tl;dv (AI meeting assistant) left 181,874 meetings exposed via misconfigured Firestore, including live calls you could join. Researcher disclosed in January, still unpatched 6 months later.

The AI meeting assistant tl;dv exposed 181,874 meetings due to a misconfigured Firestore database. This exposure included live calls that unauthorized users could join. The vulnerability was disclosed by a researcher in January but remains unpatched six months later.

• darkreading.com/application-security/ai-notetaker-spy-government-corporate-video-calls (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1vgitp9/tldv_ai_meeting_assistant_left_181874_meetings/ (opens in a new tab)
• bobdahacker.com/blog/tldv-hack (opens in a new tab)

• Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposedCriticalVulnerability2026-09-29
• PHP2Shell was probed 4 days before disclosure. Is anyone doing a look-back hunt, not just patching?News2026-10-22
• PHP2Shell: patching priorities, exposure checks, and the limits of virtual patchingNews2026-10-22
• PHP2Shell - quick mitigation pre-patchMediumVulnerability2026-10-21
• Five days before the French supermarket fridge attack, France had more exposed Danfoss StoreView dashboards than the rest of the world combinedCampaign2026-10-20