BadThingsDaily

A combination of bugs has caused llm responses in your application to be delivered incorrectly across tenants. Users report seeing unrelated responses to their prompts from other customers.

Someone has mistaken an "exploit scan" with "in-the-wild exploit". They went and broke embargo on a high profile vulnerability disclosure. That person works for you.

Someone bought a really badass domain name and made a sweet landing page for a vibevuln in your product. No one actually knows if the bug is exploitable or impactful yet but it has gone viral anyways, enjoy your weekend

While responding with an emergency patch to a sudden RCE announcement, you are alerted to a second and third RCE in unrelated platforms you have to patch too.

Developer tooling your engineering organization depends on has suffered an upstream compromise.

Your production neocloud is breached and mid-migration you learn the neocloud you are moving to is breached too.

One of your production certificate keys is just the number 4.

All of your environment variables have been lifted off of engineering's "full stack cloud" environment.

An attack on your neocloud provider has exposed environment variables on the tenant systems you host there.

An RCE is being exploited in the wild on the same production, internet facing web stack you have.

You found a weird doohickey in your office, used an agent to figure out what the doohickey does, and it turns out that doohickey is a listening device planted by an employee

An anonymous account published the answer to RSA-470 yesterday, RSA-480 today, and will publish RSA-490 tomorrow.

A “search warrant” requesting user content was actually delivered from a lookalike law enforcement domain. Your legal org complied.

An obscure feature in your product has suddenly been chosen by an AI swarm for their out of band communication.

An attacker has escaped your virtualized "Sandboxes" where user supplied code is supposed to be executed safely.

Multiple employees have alerted HR that their last direct deposit has gone to an unfamiliar account

You’ve learned a research talk at BH/DC will drop 0day on your product, and you have a short amount of time to prepare.

JavaScript artifacts that deliver your product to customer installed snippets have been compromised. Now your product is swapping out cryptocurrency addresses when viewed directly on your customer install base.

Your cryptographic keys minted in an offline, airgapped ceremony were backed by weak RNG.

You have hit your company wide token usage limits while responding to an intrusion.

An pentesting agent under the impression that it is still on your network has begun attacking a partner network

An adversary has acquired a service wide database master key in your IaaS.

An escaped frontier cyber model has created a malicious dependency that you’ve introduced into your supply chain.

Your CEO's socials are taken over to promote a memecoin, despite having hardened account security. www.reuters.com/lega...

The same leaked credentials have been exploited by overlapping ransomware groups.

An engineer's AI IDE has been instructed to edit its own configuration after viewing hidden instructions on a fetched URL.

Credentials lifted off your on prem "no-code" platform have been accessed after an adversary crafted a malicious workflow.

A malicious commit has executed code in your ci/cd pipeline.

An attacker has remotely executed code through a JSON parsing library in production.

Paging @badthingsdaily.bsky.social, is it bad if you discover that you’ve hired a member of the Com and given them access to your most sensitive data? Asking for a friend.

Potatosecurity Tabletop: Your security vendor just mandated Return to Office. Sales, support, threat research, and detection engineering are facing mass resignations and layoffs. You no longer have a rep in the company. What do you do? Cc @badthingsdaily.bsky.social

We need a @badthingsdaily.bsky.social entry for “your most senior advisors have invited a journalist to a signal chat they’re not supposed to have”

Your DNS registrar experienced a technical downtime at the exact moment your domains were to be renewed. The domain you use for email is one such domain. @badthingsdaily.bsky.social

#badthingsdaily A third-party "artificial intelligence agent" service has just performed edits to every .xlsx file on your Finance shared drive. cc @badthingsdaily.bsky.social

Billing alerts for outbound data transfer have started going off in object storage where your backup databases are stored. Happy Thanksgiving