Tag: password
-
Claude Code’s >>Don’t Ask Again<< Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories
A newly identified 2,539 distinct secrets across 1,994 public GitHub repositories, tracing exposure to coding-agent configuration files, Git history, and saved transcripts. Their November 5 research describes how Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside .claude/settings.local.json. Exposed material included production database passwords, cloud credentials, API tokens, and SSH…
-
Claude Code’s >>Don’t Ask Again<< Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories
A newly identified 2,539 distinct secrets across 1,994 public GitHub repositories, tracing exposure to coding-agent configuration files, Git history, and saved transcripts. Their November 5 research describes how Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside .claude/settings.local.json. Exposed material included production database passwords, cloud credentials, API tokens, and SSH…
-
Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.When a user selects “Yes, and don’t ask again,” Anthropic’s AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.Software security company Apiiro said yesterday…
-
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM)…
-
Hackers Target iPhones and Android Phones: Here’s What We Know
Hackers are targeting outdated iPhones and Android phones through infected websites to steal passwords and sensitive data. Here’s how to protect your device. The post Hackers Target iPhones and Android Phones: Here’s What We Know appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-iphone-android-hackers-infected-websites/
-
Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.”While we investigated, we removed access to Reactor and Data Solutions,” the company said. “At this time we continue to have no evidence that any investigations…
-
Alpine Linux SSH Flaw Lets Attackers Log In Without a Password
Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/alpine-linux-servers-openssh-server/
-
OpenSSH sshole Flaw Allows Hackers to Log Into Password-Disabled Linux Accounts Using 257-Character Passwords
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that should never accept a password. The flaw, dubbed *sshole, is tracked as CVE-2026-123158. Any password between 257 and 1,024 characters works. It affects Alpine Linux, OpenWrt, Buildroot, and Yocto, and the OpenSSH team shipped version 10.6p2 on November 5, 2026,…
-
Rental phishing sites use live chat to win over hesitant travelers
Holiday travelers looking for a place to stay are landing on copies of popular rental platforms, complete with host names, ratings and reviews, that ask for their passwords, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/06/holiday-rental-platform-phishing-travelers/
-
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long.OpenSSH, which rates the flaw critical, released version 10.6p2 today to block…
-
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed “*sshole” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/
-
Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. Its dashboard let users build…
-
Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. Its dashboard let users build…
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
Smashing Security podcast #491: How AI agents are spooking the banks
Bank of America has a message for its customers: please, for the love of God, stop handing your banking passwords to your AI assistant. And if your robot does something daft with your money? That’s your problem, not theirs. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-491/
-
mSecure password manager hack prompts password reset warnings
mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/msecure-password-manager-hack-prompts-password-reset-warnings/
-
Passwortmanager mSecure: Nutzer sollen nach IT-Vorfall Hunderte Passwörter ändern
Tags: passwordEin Angreifer ist offenbar an eine verschlüsselte Datenbank von mSecure gelangt. Nutzer des Passwortmanagers sollten ihre Zugangsdaten erneuern. First seen on golem.de Jump to article: www.golem.de/news/passwortmanager-msecure-nutzer-sollen-nach-it-vorfall-hunderte-passwoerter-aendern-2611-214829.html
-
mSecure Password Manager Reports Suspicious Activity, Urges Users to Change All Stored Passwords
mSeven Software, the developer of the mSecure password manager, has advised customers to secure all confidential data stored in the app after detecting >>suspicious activity.<>recently learned of suspicious activity associated with the mSecure password management application.<< The company […] The post mSecure Password Manager Reports Suspicious Activity, Urges Users to Change All Stored Passwords appeared…
-
mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys.The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of…
-
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers’ Linux servers.The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since…