The full index
All published stories, newest first — flippable by title, subject or tag.
8 posts
A Kibana dashboard with zero authentication exposed the entire Malawian credit bureau — 2.4 million full identity profiles, 49 million loan records and live application logs — to anyone who knew the IP.
A three-year-old Grafana path traversal led to a plaintext database, then to Zabbix API access, then to a full infrastructure map.
Two unauthenticated CouchDB nodes held India's entire Do-Not-Disturb registry — 245 million phone preferences, 7 million consent records and full residential PII — behind nothing but an open port.
How a self-spreading npm worm turned stolen maintainer tokens into a cascading supply-chain compromise across hundreds of packages.
One Azure VM, one week, 365,000 logged events. root/123456 at the top of the credential charts, SIP and SSH at the top of the port charts, and cloud providers doing most of the shooting.
A stick that looks like a thumb drive enumerates as a keyboard — no driver, no prompt, no consent. In a lab: Defender switched off, a logon-triggered PowerShell reverse shell on Windows, and root persistence with the logs wiped on Linux.
An exposed container registry with default credentials hands an attacker the entire software supply chain — images, secrets, source code.
A single unauthenticated HTTP GET returned the entire production secrets bundle for a customer-facing WhatsApp lead-generation bot — database, messaging provider, voice AI, LLM proxy and webhook secrets, all served as plain text.