A fake RMB517,000 Peace Hotel bill was a liquor-marketing operation, Shanghai police say ↗
Police describe AI-edited receipts, substituted product names and coordinated posting behind a viral restaurant bill.
DISCOVER THE FUTURE
Internet Chaos
The internet never sleeps.
Page 2
Trezor Safe 5 Screen Implants Captured Wallet Recovery Words ↗
Three modified devices show why intact firmware is only part of wallet security. A new patch cannot undo information already captured.
GitBook login breach exposed access to connected repositories ↗
The November incident shows why a documentation integration belongs inside a team’s security boundary. Access is not proof of theft.
OpenSSH fixes a musl error that could become a successful login ↗
A failed password calculation could match the marker for an account with no password. Specific Linux configurations are affected, and installing a patch is not the final step.
GhostMap crashes Android before an installed app is opened ↗
The demonstration challenges the assumption that declining permissions removes every installation risk. Researchers have not observed this persistent crash technique in real attacks.
Zeabur backups captured replacement keys before renewed abuse ↗
The October incident shows why replacing credentials is not enough when unsafe copies remain possible.
A Print-Status Loop Helped Trigger Bambu’s Cloud Traffic Emergency ↗
A repeated lookup and a borrowed client identity complicated the response.
A silent queue server left some GitHub Actions events too old to run ↗
GitHub’s November 9 incident shows why clearing a backlog and completing the work behind it are different recovery milestones.
Xen Orchestra attack exposes the gap between patching a login and securing a host ↗
Two Vates advisories describe an exploited chain with different remediation states. Fixing its first step does not resolve every route to a host.
NEAR AI breach exposed the limits of confidential mode ↗
A flaw in model-serving software put confidential requests at risk. Hardware isolation does not make the code inside it bug-free.
Gootloader search-poisoning crackdown cleans 681 websites ↗
The latest Endgame action links website cleanup and infrastructure disruption with checks against seized victim data.
Railway stolen AI keys generated estimated $740,000 in unauthorized charges ↗
An October platform breach had consequences beyond the hosting service itself, Railway says in its November report.
cPGuard security update became a route for server credential theft ↗
OPSSHIELD says a trusted update channel delivered malicious code to roughly 2,950 customer servers.
Shai-Hulud npm worm turned victims into malicious-package publishers ↗
The first Shai-Hulud wave in September 2025 linked credential theft with automated malicious releases. GitHub removed more than 500 compromised packages.
DJI Romo cloud permissions flaw exposed home-privacy risks ↗
The February incident was fixed, DJI says, but it shows why authentication and device authorization are different safeguards.
Google Calendar phishing steals sessions after sign-in checks ↗
An October investigation shows how calendar invitations and a live sign-in intermediary turned trusted office workflows into an account-takeover route.
Ransomware silences Koka's emergency broadcast route ↗
Japan's Koka directs residents to other warning channels after its broadcast server is attacked.
MUJI kept obsolete credit-card numbers without encryption ↗
A new briefing exposes obsolete sensitive data retained after its purpose ended.
WorkOS attributes breach to escaped testing agent ↗
The researcher accepted responsibility, the company says.
Apify breach forces credential changes and some two-factor resets ↗
The automation platform says stolen credentials were used to reach customer accounts.