Brief archive
All Briefs 153
Detailed classification (threat type)
October 2026 9 briefs
2026-10-22 · Government & public sector · Supply chain · No.153 An attack on NEC's contractor leaked data on 77,851 Osaka University people 77,851 people's data leaked at Osaka University; systems down at Osaka Metropolitan University 2026-10-20 · Procurement & supply chain · Supply chain · No.144 Studio: a SaaS breach read the decryption keys too, reaching customer companies' form data 2026-10-20 · Government & public sector · Human error · No.134 Tokyo Metropolitan Housing Supply Corporation, 770 names misdirected: no check that labels matched the list before dispatch Names of 770 association heads reached other residents 2026-10-20 · Services & retail · No.110 Sourcenext, up to 22.52 million records: no check on the volume and purpose of member-information API calls Up to 22.52 million member records may have leaked 2026-10-20 · Procurement & supply chain · Supply chain · No.069 ConnectWise: a vendor's app identity granted itself Global Administrator in some customer tenants Sign-in activity in about 1,000 tenants, more than 300 successful 2026-10-20 · Media & content · No.026 Comic C'moA breach: system logs taken along with member data Five member-data fields and some system logs leaked 2026-10-16 · Government & public sector · Impersonation · No.044 SpeeCAN RAIDEN breach: fake mail sent from the disaster-alert domain 36 municipalities suspended the service 2026-10-14 · Government & public sector · Privilege abuse · No.152 Denmark CPR: a company's lawful access was abused to pull data on 8.8 million people Names, addresses and CPR numbers of about 8.8 million people retrieved 2026-10-14 · Finance & FinTech · Human error · No.151 TOPPAN sent 177,426 Sompo Japan policyholder records to another insurer 177,000 policyholders' data sent to another insurer
September 2026 12 briefs
2026-09-24 · Developers & agent operations · Impersonation · No.150 North Korean IT workers won contracts in Japan with ID images supplied by local enablers Japan's first laptop farm dismantled; hundreds of millions of yen sent abroad 2026-09-21 · Finance & FinTech · Impersonation · No.149 Revolut answered data requests from Italy's certified state email Customer data handed over for months 2026-09-15 · Developers & agent operations · Supply chain · No.148 RubyDoc.info doc builds ran arbitrary code from 500+ RubyGems spam packages 500+ malicious packages removed 2026-09-15 · Developers & agent operations · AI failure or misuse · No.147 GitSpawn: seven AI coding agents run code via git config Code ran in 7 AI coding agents 2026-09-11 · AI adoption (all industries) · Supply chain · No.146 Transformers writes remote code to disk before consent check (CVE-2026-80047) 2026-09-11 · AI adoption (all industries) · No.145 LiteLLM's MCP auth fallback silently granted unchecked access (CVE-2026-59822) Exploitation in the wild confirmed by CISA 2026-09-08 · AI adoption (all industries) · AI failure or misuse · No.143 Unit 42: AI-agent-run intrusion completed in under 10 hours Breach completed in under 10 hours 2026-09-08 · Finance & FinTech · Account takeover · No.142 Awa Bank: breach of a test environment past its purpose leaks 27,745 records 27,745 customer and shareholder records leaked 2026-09-04 · Supply chain · No.141 IDScan.net: 153M+ scanned driver's licenses sold on the dark web 153M+ driver's licence scans for sale 2026-09-01 · Impersonation · No.140 AnonyMousKIT: AI voice calls harvest stolen-iPhone passcodes 2026-09-01 · AI adoption (all industries) · No.139 11 flaws across six major agent frameworks (Check Point) 2026-09-01 · No.138 ServiceNow AI Platform: four unauthenticated flaws disclosed at once
August 2026 20 briefs
2026-08-28 · Healthcare · No.137 Staff met Japan's claims-Fund one-second target with a tool 290 staff used a tool that auto-pressed Enter 2026-08-28 · Finance & FinTech · No.136 All 15 x402 facilitators in violation; verification isn't bound to settlement 2026-08-21 · Finance & FinTech · No.135 Expired Visa EMV contactless cards can pass; the terminal's expiry isn't bound to the record 2026-08-21 · Developers & agent operations · No.133 One Pyodide sandbox escape reproduced across seven products; isolation premise unverified 2026-08-21 · AI adoption (all industries) · Supply chain · No.132 A vendor's 'sealed' eval environment opened onto the internet — real third parties breached AI under evaluation accessed 3 organizations' production systems 2026-08-21 · AI adoption (all industries) · AI failure or misuse · No.131 OpenClaw's agent cancelled a stranger's gym booking; the API had no authorization check A stranger's booking cancelled, irreversibly 2026-08-11 · AI adoption (all industries) · AI failure or misuse · No.130 Atlassian Rovo can be tricked into sending Jira/Confluence data out unverified 2026-08-11 · AI adoption (all industries) · AI failure or misuse · No.129 An AI agent vouched for its own change and rewrote the history (UK AISI) 2026-08-11 · Developers & agent operations · AI failure or misuse · No.128 Three coding agents broken in default config — one GitHub issue reaches CI 2026-08-07 · AI adoption (all industries) · No.127 Japan's MOJ puts voice inside publicity rights in its generative-AI interpretation guidance 2026-08-07 · Finance & FinTech · No.126 FCA fines Starling Bank £29m — sanctions screening covered only a fraction of the list Over 54,000 accounts opened for 49,000 high-risk customers 2026-08-07 · Developers & agent operations · Account takeover · No.125 keyv and cacheable npm takeover — nine releases in 38 minutes, all pulled Nine compromised versions published in about 38 minutes 2026-08-04 · Healthcare · No.124 Doctors suspect AI hallucination behind Medicare's WISeR prior-authorization denials Nearly 100 patients awaiting epidurals at one health system 2026-08-04 · Finance & FinTech · Privilege abuse · No.123 BonkDAO governance attack drained about $20M; the smart contracts ran as designed About $20 million in BONK moved from the treasury 2026-08-04 · AI adoption (all industries) · No.122 Truffle Security scanned 7.6PB of Hugging Face datasets, found 221,303 live secrets 221,303 still-valid credentials in public datasets 2026-08-04 · AI adoption (all industries) · Supply chain · No.121 "FaceHugger" flaws in Hugging Face Diffusers let a malicious model repo run code on load 2026-08-03 · Media & content · AI failure or misuse · No.120 TikTok's 3 billion AI labels coexisted with a 550-video AI-presenter disinformation network 550+ misleading videos drew over 3 million views 2026-08-03 · AI adoption (all industries) · AI failure or misuse · No.119 Japanese police identified 123 sexual-deepfake cases in H1 2026, passing all of last year — NPA 123 sexual deepfake cases of minors in six months 2026-08-03 · AI adoption (all industries) · AI failure or misuse · No.118 Copilot for Word document-borne prompt injection; generated files become carriers (PoC) 2026-08-03 · AI adoption (all industries) · No.117 Speechify's voice-cloning consent is one self-certification checkbox; CFA files with the FTC
July 2026 24 briefs
2026-07-31 · AI adoption (all industries) · Supply chain · No.116 Fake OpenAI model tops Hugging Face trending; publisher provenance unverified before execution 2026-07-31 · AI adoption (all industries) · No.115 Workday AI hiring-bias suit: no record the decision was verified before rejection Lead plaintiff rejected for 100+ openings (alleged) 2026-07-31 · Developers & agent operations · AI failure or misuse · No.114 RCE in AWS Kiro: the agent rewrites its own MCP config 2026-07-31 · AI adoption (all industries) · No.113 Ruflo MCP Bridge unauthenticated RCE: memory poisoning survives the patch 2026-07-31 · Media & content · Impersonation · No.112 Ariana Grande suit: collaborator credentials unverified before the action 45 unreleased songs leaked in 2023 alone 2026-07-28 · Finance & FinTech · No.111 Wanchain — ambiguous signing encoding let one signature move 65,000× more About 515.2 million NIGHT (roughly $10 million) drained 2026-07-24 · AI adoption (all industries) · No.109 ServiceNow CVE-2026-6875: one request before login escapes the sandbox to code execution On unpatched instances, data could be read and admins created without logging in 2026-07-24 · Finance & FinTech · Account takeover · No.108 AFX Trade — compromised signatures met the 2/3 quorum, $24.15M gone Roughly $24.15 million (USDC) drained 2026-07-24 · Finance & FinTech · No.107 Verus-Ethereum bridge — same entry path, hit again in 66 days for $7.54M Roughly $7.54 million paid out with no backing 2026-07-21 · AI adoption (all industries) · No.106 Figma — AI training defaulted on for individuals/small teams, off for enterprise (Khan v. Figma) 2026-07-21 · Media & content · No.105 JAPRO FY2025 — 40,000+ unauthorized likeness/voice posts, and a 100% takedown rate did not stop reappearance Over 40,000 suspected infringing posts 2026-07-21 · AI adoption (all industries) · AI failure or misuse · No.104 WebMCP — swapping the tools mid-session led agents to call the attacker's tool without noticing 2026-07-21 · Finance & FinTech · Account takeover · No.103 Ostium — one compromised oracle signer key let "future prices" be accepted as validly signed, draining $18M Up to roughly $18 million (USDC) drained 2026-07-15 · Developers & agent operations · AI failure or misuse · No.102 Friendly Fire — a defensive AI coding agent ran the very binary it was asked to vet 2026-07-10 · Finance & FinTech · Supply chain · No.101 Paysafe fake SDKs — 17 packages posing as payment SDKs stole developer secrets, payment API keys and all 17 malicious packages posing as payment SDKs 2026-07-10 · Finance & FinTech · No.100 Aptos — a ~$3,000 rig reproduced a Move VM type confusion, a risk cascading to ~$70B 2026-07-10 · Developers & agent operations · AI failure or misuse · No.099 Agentjacking — one fake error report trusted as "resolution steps," and an AI coding agent ran the attacker's commands 2026-07-07 · AI adoption (all industries) · AI failure or misuse · No.098 BioShocking — six AI browsers, convinced "it's a game," leaked credentials 2026-07-07 · AI adoption (all industries) · AI failure or misuse · No.097 JadePuffer — an LLM ran a real-world ransomware attack from breach to encryption 1,342 configuration items encrypted beyond recovery 2026-07-07 · Developers & agent operations · Impersonation · No.096 Gitea — a default reverse-proxy config lets one HTTP header impersonate an admin (CVE-2026-20896) 2026-07-03 · Developers & agent operations · Supply chain · No.095 Amazon Q — a bundled .amazonq/mcp.json auto-ran and leaked AWS credentials 2026-07-03 · Developers & agent operations · AI failure or misuse · No.094 Cursor's DuneSlide — one injected prompt escapes the sandbox to RCE 2026-07-03 · Finance & FinTech · No.093 A7A5 moved $110B under sanctions — traceable, yet no attribute stops it at transaction time Over $110 billion moved on-chain under sanctions 2026-07-01 · Developers & agent operations · No.092 exploitarium: bikini dropped many zero-day PoCs found via AI-automated fuzzing. CVEs exist, but recipients can't verify whether each report is a real finding or noise
June 2026 70 briefs
2026-06-30 · Services & retail · Impersonation · No.091 Photo ZIP: authentication laundering cleared SPF/DKIM/DMARC; email auth verifies the path, not the author 2026-06-30 · AI adoption (all industries) · Supply chain · No.090 AIR: a fake agent skill cleared every scanner; the blind spot was an external link swapped after the scan 2026-06-30 · Finance & FinTech · Supply chain · No.089 SecondFi: an unaudited SDK swap let private keys be rebuilt from public data (~$2.4M drained) About 16M ADA drained from 374 addresses 2026-06-30 · Developers & agent operations · No.088 Kestra: a /configs path suffix bypasses auth — unauthenticated root RCE (CVSS 10.0) 2026-06-30 · Finance & FinTech · Supply chain · No.087 Polymarket: JS injected via a third-party dependency drove fake approvals, ~$3M drained (contracts intact) About $3 million worth of assets stolen 2026-06-30 · Finance & FinTech · Supply chain · No.086 Sumsub: an 18-month undetected breach of a KYC vendor's support environment exposed users' names and contacts Client end-users' names and contact details exposed (number undisclosed) 2026-06-30 · Finance & FinTech · No.085 Secret Network: forged-channel deposits went unverified, minting unbacked wrapped tokens (~$4.67M) ~$4.67M in assets withdrawn 2026-06-26 · Finance & FinTech · Impersonation · No.084 Hong Kong deepfake meeting fraud: a fake CFO's instruction moved HK$200M (Arup) About HK$200M sent to five accounts in 15 transfers 2026-06-26 · Healthcare · Account takeover · No.083 Change Healthcare: a breach of one Citrix account without MFA halted a third of US medical claims for weeks Medical records of 100M+ Americans affected 2026-06-26 · Developers & agent operations · Supply chain · No.082 A two-year "trusted developer" impersonation — xz utils backdoor 2026-06-26 · Finance & FinTech · Supply chain · No.081 JS injected into the signing UI drained ~$1.5B — Bybit ~401,347 ETH (~$1.5B) drained 2026-06-23 · AI adoption (all industries) · AI failure or misuse · No.080 Replit's AI agent broke a code freeze, wiped the production DB, then covered it with fake data Production DB on 1,200+ companies and 1,190+ executives wiped 2026-06-23 · AI adoption (all industries) · No.079 Common Crawl: ~12,000 live credentials embedded in an LLM training corpus ~12,000 live credentials found in a training corpus 2026-06-23 · Government & public sector · No.078 TennCare Connect's automated eligibility system illegally cut thousands off Medicaid Thousands illegally cut off from benefits 2026-06-23 · Finance & FinTech · No.077 IDMerit's disputed billion-record exposure — no one can show whose data it was Reported exposure of about 1 billion records; custody disputed (figures unverified) 2026-06-23 · Government & public sector · AI failure or misuse · No.076 A 93% FRT 'match' drove arrest with no independent corroboration — Robert Dillon One man wrongfully arrested as someone else 2026-06-23 · Procurement & supply chain · Supply chain · No.075 Klue's un-revoked test credential led to mass Salesforce extraction CRM records mass-extracted over ~24 hours 2026-06-23 · Finance & FinTech · Impersonation · No.074 A leaked prover signing key let forged withdrawals pass as valid — Taiko bridge ~$1.7M withdrawn from the bridge vault 2026-06-19 · AI adoption (all industries) · No.073 ShadowMQ: one unauthenticated ZMQ + pickle implementation, copied across inference stacks — at ecosystem scale 2026-06-19 · AI adoption (all industries) · No.072 Pickle over an unauthenticated gRPC channel = instant RCE — LeRobot 2026-06-19 · Manufacturing & critical infrastructure · No.071 One authenticated client reached 7,000 robot vacuums' cameras — DJI ROMO 2026-06-19 · Manufacturing & critical infrastructure · No.070 One shared key let a single takeover collapse the whole fleet — Unitree / UniPwn 2026-06-19 · Manufacturing & critical infrastructure · No.068 Unauthenticated network access yields RCE on cobots — UR PolyScope 2026-06-19 · Finance & FinTech · No.067 An invalid SPV proof minted 5B SYS with no burn — Syscoin bridge ~5 billion SYS minted with no burn behind it 2026-06-19 · AI adoption (all industries) · Privilege abuse · No.066 Low-priv user to admin and RCE — the LiteLLM gateway chain 2026-06-17 · Healthcare · Human error · No.065 Drives assumed shredded resurfaced online — 180,000+ patients (NHO Hokkaido) Drives holding data on about 179,000 patients circulated online 2026-06-17 · Manufacturing & critical infrastructure · AI failure or misuse · No.061 Driver-assist AI braked with no real threat, causing rear-end crashes — Hyundai 4 rear-end crashes and 4 injuries alleged 2026-06-17 · AI adoption (all industries) · AI failure or misuse · No.042 A robotaxi drove past a stopped school bus — Waymo 19 instances logged by the Austin school district this year 2026-06-16 · Procurement & supply chain · Supply chain · No.064 Stolen integration OAuth tokens hit 700+ Salesforce tenants — Salesloft Drift 700+ Salesforce environments queried 2026-06-16 · AI adoption (all industries) · No.063 Your smart TV is a node in the AI-scraping economy — Bright Data SDK 2026-06-16 · AI adoption (all industries) · AI failure or misuse · No.062 One GitHub issue hijacks the repo via the agent — Claude Code GitHub Action 2026-06-16 · AI failure or misuse · No.060 Both sides filed AI-hallucinated cases, both sanctioned — N.D. Miss. All four attorneys sanctioned and the trial vacated 2026-06-16 · AI adoption (all industries) · Supply chain · No.059 "Allow all" OAuth to an AI tool became the breach path — Vercel 2026-06-16 · AI adoption (all industries) · No.058 An agent loads its own checkpoint unverified → RCE — LangGraph 2026-06-15 · AI adoption (all industries) · No.057 No auth on the AI backend — reachable meant readable — DeepSeek Over a million log lines and plaintext chat history exposed 2026-06-15 · AI adoption (all industries) · No.056 Hiring AI: 64M records within reach, no authorization check — McHire 2026-06-15 · AI adoption (all industries) · AI failure or misuse · No.055 AI exfiltrated data without verifying the instruction's origin — EchoLeak 2026-06-13 · Media & content · No.054 Copyrighted characters generated until opt-out — Sora 2 2026-06-12 · Media & content · Impersonation · No.053 200M views of fake celebrities, likeness provenance gap — YouTube Celebrity-impersonation scam ads viewed about 200 million times 2026-06-12 · Supply chain · No.052 70k government IDs leaked to prove age — Discord / 5CA 70,000 government ID images stolen 2026-06-12 · Media & content · Account takeover · No.051 Asking the AI support bot hijacked 20k accounts — Meta HTS 20,225 Instagram accounts taken over 2026-06-12 · AI adoption (all industries) · AI failure or misuse · No.050 Consent and age unverified at generation — Grok deepfakes 2026-06-12 · AI adoption (all industries) · No.049 Crash control attribution left self-reported — Tesla Robotaxi 2 of 17 crashes were caused by remote teleoperators 2026-06-12 · Developers & agent operations · Supply chain · No.048 Hidden directives planted in AI instruction files — TrapDoor Over 34 packages and 384+ versions/artifacts 2026-06-12 · AI adoption (all industries) · AI failure or misuse · No.047 An AI agent forwarded credentials before verifying the sender — OpenClaw / Varonis 2026-06-12 · No.046 A flipped auth flag let an unauthenticated API query customer instances — ServiceNow Unauthenticated table queries succeeded for some customers 2026-06-11 · Finance & FinTech · No.045 Keys stolen from one device clear the multisig threshold — Humanity Protocol Over $32M drained 2026-06-09 · AI adoption (all industries) · AI failure or misuse · No.043 Tesla FSD crash data and safety stats, self-reported and unverified — Tesla FSD 9 reduced-visibility crashes (1 death, 1 injury) 2026-06-09 · Manufacturing & critical infrastructure · Supply chain · No.041 AOG Technics circulated 60,000+ aircraft engine parts with forged airworthiness certificates for over four years Over 60,000 parts circulated with forged certificates 2026-06-09 · Finance & FinTech · No.040 Carbon credits from forests with no real conservation — Operation Greenwashing 2026-06-09 · AI adoption (all industries) · AI failure or misuse · No.039 In Semantic Kernel, prompt injection led directly to host-level RCE 2026-06-09 · Developers & agent operations · Supply chain · No.038 A self-propagating npm worm republishes itself with stolen credentials — IronWorm Roughly 37 packages infected 2026-06-09 · Developers & agent operations · AI failure or misuse · No.037 AI coding agents auto-execute project-local config — SymJack / Miasma 73 repositories across 4 Microsoft orgs disabled 2026-06-08 · AI adoption (all industries) · No.036 12.8B training images contained passports, résumés, faces — CommonPool Over 800 faces escaped blurring in a 0.1% sample alone 2026-06-08 · Manufacturing & critical infrastructure · No.035 Inspections recorded as complete but never performed — Boeing 787 Roughly 450 aircraft affected (per sources) 2026-06-08 · Finance & FinTech · Impersonation · No.034 eKYC face-check bypass kits sold on Telegram swap in fake camera video Bypass kits sold in 22 Telegram channels and groups 2026-06-08 · Account takeover · No.033 One edge-appliance compromise cascaded to full domain takeover — F5 BIG-IP One appliance compromise led to full Active Directory takeover 2026-06-08 · Services & retail · Account takeover · No.032 Booking.com payout account switched, ¥9M lost — Polaris Holdings About ¥9M lost at one hotel 2026-06-08 · Government & public sector · AI failure or misuse · No.031 AI agents ran intrusions end to end — SHADOW-AETHER Six Mexican government agencies compromised 2026-06-06 · Services & retail · No.030 Trusted Stripe API repurposed as a card-skimming channel 2026-06-06 · Developers & agent operations · Account takeover · No.029 One-click GitHub OAuth token theft via github.dev 2026-06-05 · Developers & agent operations · Supply chain · No.028 33 packages impersonating internal scopes exploited the build environment's provenance assumptions — npm dependency-confusion recon campaign 33+ malicious packages published to npm 2026-06-05 · AI adoption (all industries) · No.027 User-supplied MCP server URLs became an exfiltration channel for server secrets — LibreChat CVE-2026-32625 CVSS 9.6 2026-06-05 · AI adoption (all industries) · Supply chain · No.025 Agent infrastructure trust boundaries, unverified at the reference implementation design level 2026-06-05 · AI adoption (all industries) · AI failure or misuse · No.024 What humans read and what models read cannot be guaranteed identical without a verification layer 2026-06-05 · Finance & FinTech · No.023 Guardian keys intact — but the provenance of the events they signed was never verified — Alephium TokenBridge $815K exploit About $815K drained from the bridge 2026-06-04 · Finance & FinTech · Impersonation · No.022 AI-generated IDs bypassed exchange KYC — image review isn't issuer verification — OnlyFake 2026-06-03 · Finance & FinTech · Impersonation · No.021 Forged bank balance confirmations went unverified, reaching disclosure — Wirecard EUR 1.9 billion in cash that did not exist 2026-06-03 · Manufacturing & critical infrastructure · No.020 Tampered certification test data reached type designation and shipment — type-designation fraud Type designation of three models revoked 2026-06-03 · No.019 Engineers placed under national-license claims they didn't meet — qualified-worker fraud
May 2026 18 briefs
2026-05-31 · AI adoption (all industries) · AI failure or misuse · No.018 Rewriting CLAUDE.md to hijack the defending AI — hackerbot-claw, the first AI-vs-AI attack 2026-05-31 · AI adoption (all industries) · AI failure or misuse · No.017 The layer governing the AI's behavior had no integrity or provenance — McKinsey Lilli 2026-05-31 · Finance & FinTech · No.016 Valid Merkle proof but no verification of source-vs-payout amount — Verus-Ethereum bridge ($11.58M) About $11.58M drained from the bridge 2026-05-31 · Developers & agent operations · Supply chain · No.015 A poisoned VS Code extension lived 18 minutes on the marketplace — GitHub internal breach About 3,800 internal repositories cloned 2026-05-31 · Developers & agent operations · Supply chain · No.014 Malicious npm packages signed under a legitimate OIDC trusted publisher — TanStack 84 malicious versions published across 42 packages 2026-05-31 · Finance & FinTech · Privilege abuse · No.013 Regulation-mandated raw PII storage became the breach surface via insider — Coinbase KYC KYC data of at least 69,461 customers exfiltrated 2026-05-31 · Government & public sector · AI failure or misuse · No.012 AI face-match drove enforcement with no independent verification — Robert Williams One man wrongfully arrested and held about 30 hours 2026-05-31 · AI adoption (all industries) · No.011 SynthID Watermark, Statistically Stripped — a provenance mark that can be removed and forged 2026-05-31 · Developers & agent operations · Impersonation · No.010 Trust signals and GitHub Releases weaponized as a delivery channel — Claude Code leak lures 2026-05-31 · AI adoption (all industries) · AI failure or misuse · No.009 AI agent ran 80–90% of an attack autonomously — GTG-1002 About 30 targets attacked; a few breached 2026-05-30 · AI adoption (all industries) · No.008 2.05 billion public messages redistributed as AI training data — Discord scraping 2.05 billion messages scraped and published 2026-05-30 · AI adoption (all industries) · AI failure or misuse · No.007 An AI coding agent wiped a production DB in 9 seconds — Cursor + Claude × PocketOS Production database and backups wiped in 9 seconds 2026-05-30 · Developers & agent operations · No.006 Deleted API keys stayed usable for 23 minutes — Google revocation lag 2026-05-30 · AI adoption (all industries) · AI failure or misuse · No.005 Embedded font forgery silently rewrote what the AI read — Noroboto attack 2026-05-30 · Developers & agent operations · Supply chain · No.004 5,561 repos poisoned in 6 hours via CI/CD credential theft — Megalodon GitHub supply chain Spoofed commits pushed to 5,561 repositories in 6 hours 2026-05-30 · AI adoption (all industries) · No.003 Host header manipulation bypassed MCP server auth — Starlette CVE-2026-48710 (BadHost) 2026-05-29 · Finance & FinTech · Account takeover · No.002 Deployer key rewrote LayerZero v2 trust config to mint tokens — Stake DAO vsdCRV 5.4 trillion vsdCRV minted from a forged message 2026-05-29 · Finance & FinTech · Supply chain · No.001 RPC manipulation on the DVN observation layer unlocked the bridge — KelpDAO / rsETH 116,500 rsETH (approx. ¥46B) unlocked without authorization
No Briefs matched your filters.