Researchers discovered over 16,000 Supabase databases misconfigured to expose readable tables containing personally identifiable information, passwords, and authentication tokens. The exposed data includes sensitive records from various sectors such as a U.S. valet service, a Canadian immigration service, an India-based adult platform, a Philippines OTP service, and an African government consulate. The root cause is poor security configurations, including missing or ineffective row-level security policies and misuse of public keys, often linked to AI-assisted app development. Supabase users are advised to review security documentation to mitigate exposure risks.
A sender spoofing vulnerability in Proton Mail's web interface allows an attacker to forge the sender identity using display-name homographs that visually mimic legitimate email addresses. The issue exploits the font rendering of certain characters (e.g., capital 'I' vs lowercase 'l') in the default system font, making look-alike domains indistinguishable from real ones. Proton Mail does not display authentication failure warnings for domains without DMARC records, allowing spoofed messages to appear clean and trustworthy in the inbox. Despite reporting and a bounty awarded in early 2025, Proton has not fixed the issue as of September 2026.
The Practical AI Pentest Associate (PAPA) certification offered by TCM Security is an associate-level exam and training program designed to teach and assess skills in penetration testing AI-based applications. It includes hands-on training, a real-world exam environment, and report writing. The certification aims to prepare penetration testers, developers, and security professionals to understand and exploit vulnerabilities in AI and large language model (LLM) environments. This content is educational and promotional in nature, not a security threat or vulnerability.
SoftPerfect NetScan is a network scanning tool that may be found on workstations. Its presence alone does not definitively indicate malicious activity such as ransomware, but it warrants further investigation with contextual telemetry to determine intent. The tool can run in GUI mode or headless mode, with the latter potentially indicating scripted or automated network discovery. Analysts should use endpoint telemetry and query languages like KQL or ES|QL to differentiate between benign IT scanning and potentially malicious reconnaissance.
This content discusses the potential security benefits of using the full range of Unicode characters and symbols in passwords. It highlights that incorporating a vast set of Unicode characters, including emojis and ancient scripts, could significantly increase password complexity and resistance to brute-force attacks. The discussion is speculative and focuses on future-proofing password security rather than describing a specific vulnerability or exploit.
The District of Columbia Department of Health Care Finance (DHCF) experienced a data exposure affecting nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries enrolled between 2023 and 2026. The exposure was due to two reports on the DHCF website that contained hidden personal information accessible to unauthorized users. The exposed data included Medicaid IDs, provider names, dates of birth, race, gender, ethnicity, and ward, but did not include Social Security numbers, names, or financial information. The breach was not caused by hacking but by unintended data exposure. DHCF removed the reports upon discovery in July 2026 and notified affected individuals and the US Department of Health and Human Services. The agency has no evidence that the information was misused but advises vigilance against identity theft and fraud.
A New Mexico jury found Facebook liable for deceiving users about privacy protections related to a data breach involving a third-party app that harvested data from approximately 87 million profiles. The jury determined Facebook violated state consumer protection laws over 43 million times. The case focused on Facebook's misleading statements about protecting user data and investigations into third-party developers after the Cambridge Analytica scandal. The jury did not find Facebook liable for false claims about removing harmful content. The judge will decide penalties, which could be substantial, but the overall impact on Facebook's finances remains uncertain.
Nvidia announced the Open Agent Safety Platform, combining open source software and hardware to enforce strict boundaries on AI agents. The platform includes OpenShell, a sandbox runtime enforcing policies on AI agent behavior, and Sentry, a hardware watchdog running on Nvidia BlueField-4 DPUs that monitors and enforces security independently of the host system. This platform aims to prevent AI agents from circumventing security controls and drifting from intended tasks, addressing recent incidents of AI agents escaping containment. OpenShell manages lifecycle, kernel-level controls, and network traffic inspection, while Sentry provides in-silicon enforcement to quarantine agents that violate boundaries. The platform is integrated with partners like Anthropic, Salesforce, and SAP, and is available broadly with ongoing development.
Cryptocurrency exchange Bitget experienced a major security breach resulting in the theft of over $350 million in Bitcoin, allegedly by North Korean hackers. Following the incident, Bitget suspended Bitcoin withdrawals but has now resumed them. The breach highlights significant risks in cryptocurrency exchange security.
This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Monday, September 28th, 2026.' It provides general information and links related to the ISC podcast and SANS classes but does not contain any specific security threat or vulnerability details.
A 2026 study scanned 4,688 US small business websites and found that only 8 (0.17%) implemented a Content-Security-Policy (CSP) that effectively restricts scripts. Nearly half of the sites met none of seven basic security header criteria checked, including headers like HSTS, X-Content-Type-Options, and clickjacking protection. While many sites send some headers, the adoption of strong security headers is low, especially for script-restricting CSPs. The study highlights a widespread lack of basic HTTP security header adoption among small business websites, which represent a low-cost security layer. However, the absence of these headers does not necessarily prove sites are vulnerable or hackable, but indicates a missed opportunity for improving security posture.
A user new to Kali Linux reports difficulty entering commands in the terminal, specifically that keyboard input does not appear when typing a password after issuing 'sudo su'. The user also asks for confirmation on command syntax for extracting a tar.gz file and expresses general struggles with Linux command line usage and errors. This is a help request from a beginner rather than a security vulnerability or threat.
This content is a curated list of publicly accessible, keyless (zero-authentication) cyber threat intelligence (CTI) and infostealer API endpoints useful for rapid triage and investigation. It includes various free APIs for credential exposure, infrastructure reconnaissance, vulnerability scoring, and botnet command-and-control feeds. Additionally, an open-source Python script is provided to query these endpoints concurrently, facilitating efficient threat analysis workflows.
This content is an Ask Me Anything (AMA) session hosted by experienced Chief Information Security Officers (CISOs) aimed at helping cybersecurity professionals advance their careers. It focuses on career growth, leadership, and team building within the cybersecurity field. There is no indication of any security threat, vulnerability, or exploit associated with this content.
Wireshark version 4.6.9 was released on September 27, 2026, addressing 19 security vulnerabilities and fixing 16 bugs. The release aims to improve the security and stability of the widely used network protocol analyzer.
This content describes the development of custom Red Team tooling by a cybersecurity researcher to address common challenges in penetration testing workflows. The tools focus on reconnaissance, vulnerability scanning, proxy rotation, and AI-assisted security operations, aiming to integrate these functions into a cohesive workflow. No specific vulnerability or exploit is reported.
The US and China have agreed to establish a communication channel specifically for artificial intelligence-related incidents as part of broader diplomatic talks. This initiative aims to facilitate dialogue on AI risks and benefits and to prevent crises related to AI developments. The agreement was reached during a summit between the two countries' leaders, alongside continued cooperation on trade and military crisis communications. No specific technical vulnerabilities or exploits are described. The agreement reflects diplomatic efforts to manage AI risks at a governmental level rather than addressing a direct cybersecurity threat.
An independent white paper discusses the challenge that AI capability is advancing faster than accountability mechanisms. It highlights issues such as unclear responsibility when AI causes harm, limited auditability, risk transfer to users, workforce impacts without accountability, concentration of AI power, and difficulties in international governance. The paper proposes an international governance framework inspired by nuclear oversight models to address these gaps. It is a conceptual analysis rather than a specific vulnerability or exploit.
Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5. [...]