Railway breach may have exposed customer API keys and secrets
After an October 21 disclosure, Railway paused builds, rotated platform credentials, and told customers to rotate secrets.
Stories per day · 30 days
5 RSS
Relatedsecrets2ai-agents1api-keys1churn1cloud-abuse1cloud-backup1cloud-credentials1command-and-control1complaints1connectwise1credential-compromise1data-exposure1environment-variables1hacker-news1identity1living-off-the-cloud1microsoft-3651npm1
22 stories, newest first · one card per story
Stories tagged #saas
HackerChurn lists SaaS tools with highest HN complaints
Analysis of 3 years of Hacker News comments flags Bitwarden, Notion, and Asana for highest churn as users build their own replacements.
1
Trigger.dev says attacker accessed some customers' environment variables
The company says it blocked the exploit and emailed affected account owners mitigation steps.
1
SBOMs missed scope of a Shai-Hulud supply-chain compromise
A stale SBOM called a SaaS environment clean while a hidden transitive dependency had already run.
1
SaaSHub data shows median product lifespan down to about 1.5 years
A Hacker News poster attributes the 2026 drop to cheap, quickly abandoned software experiments.
Attackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
1
ThreatBook launches RedAgents multi-agent penetration-testing platform
The October 16 SaaS launch names Artex Pro, Cyber(YanJi), Yanxun and CyberStrikeAI Enterprise Edition, with vendor-only accuracy claims.
3
ConnectWise backup credential used to enter Microsoft 365 tenants
Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.
4
FBI Arrests Canadian Cybersecurity Executive in ShinyHunters-Linked Cybercrime Investigation
FBI arrested Canadian cybersecurity executive Edward Dubrovsky in Pennsylvania, linked to the ShinyHunters extortion investigation.
2
ASOS Breach Reveals the Risks in Customer-Facing SaaS
A breach at British retailer ASOS shows one compromised identity can reach deep into the network.
OAuth grants pile up faster than you can review them. Here's how to keep up.
Nudge Security markets an agent that inventories and scores risky SaaS OAuth grants teams cannot review manually.
Telegram Account Behind ASOS Rogue Notification Tied to Gaming Trading
ASOS says names and contact details may have been accessed after rogue customer notifications; broader hack claims remain unproven.
4
Every SaaS business will become a harness around a model
An essay argues every SaaS company will become a harness around a model and human reviewers.
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry
NordLayer argues browser-based SaaS attacks, including AiTM phishing and malicious extensions, often evade traditional EDR.
4
Query-Limited RAM Programs and their Applications
Query-limited RAM programs extend quantum one-time programs to stateful, policy-bounded computation.
The SaaSpocalypse that wasn’t, with Atlassian CEO Mike Cannon-Brookes
Atlassian CEO Mike Cannon-Brookes argues AI is increasing, not replacing, use of Jira and Trello.
Hackers Abuse Stolen BigCommerce App Key to Steal Master of Malt Customer Data
Attackers used a stolen Ribon BigCommerce app key to access Master of Malt customer contact data.
1
Identifying Security Platform Product Abuse with Machine Learning
A deployed ML defense raised security-platform abuse coverage 35% and cut monthly alerts 30%.
Show HN: Aclif – Agent CLI framework: one grammar, canonical names across SaaS
Aclif launched an agent CLI framework giving AI agents one grammar and canonical names to operate SaaS platforms like Salesforce and ServiceNow.
How AI and cybersecurity are reshaping ServiceNow
Analysis argues ServiceNow's $7.75B Armis acquisition and AI-driven consumption pricing are reshaping its ITSM platform amid SaaS market anxiety.
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
4
Lovable CTO: The Future of SaaS Is Apps That Agents Can Use
Lovable pivots from app building to exposing app functions as agent-callable capabilities via hosted MCP servers, raising a $400M Series C at a $13.3B valuation.
5