Forgotten Website Tags Put iPhones at Risk
Researchers uncovered a massive iPhone spyware pipeline lurking in the digital graveyard of abandoned third-party website tags. Meanwhile, iVerify traced a separate, zero-click infection straight to a seemingly harmless Instagram ad.
Cybercriminals are scooping up the expired domains those forgotten analytics tags still ping, quietly funneling unsuspecting visitors toward Coruna or DarkSword exploits. If you’re stubbornly clinging to an older iOS version, merely loading the trapped page is enough to unleash spyware that happily loots your passwords and crypto wallets.
Update iOS before your digital life gets drained, and consider Lockdown Mode if you’re a high-value target. Website owners need to immediately scrape off their obsolete tags, monitor external scripts, and actually enforce a Content Security Policy.
Because nothing says “modern internet” quite like someone else’s abandoned analytics tool becoming your personal security nightmare.
AI Aggregator Exposed 17.6 Million Files and Private Chats
AI aggregator 302.ai just proved that sharing is caring, exposing 17.6 million files (a massive 22.72TB) in a wide-open Azure storage bucket, according to Cybernews. The platform bundles multiple AI models into one convenient place—which, unfortunately, became a convenient place for anyone to read corporate documents.
Among the loot? Over 144,000 chat logs containing personal details and, awkwardly, customer support chats for a sex doll manufacturer. While the leaky bucket was quietly secured by Sept. 8 with no confirmed data pillaging, the sheer volume of exposed secrets is enough to make any IT admin sweat.
If your team played around with 302.ai, it’s time to review exactly what they overshared. Flag any sensitive corporate data to security and immediately rotate any passwords or API keys that might have been tossed into the chat.
Seems like “private chat” needed a second opinion from the storage settings.
Capcom Hack Exposes 11.7 Million Records
Capcom confirmed a breach exposing 11.7 million CAPCOM ID records.
Attackers also changed 196 account passwords and accessed additional personal data from 19 accounts.
The Capcom breach is a reminder to limit the blast radius of compromised accounts across connected services.
Security teams should enforce least-privilege access and monitor suspicious activity, while CAPCOM ID users should check for unauthorized account changes and replace reused passwords.
Quest Diagnostics Breach Puts Patient Data at Risk
Quest Diagnostics disclosed unauthorized access to its Quanum Lab Services Manager system, potentially exposing patient records.
The company temporarily suspended access to the platform, raising concerns about disruptions to laboratory services as the investigation continues.
As a former nurse, I know how important timely lab results are to patient care. This incident reinforces why healthcare cybersecurity must protect patient data without disrupting care.
Healthcare organizations should review patient data access controls and test backup laboratory ordering procedures to maintain continuity of care during outages.
Arista VeloCloud Flaw Gives Hackers Admin Access
Arista confirmed active exploitation of a SQL injection vulnerability in its VeloCloud Orchestrator platform.
The flaw allows attackers with read-only access to gain privileged control of SD-WAN management.
A compromised SD-WAN orchestrator could give attackers influence over network configurations across multiple locations.
Patch affected deployments and audit SD-WAN configuration changes for signs of unauthorized activity.
Nearly 3,900 SBI Customer Records Exposed
The State Bank of India is investigating nearly 3,900 customer records exposed on the dark web, including personal and loan-related information.
Although SBI says customer funds remain safe, the exposed data could enable targeted financial scams involving bank impersonation.
I’m concerned that exposed customer information could help threat actors pass identity verification checks without directly compromising bank accounts.
Security and fraud teams should review access to customer data and strengthen identity verification to prevent misuse of exposed information.
Smart TVs Keep Talking to Tracking Servers
Researchers found that some smart TVs continued contacting tracking servers even after users disabled automatic content recognition (ACR).
However, encrypted traffic prevented researchers from confirming whether viewing data was still being collected, raising questions about the effectiveness of privacy controls.
One concern here is that consumers have no reliable way to verify whether disabling tracking actually stops their devices from transmitting viewing-related data.
Users should disable ACR and personalized ads, block known tracking domains, and monitor smart TV traffic for suspicious connections.
Is Your Threat Intel Keeping Up?
As cybercriminals use AI to enhance attacks, threat intelligence helps security teams identify relevant threats and strengthen defenses.
How to strengthen threat intelligence:
- Monitor trusted threat intelligence feeds to identify emerging threats and vulnerabilities relevant to your organization.
- Use threat intelligence tools to aggregate threat data and integrate actionable intelligence with SIEM and EDR/XDR platforms for improved detection.
- Track attacker tactics using MITRE ATT&CK to identify security gaps and prioritize defenses against threats targeting critical assets.
Security teams should track which threats identified through intelligence affect critical assets and report on detection gaps and remediation progress.