Cryptocurrency wallet maker SafePal disclosed that an authorization flaw in a third-party order-tracking plug-in exposed personal data of about 39,798 customers, and a threat actor is now selling it. The flaw worked like a parcel tracker that lets one customer see another's order simply by changing the order number, exposing names, email addresses, shipping addresses, phone numbers, and purchase details for orders placed between March 2025 and April 2026. Seed phrases, private keys, wallet passwords, and payment data were not affected. SafePal warned customers to expect phishing and impersonation, and noted that a fake firmware-update lure had already been seen. It has taken down more than 30 fraudulent sites.
Sysdig detailed a financially motivated operator who chained two Langflow vulnerabilities to raid the AI orchestration platform for credentials, part of why CISA just added one of them to its exploited-vulnerabilities catalog. Using a cross-tenant access flaw (CVE-2026-55255), the attacker ran flows belonging to other tenants to steal their large language model provider keys and AWS keys, while a separate unauthenticated code-execution flaw (CVE-2026-33017) took over the host itself. The activity, observed in late June against an internet-exposed Langflow instance, followed a methodical pattern of reconnaissance, flow enumeration, and credential theft. It underscores that AI orchestration platforms concentrate valuable secrets and are increasingly a direct target once left exposed online.
RCI Hospitality, one of the largest US adult-nightclub operators, has confirmed that a breach exposed the personal data of 40,178 people, mostly independent contractors. Attackers got in through an insecure direct object reference (IDOR) flaw on one of the company's IIS web servers, a common web bug where simply changing an ID number in a web address lets you pull up someone else's record. The intrusion began March 19 and was spotted four days later. Stolen data includes names, dates of birth, Social Security numbers, and driver's license numbers. RCI says no customer or financial systems were touched, and the data has not yet appeared publicly.
TrustStrike Labs