Security researcher Robert Wiggins found a password embedded in Wyndham's Android app source code that granted access to an internal Salesforce-hosted database containing customer names, emails, member numbers, login tokens, and company documents. Wiggins reported the issue to TechCrunch, which notified Wyndham; the exposed credential was revoked shortly after. Wyndham said it found no evidence of unauthorized access but did not clarify whether it has logs to verify that claim.
techcrunch.com
· 2026-11-09
Trigger.dev reported a security incident in which an attacker exploited a vulnerability to gain unauthorized access to environment variables belonging to a subset of its customer organizations. The company says it has blocked the exploit and emailed affected account owners with mitigation steps, and will post further updates on its status page.
trigger.dev
· 2026-11-02
A data leak has exposed personal and professional information belonging to more than 41,000 Department of Homeland Security employees, according to a report. The exposed records reportedly include names, phone numbers, job titles, and work assignments for staff across agencies such as ICE and CBP.
gizmodo.com
· 2026-10-29
Meta has suspended the conversation-sharing feature in its Muse AI assistant after security firm Claroc found that over 6,800 shared chat links were discoverable through public DNS records. Some of the exposed pages contained sensitive business documents and personal financial information accessible without any login. Meta spokesperson Tracy Clayton said sharing has been paused while the company reviews the report and considers changes to how links are generated.
techspot.com
· 2026-10-21
Security firm Claroc found that Meta's Muse AI agent generated shareable chat URLs using the conversation's title as a subdomain, which were recorded in public DNS and discoverable via passive DNS searches. Claroc said it enumerated roughly 6,800 shared Muse links, exposing personal and business data including meeting schedules, a loan application, a bank fraud alert and internal company documents. Meta confirmed to Ars Technica that it has paused the sharing feature while reviewing the report.
engadget.com
· 2026-10-20
Security researchers at Claroc found they could enumerate roughly 6,800 shareable conversation links generated by Meta's Muse AI agent due to a predictable URL-construction method. Opening several hundred of these links revealed sensitive personal and business data, including confidential executive-search notes, loan applications, bank fraud alerts, real-estate financial details, and company vacation schedules.
arstechnica.com
· 2026-10-20
Security researcher Sammy Azdoufal gained access to the backend database behind Energize Lab's Eiliko robot companions, reportedly exposing 13 million conversations from the company's entire 68,000-device fleet, according to an investigation by The Verge. The exposed data included detailed user profiles with names, ages, birthdays, occupations and personality traits, plus email and IP addresses, and over 31,000 profiles belonging to children. Azdoufal also demonstrated he could remotely alter what a device said, including making it issue sexually explicit commands.
techspot.com
· 2026-10-17
Denmark's Central Person Register (CPR) confirmed that unauthorized parties exploited a private company's legitimate access to the system to obtain names, addresses, CPR numbers and other personal data belonging to roughly 8.8 million registered citizens. Records of citizens who had opted for name and address protection were not affected. Authorities have cut off the company's access, reported the incident to the Danish Data Protection Agency, and police are investigating alongside other relevant agencies.
cpr.dk
· 2026-10-05
Cyber risk firm UpGuard scanned around 300,000 domains using Supabase and found more than 16,000 databases with misconfigured access controls exposing readable tables. Over half contained personally identifiable information, with smaller subsets exposing plaintext passwords, authentication tokens, and in some cases credit card data. Specific examples cited include a US valet service exposing 100,000+ customer records, a Canadian immigration service leaking 884 plaintext passwords, and an African government consulate exposing 25,000 records.
bleepingcomputer.com
· 2026-09-28
Cybersecurity firm UpGuard identified roughly 16,000 Supabase-hosted databases that were publicly accessible, exposing personal information including names, addresses, phone numbers, passwords and some authentication tokens. Supabase, a backend platform valued at $10 billion this year, has seen surging use among developers building AI 'vibe-coded' apps, and has previously faced criticism over how customers configure database security.
techcrunch.com
· 2026-09-25
Trezor has revised the scope of its August data breach, now saying 81,000 customers were affected instead of the roughly 14,000 first reported. The increase stems from logistics partner ShipMonk failing to delete older records as its contract required, exposing details of 67,000 additional U.S. customers who ordered between November 2019 and August 2021.
bleepingcomputer.com
· 2026-09-07
GoKawiil