Breaches, malware and the small human mistakes that scale into incidents — retold as stories, moral attached.
Archive
8 entries
A Kibana dashboard with zero authentication exposed the entire Malawian credit bureau — 2.4 million full identity profiles, 49 million loan records and live application logs — to anyone who knew the IP.
A three-year-old Grafana path traversal led to a plaintext database, then to Zabbix API access, then to a full infrastructure map.
Two unauthenticated CouchDB nodes held India's entire Do-Not-Disturb registry — 245 million phone preferences, 7 million consent records and full residential PII — behind nothing but an open port.
How a self-spreading npm worm turned stolen maintainer tokens into a cascading supply-chain compromise across hundreds of packages.
One Azure VM, one week, 365,000 logged events. root/123456 at the top of the credential charts, SIP and SSH at the top of the port charts, and cloud providers doing most of the shooting.
A stick that looks like a thumb drive enumerates as a keyboard — no driver, no prompt, no consent. In a lab: Defender switched off, a logon-triggered PowerShell reverse shell on Windows, and root persistence with the logs wiped on Linux.
// Never miss an issue
New entries land in the feed the moment they're filed.