormable Windows flaw (CVE-2025-47981)
60
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
60
Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Company Servers
60
Microsoft issues emergency patches for SharePoint zero
60
U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog
60
60
60
30
60
60
60
60
60
60
30
CISA adds TP-Link, Apache, and Oracle bugs to its Known Exploited Vulnerabilities catalog
60
60
35
60
60
60