HackingPassion.comSecurity News
198 posts
Police bought a tool that shows where up to 500 million phones have been over 12 months, without a warrant. The location came out of the ads in weather apps, …
A photo of your license plate could open your car and start its engine from far away. The car’s locks had nothing to do with it. The way in was an admin …
One crafted file opened in Paint could run an attacker’s code. In all 6 countries checked, the Store had no safe Paint. Auto-updates did not help. The fix …
More than 2,000 Windows machines have been taken over by the security tools their owners cloned from GitHub and built themselves. The people getting hit are …
820 fake ordering sites for 35 restaurant chains showed the restaurant’s own menu, then took the card and the bank’s text code. The customers did …
Customers with close to 1,000 logins in one password manager got one email: change the passwords, reset the 2FA, remove the passkeys. No reason given. A German …
1,472,554 TV boxes and other Android devices in over 170 countries shipped with a backdoor. The owners did nothing wrong. The maker put it in the firmware, at …
Freezers in more than 100 stores across ten countries went warm overnight, some set to 50°C. Three weeks after France. The boxes running them were still online, …
Linux servers on Ubuntu 22.04, 24.04 and 26.04 are 18 days behind Debian on a 9.8 kernel bug. 53 minutes, no password, and a server runs commands as root. An AI …
A single web page took over a fully patched Windows computer straight through Microsoft Edge, and the break-in paid 175,000 dollars at a hacking contest. The …
An attacker drained 6.36 billion dollars from Binance in about 20 minutes across ten blockchains. No customer did anything wrong. The way in was one …
USB encryption from five makers opened without the password. Lenovo, Netac, KakaSoft, Nexcopy, SecZure. A Lenovo USB stick with a fingerprint reader was sold as …
About 170 people held their bank card against their own phone and lost €380,000 in three weeks. Dozens were in their 20s and 30s. An app sent the chip to an …
A file from 1993 opens on a fully updated Windows 11 in 2026 and plays like nothing ever changed. It is FreeCell, the card game, 33 years old. What makes it run …
Up to 3 million Windows PCs and 350,000 Macs kept asking dead web addresses for updates to a movie app from 2014. The owners did nothing wrong. The updater had …
9.3 out of 10 for a Signal flaw. After hang-up, the microphone could stay live for the other side, maybe the camera too. Hanging up was the right move. A full …
WhatsApp Help Pages Hid Rules Telling Its Chatbot Not to Recommend a Privacy Regulator 80 help pages on WhatsApp’s website hid text meant only for the …
Plex servers, more than 36,000 of them, sat open to the internet. A day after the attack code went public, some were mining crypto for an outsider. The owners …
More than 22 million PHP installations sat exposed online this week, facing two flaws that need no password. The details leaked before a patch existed. Updating …
Canon, then Stardock, now Siemens. Attackers keep running their code behind a trusted signature. On October 19 Siemens confirmed its own signed program was the …
Spyware got onto Al Jazeera devices through an ad that only had to load on the screen. 45 were targeted, and the owners did nothing wrong. The company behind …
Three bugs chained in order gave an attacker full control of a smart TV, straight over the home WiFi, without the set ever asking for its PIN. The owner did …
77 million shoppers a week. On a Sunday afternoon, the company behind them switched off its own systems. Shelf labels showed last week’s prices. Six days …
8,749,975 Danish ID numbers copied in about ten days. Names and home addresses, the dead included. One company with two employees. Its admin password: 123456. …
Crypto worth more than 86 million dollars was drained from Ledger wallets. Each confirmed case was a wallet bought from a shop Ledger had authorized itself. …
Fridges in hundreds of French supermarkets heated up to 50°C in one night. The food went in the bin. The attackers never set foot inside. The cooling controls …
One click in a Telegram group sent 3 of a victim’s login files to an attacker. The victim opened no file and typed no password. Versions up to 7.2.8 did …
Thousands of Android phones in more than 150 countries came out of the box already infected. The owners did nothing wrong. The malware sat in the phone’s …
A WordPress backdoor was deleted and came back within seconds. Deleted again, back again. It lived in at least 8 places, the server’s memory too, and had …
Home routers from Linksys, TP-Link, D-Link and Tenda are being turned into hidden proxies, and the orders arrive disguised as Google. The owners did nothing …