Humble Bundle launched a new website that reportedly eliminated two-factor authentication, allowing accounts to be secured by password alone. Users can also change their password or email address without re-entering their current password, and the site allegedly reinstated one-click payments despite that practice being illegal in some jurisdictions. The findings were surfaced by an IT security professional streaming live and corroborated on a Reddit thread; Humble Bundle has not yet publicly responded.
forums.spacebattles.com
· 2026-11-12
Trigger.dev reported a security incident in which an attacker exploited a vulnerability to gain unauthorized access to environment variables belonging to a subset of its customer organizations. The company says it has blocked the exploit and emailed affected account owners with mitigation steps, and will post further updates on its status page.
trigger.dev
· 2026-11-02
A Reddit user says they installed Garmin Messenger on a second phone, entered their existing number, verified it via SMS, and saw their full conversation history reappear without entering a Garmin account password. The second device then began sending and receiving messages, with no apparent way to view or disconnect other active sessions. Garmin has reportedly been notified but has not confirmed any fix.
androidauthority.com
· 2026-10-29
Bank of America sent customers an email titled 'Protecting your finances in the AI World,' telling them never to share their username and password with another person or outside service, including AI tools or agents acting on their behalf. A bank spokesperson confirmed the email's authenticity after it circulated on social media. The bank also noted that customers remain responsible for any account activity that results from sharing their credentials.
yro.slashdot.org
· 2026-10-29
Bank of America sent an email titled 'Protecting your finances in the AI World,' telling customers never to share their banking username and password with another person or any outside AI-enabled tool or agent acting on their behalf. The bank noted that customers remain responsible for any activity that results if they do share their credentials.
techcrunch.com
· 2026-10-27
A Hacker News user described being locked out of Google, banking, email and Drive accounts after their phone was stolen, since 2FA and account recovery relied on that device and an old email they could no longer access. The poster noted Google's automated recovery flow offers only options tied to the lost phone or an outdated backup email, leaving no clear path to a human for help.
news.ycombinator.com
· 2026-09-17
X users have reported receiving unsolicited password reset emails following the rollout of the platform's new X Money payment service. X engineer Mridul Singhai confirmed the company is investigating the surge of reset requests, stating no evidence of actual account breaches has been found so far.
techcrunch.com
· 2026-09-01
WhatsApp is strengthening its two-step verification by letting users set a full password—supporting letters, numbers and special characters—instead of the previous six-digit PIN. The company is also improving caller ID on Android, showing more context about unknown callers such as their country and any shared groups. Both features are rolling out gradually, with the password option available on Android and iOS, while enhanced caller ID is Android-only for now.
androidauthority.com
· 2026-08-25
GoKawiil