Over 50,000 exposed Stripe API keys show how leaked secrets can enable fraud, data access and account abuse within hours. Ransomnews researchers have documented a large-scale leak of Stripe merchant API keys found exposed in public code repositories, GitHub Actions logs, and misconfigured web servers, with over 50,000 unique keys identified in total. The research is practical rather than theoretical: the team tested a sample of the keys, found a meaningful portion still active, and documented exactly how quickly a fraudster could exploit them. The answer is fast. “A dataset published on a data-trading forum on 18 August 2026 contains live Stripe API keys for 659 merchant accounts, along with roughly 35 GB of customer and payment data pulled from them.” reads the report published by Ransomnews. “Ransomnews analysed the files offline and reported the exposure to Stripe before publishing. Stripe itself was not compromised. The keys belong to merchants.” Researchers said that after finding an active Stripe API key, they were able to access a merchant’s customer list, create a fraudulent payment link and make a $1 test charge within 17 hours. The key alone was enough to perform these actions, highlighting the risks of exposed credentials and insufficient API protections. The operations a live Stripe secret key unlocks are extensive: listing customers and their stored payment methods, creating charges and payment intents, issuing refunds to attacker-controlled accounts, modifying webhook endpoints to intercept future payment notifications, and in some cases accessing connected accounts if the merchant had enabled Stripe Connect. A secret key is not a partial credential. It’s full API access. The sources of the leaked keys are unsurprising to anyone who has done developer security work. GitHub repositories — both public and accidentally made public, account for the largest share, typically through hardcoded keys in configuration files, .env files committed without a corresponding .gitignore entry, or keys left in code comments. GitHub Actions build logs are the second major source: when a workflow prints environment variables for debugging, any secret that wasn’t properly masked ends up in a log that anyone with repository access can read. Misconfigured web servers are another major source of exposed Stripe API keys. Researchers found over 3,000 servers revealing Stripe-related strings, with about 12% containing keys that worked against the Stripe API. The source of the 659 exposed merchant keys is unclear, but likely includes infostealer logs, public repositories, exposed environment files and misconfigured backups. The collector’s real advantage was systematically validating the keys, accessing each account and organizing the stolen data. “The dataset doesn’t say, and we are not going to guess at a single source for 659 separate merchants. The realistic candidates are the ordinary ones: secret keys sitting in infostealer logs lifted from developer machines, keys committed to public repositories, keys left in exposed environment files, keys pulled out of misconfigured backups. Stripe’s own documentation says the company scans for exactly this, and describes finding merchant keys on repositories and package registries.” concludes the report. “What the collector added was patience. Gathering keys is common. Validating several hundred of them, then systematically walking the API for each account and archiving the results into a consistent folder structure, is a different level of effort.” Stripe does provide automatic secret scanning through GitHub’s partner program, which flags Stripe keys found in public repositories and can trigger automatic revocation when a merchant opts in. The problem is that opt-in rate is low, the scanning doesn’t cover private repositories, and it has no coverage over build logs, web server misconfigurations, or other platforms where keys surface. Ransomnews also found that some merchants had rotated their keys after a GitHub exposure but left the old keys active, possibly because Stripe doesn’t revoke keys on rotation unless you explicitly delete the old one. The remediation is not complicated. Audit your current Stripe keys against your version control history to see if any have ever been committed. Rotate any key that has touched a public repository, a build log, or a configuration file that wasn’t explicitly protected. Enable Stripe’s restricted keys for any integration that doesn’t need full account access — a webhook handler doesn’t need the ability to create charges. And enable Stripe Radar rules to flag unusual charge patterns that might indicate someone else is using your key before you’ve noticed it’s gone. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data leak)
Researchers tested 31 million patterns to disrupt surveillance AI, with promising results but significant gaps between simulation and real-world use. The Kansas City-based cybersecurity researcher Bill Swearingen spent the past year doing something that sounds almost too simple to work: printing patterns, watching cameras fail to detect them, and repeating. TechCrunch reports that after roughly 31 million tests, he can now generate patterns on demand that block license plate readers and surveillance cameras from recognizing whatever the pattern covers, whether that’s a person or a vehicle. The project is called noRecognition, and the core idea isn’t stealth in the traditional sense. The camera still records everything just fine. What breaks is the detection layer sitting on top of the footage, the software that flags license plates, tracks faces, or spots “activity of interest” across thousands of hours of video. Swearingen’s patterns don’t hide you from the lens; they make the algorithm looking through that lens shrug and move on. Swearingen, co-founder of the SecKC meetup, said his project started for personal reasons. He became concerned about the growing number of surveillance cameras in his town and the possibility of being tracked while attending a protest. What started as a simple experiment later became a reinforcement learning system. He taught the model to create patterns, learn from failures and keep improving. Over time, it learned how to avoid detection by several camera systems. Every time a pattern failed and got detected, the system adjusted and tried again, eventually learning to defeat multiple detection algorithms simultaneously rather than just one at a time. The research dashboard behind the project, published at sandbox.norecognition.org, goes considerably deeper into the numbers than the headline claim suggests, and it’s refreshingly upfront about what’s proven versus what isn’t. The team states its overall objective plainly as “one pattern that defeats every detector,” and by their own account that goal remains only partially met. Their strongest validated result against a detector extracted directly from a real deployed surveillance camera sits at 61.7% non-detection across held-out test subjects, a solid number, but nowhere near total, and still a digital simulation rather than a real-world fabric test. That distinction matters more than it might seem. Most of the dashboard’s headline figures are explicitly labeled as digital, simulated results, meaning the pattern was tested against a virtual camera and printed ink model rather than an actual garment photographed by an actual camera in the field. The gap between “works in simulation” and “works when Donut Media wraps a real 2009 Toyota Yaris in it,” which is the physical test Swearingen ran live at DEF CON, is exactly the gap this kind of research has to close before anyone should treat it as a reliable, everyday privacy tool. “On Friday at the Def Con cybersecurity conference in Las Vegas, Swearingen ran his first real-world test. With help from Donut Media, the test involved covering a 2009 Toyota Yaris with one of Swearingen’s newest patterns to see if the car would be invisible to detection by a Flock camera.” reports TechCrunch. “We proved it was effective,” said Swearingen, though the wheels were a challenge. The video of the demo will be out in the next few weeks, said Donut Media.” That DEF CON demo is where things got concrete. Swearingen covered a car in one of his newest patterns and tested it against a Flock Safety camera, the kind widely deployed for automated license plate reading across the US. He said the test proved effective, though the vehicle’s wheels turned out to be a persistent weak point, curved surfaces apparently don’t cooperate with flat printed patterns the way a car door does. Source Tech Crunch – A photo of a 2009 Toyota Yaris at the Def Con conference in Las Vegas, covered in a pattern made by Bill Swearingen, as part of a test to see if it can defeat surveillance camera detection. Image Credits:Bill Swearingen / Donut Media Swearingen is not publishing his best patterns because he does not want camera makers to easily find and block them. Instead, he is using crowdfunding to develop and sell printed products such as T-shirts and hoodies, with vehicle wraps possibly coming later. It is still unclear whether the project will become a practical privacy tool for everyday users or remain mainly a DEF CON demonstration. Its real effectiveness will depend on how well the patterns work on real clothing, in different weather and camera conditions. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Surveillance camera)
Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. While CEVA's systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who submitted orders on the site. The company then shared this information with the logistics provider to fulfill and ship PokemonCenter.com orders. CEVA Logistics is a subsidiary of the CMA CGM Group, the world's third-largest shipping company. The logistics provider operates 1,000 warehouses, handled 15 million shipments last year, and reported $18.3 billion in revenue in 2025. The company recently suffered a cyberattack in which attackers breached its servers between July 29 and August 1, affecting multiple retailers in Europe.
GitHub is down for some users as a widespread outage is causing errors across the website, API, Actions, Pull Requests, and several other services. GitHub confirmed the outage at 9:40 AM EDT on August 17, 2026, when it said it was investigating reports of performance problems affecting some of its services. The problems quickly spread across several parts of GitHub that developers rely on, including API Requests, Actions, Webhooks, Issues, and Pull Requests. According to GitHub's status page, the company is seeing error rates of around 20% across its web experience and API traffic. GitHub says archive downloads and raw repository content downloads are experiencing error rates of approximately 50%. Likewise, authentication-related services are also having problems, with SAML and OIDC authentication, SCIM, and Team Sync affected by the incident.
Author: Len Noe, Solutions Architect, BeyondTrust Every mature Active Directory environment has a component that quietly holds more power than the people running it usually admit: the Certification Authority (CA). The thing your entire estate has agreed to believe. When it signs a certificate, every machine, service, and authentication flow downstream treats that signature as truth. That is an enormous amount of trust concentrated in one system, and most organizations manage it like a utility installed once and never thought about again. Certighost, tracked as CVE-2026-54121, is a reminder of what happens when that trust is misplaced. Researchers published a working proof-of-concept on July 24, 2026, demonstrating that a low-privileged Active Directory user (holding nothing more than a standard domain account) can coerce an Enterprise CA into issuing a valid authentication certificate for a Domain Controller, then use that certificate to become the Domain Controller.
The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. This incident was discovered after a threat actor using the "ZeroBytes" handle claimed the attack and listed a stolen database for sale on August 12 on the PwnForums hacking forum. "The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number," the French Finance Ministry said.
A seller claims 1.7M McDonald’s employee records were stolen from Azure. An 8,000-row sample appears genuine, but its age and full size remain unconfirmed. A seller on a data-trading forum posted an 8,000-row sample this week claiming it came from McDonald’s own Azure tenant, part of a supposed 1.7 million-record employee directory obtained using stolen credentials. Ransomnews’s technical breakdown found the sample holds up as genuine on every test that can be run against it. What it can’t confirm, notably, is exactly how old the data is or whether the full 1.7 million figure is real. “The listing is a straightforward private sale, posted at 4:08 AM forum time under the title “McDonalds 1.7M+ Azure Internal Employee Dump”. The seller, an account called TheHatman, writes that the data was “downloaded directly from Azure Tenant using compromised credentials” and that it contains “employee accounts, service accounts, and other tenant account records”. No price is named. Buyers are invited to make offers.” reads the report published by Ransomnews. “To evidence the claim, the seller attached a free 8,000-record sample. That file is the entire basis for what follows. Ransomnews analysed it offline. We did not access, probe or authenticate against any McDonald’s system, and we have redacted the sample’s download location from the screenshot below because it still resolves to real people’s contact details.” The file’s structure gives away exactly what it is before you even read a single row. Column names like FacsimileTelephoneNumber and PhysicalDeliveryOfficeName aren’t something anyone invents; they’re the exact property names Microsoft’s own PowerShell directory tools return when an administrator exports a user list from Entra ID, the modern name for Azure Active Directory. Whoever produced this file ran a standard Microsoft export command and saved the output, nothing more exotic than that. Every one of the 50 email domains found in the sample is genuinely McDonald’s-controlled, spanning corporate staff, restaurant crew accounts, franchisee logins, and vendor guest access across more than thirty countries. Three rows even carry the tenant’s own built-in Microsoft address, mcdonaldscorp.onmicrosoft.com, something that’s invisible from outside the organization and simply isn’t guessable or scrapeable. Add in 233 rows with the exact kind of garbled text encoding that happens when someone forgets to specify UTF-8 during an export, plus 85 job titles cut off at precisely 30 characters mid-word, the unmistakable fingerprint of a fixed-width HR system field bleeding into the directory, and you get a picture consistent with a real export rather than something assembled from public sources. “The file is broken in the ways real exports are broken. 233 rows contain mangled characters: Königswinter appears as “Königswinter”, München as “München”, and Ukrainian job titles are rendered as unreadable strings of Cyrillic run through the wrong character set. This is what happens when somebody runs Export-Csv without specifying UTF-8 encoding.” continues the report. “It’s a mistake, and it is not the kind of mistake anybody makes on purpose. A fabricated dataset doesn’t come with authentic encoding damage.” One detail actually reaches outside the file entirely. A restaurant entry for “556 Upton” on Upton By-Pass in Wirral, complete with phone number, matches a real, publicly listed McDonald’s location down to the digit. That’s a small anchor, but it’s the kind of anchor fabricated data doesn’t usually survive contact with. What the sample genuinely can’t settle is timing. There isn’t a single date field anywhere in the schema, no creation date, no last login, nothing to age a row by. “We can say with confidence that the data came out of McDonald’s directory. We cannot say from the file alone when it came out.” The best clue available is McDonald’s own market footprint: no Russian records at all, consistent with the company’s 2022 exit, and no Kazakh ones either, which points to sometime in 2023 or later, a wide window rather than a firm date. The 1.7 million headline number also isn’t something 8,000 rows can verify. That sample is under half a percent of the claim, and while nothing in it looks implausible given McDonald’s global workforce size, plausible isn’t the same thing as confirmed. A seller running a volume trade across multiple companies has every incentive to round the number up in the listing title. This McDonald’s post wasn’t an isolated event either. The same account, going by TheHatman, posted nine listings in total over sixteen days, claiming roughly 3.6 million records combined across McDonald’s, Vodafone, Gap, two hotel chains, and four major IT outsourcing firms including Kyndryl and Tata Consultancy Services. Every listing uses an identical 19-column schema and nearly identical wording, the kind of consistency you get from one person running the same export script against whatever tenant they currently hold a working login for, not from someone fabricating nine separate datasets by hand. That pattern points toward something fairly mundane and fairly common: infostealer malware harvesting saved credentials at scale, feeding a resale market that lets one operator walk into tenant after tenant using logins nobody bothered to protect with multi-factor authentication. Reading an entire company directory doesn’t require a sophisticated intrusion; it requires one working account in a tenant that hasn’t restricted user enumeration, which is Entra ID’s default setting unless an administrator has explicitly locked it down. For anyone at McDonald’s or one of the other eight listed companies, the real risk here isn’t account takeover, since there are no passwords or hashes in the sample at all. It’s social engineering: full names, job titles, direct phone numbers, and internal email formats are more than enough to make a fake helpdesk call or a fraudulent invoice sound completely legitimate. Treat unsolicited contact that already knows your role and your location with more suspicion than usual, because that’s precisely the kind of detail this file was built to hand someone. “For individuals named in the data, there is no action that removes the exposure.” concludes the report.”The realistic response is scepticism about unsolicited contact that arrives already knowing your role and your store, and a refusal to act on instructions that arrive by phone or email without out-of-band confirmation.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, McDonald’s)
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. The incident began on August 16, 2026, at around 21:58 UTC, and is affecting Claude.ai, Claude Code, and Claude Cowork. According to Anthropic’s status page, the company first said it was investigating an issue preventing some users from authenticating to Claude.ai, Claude Code, and Claude Cowork. A few minutes later, Anthropic reported a broader service disruption involving degraded performance on Claude.ai and platform.claude.com. For users, the outage can result in problems signing in, Claude failing to load, requests not completing, or other errors when using the affected services. Anthropic’s status page currently classifies Claude.ai, Claude Code, and Claude Cowork as experiencing a major outage. Claude Console and the Claude API are currently listed as operational.
Confirm this action.
Leaving now will discard your changes.