⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Ghost credentials, or dormant nonhuman identities such as service accounts, API keys, OAuth tokens, and machine-to-machine certificates, create significant security blind spots in cloud environments. These identities are often provisioned for automation and integrations, then forgotten as teams change and projects evolve, leaving them with excessive privileges that go unmonitored.
CubePilot, an Australian drone flight controller manufacturer, suffered a DNS hijacking attack on July 24, 2026, when an attacker gained control of cubepilot.org DNS settings, intercepting traffic intended for internal systems and fraudulently obtaining TLS certificates for all subdomains. This exposed users to credential theft, malware delivery, and phishing — even on pages showing valid HTTPS. CubePilot regained control of its domains the same day, revoked fraudulently issued certificates, preserved evidence, and reported the incident to the Australian Cyber Security Centre and law enforcement.
Thousands of remote hardware management processors, such as IPMI, iDRAC, iLO, and BMC interfaces used to manage data center infrastructure, are exposed directly to the internet without adequate access controls. These out-of-band management controllers provide full keyboard-video-mouse access to servers, allowing anyone who compromises them to power cycle systems, mount ISO images, access console output, and effectively take complete control of the underlying hardware.
This article warns that thousands of data center controllers are exposed online and susceptible to offline password-cracking attacks. Attackers are actively targeting these systems, which could lead to full takeover of data center hardware.
A host of Internet-exposed remote hardware management processors are subject to offline password-cracking attacks, leaving thousands of data center controllers open to takeover. Adversaries have taken note of these vulnerabilities, posing a significant security risk.
Thousands of remote hardware management processors, such as IPMI, iDRAC, iLO, and BMC interfaces used to manage data center infrastructure, are exposed directly to the internet without adequate access controls. These out-of-band management controllers provide full keyboard-video-mouse access to servers, allowing anyone who compromises them to power cycle systems, mount ISO images, access console output, and effectively take complete control of the underlying hardware.