Pharo browser Git traffic can pass through a CORS proxy
Iceberg and Metacello requests, including push tokens, are visible to the proxy the user selects.
Stories per day · 30 days
9 RSS
Relatedai-agents13github6data-breach5password-manager4banking3claude3cloud3infostealer3supply-chain3webhooks31password2anthropic2aoki2claude-code2cursor2data-exposure2data-loss2india2
85 stories, newest first · one card per story
Stories tagged #credentials
Claude Code permission file exposes secrets in 1,122 public GitHub copies
Apiiro found 1,379 secrets, including database passwords and AWS keys; one notified company confirmed a live key.
4
Datadog says high and critical cloud flaws quadrupled since May
Among monitored workloads, the median count rose from four in May to 16 in November, Datadog claims.
1
Researcher finds serious flaws in public UK government code
A Planning Inspectorate GitHub commit left Microsoft Entra ID credentials that could have reached SharePoint, OneDrive and legal-hold files.
1
GhostAction Targets GitHub Repositories for Credentials
Malicious workflows in 30,000+ GitHub repositories steal AWS, AI, and other keys by scanning commit history.
2
Chainalysis says breach exposed every customer's credentials and tokens
The login portal, Reactor, KYT, and address screening are offline; users must reset passwords and rotate API keys.
1
mSecure urges password and passkey resets after suspicious activity
mSeven has not said whether vaults were accessed, how many customers are affected, or what occurred.
mSecure tells users to reset passwords and will not say why
A November 3 customer email recommends password, 2FA, and passkey changes but names no exposed data.
1
SailPoint argues identity governance needs executive oversight
The piece says AI agents and other nonhuman identities should get the same access controls as people.
AO3 stays down after security incident; data theft not ruled out
Works were not deleted; the outage may last two to four weeks, and reused passwords should be changed elsewhere.
Ransomnews counts 484,142 listable cloud buckets holding 18 billion files
An October 7 snapshot found 321,058 credential and key files without opening any objects, and the authors say many buckets are public on purpose.
2
US banks block AI agents logged into customer accounts
Customers have shared bank usernames and passwords with agents, and several banks are steering tools toward read-only access.
Sony So-net breach exposes 2.58 million customer records
Passwords for 54,401 email addresses and 16 bank account records were exposed; membership passwords and cards were not.
Bank of America tells customers not to share passwords with AI assistants
The bank says customers remain liable for activity that follows from giving an AI agent their login.
2
Arrakis says dormant AI agents keep access to company systems
In a 12-week review, 76% of enabled agents had not run in 60 days and 22.9% had an unsecured trigger.
1
1Password launches agent sign-in that hides user passwords
Users confirm each attempt, and 1Password fills credentials so named agents never receive the password.
US banks report unauthorized AI agents in customer accounts
Access reportedly begins when customers share banking passwords with assistants, and Axios described no confirmed widespread theft.
1Password lets AI agents sign in without seeing passwords
Users approve each request on their device, and 1Password fills the login instead of handing credentials to the agent.
RUGGEDCOM APE1808 inherits Nozomi Guardian and CMC flaws
All listed APE1808 versions are affected; the highest detailed score is 7.5 for unvalidated Smart Polling connections.
Arrakis says 76% of AI agents are dormant but still credentialed
In Arrakis customer telemetry, 24% of dormant agents can be started by an unsigned external webhook.
1
Essay says credential risk spans code, endpoints, vaults and AI
It argues one exposed secret can recur across laptops, pipelines, chat, Git history, and agent context.
1
Stolen credentials used to access PingCAP systems and source code
Access ran from September 9 to October 7; customer-specific impact and credential usability remain under investigation.
Zeabur to shut down after second breach exposes 321,810 accounts
Attackers used leaked plaintext internal credentials to read the production database and access shared clusters in nine regions.
1
OpenCode Hacked: User credentials leaked
OpenCode was hacked and user credentials were leaked, according to a Hacker News post.