Gyazo Breach Exposes 23 Million User Records

🕵️ RESEARCH & DEEP DIVES

• Gyazo Breach Exposes 23 Million User Records and 490 Million Image Metadata Records
  Hackers accessed roughly 23 million Gyazo user records after exploiting a vulnerability in Helpfeel's image upload server.

  • Japanese software firm Helpfeel is notifying users of its Gyazo service, a widely used cross-platform tool for capturing screenshots, GIFs, and screen recordings with shareable links.
  • Compromised user records (~23.62 million, including anonymous accounts) contain names, email addresses, password hashes, user and device IDs, X integration tokens, profile information, usage statistics, and billing information; payment card data was not exposed.
  • The attacker also accessed roughly 490 million image metadata records that could allow threat actors to reconstruct and access URLs of user-uploaded images, plus a list of private images of unknown volume.
  • On September 11, the hacker exploited a vulnerability in Gyazo's image upload server to execute malicious commands; Helpfeel ejected the attacker the next day.
  • Helpfeel says it is still determining the actual number of individuals whose personal information was disclosed without authorization.
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• Microsoft Patches 18 Vulnerabilities in AI, Cloud Products — SecurityWeek

• NightmareStresser DDoS Service Disrupted in International Operation — SecurityWeek

• Brevo Supply Chain Attack Injects Malware Into 100,000 Websites — SecurityWeek

• Are AIs Still Struggling with CAPTCHAs? — Schneier on Security

• A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity — Palo Alto Unit 42

• WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage — The Hacker News

• Netty: netty-codec-memcache: io.netty/netty-codec-memcache: netty: memcache b... — CVE ThreatInt

• Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0A stored Cross-Site Sc... — CVE ThreatInt

• Quarkus-vertx-http: authorization bypass via path normalization discrepancy i... — CVE ThreatInt

• An out-of-bounds write vulnerability exists in some of the Ethernet switches ... — CVE ThreatInt

• WP Recipe Maker through 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Sc... — CVE ThreatInt

• Jeg Kit for Elementor through 3.2.16 - Unauthenticated Stored Cross-Site Scripting... — CVE ThreatInt

• Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution — Cyber Security News

• Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws — Cyber Security News

• Android Apps Can Now Check If Your Phone Is Missing Critical Security Patches — Cyber Security News

• MikroTrick Attack Lets Hackers Gain Full Admin Control of MikroTik Routers Without Login — Cyber Security News

• Hackers Use Fake T-Mobile Rewards Expiry Texts to Lure Users to Phishing Sites — Cyber Security News

• Patchstack Now Protects Your AI-Built Apps — patchstack.com (discovered)

• Interesting look at how anybody can go around US frontier models' cyber restrictions by turning to free Chinese models... — @metacurity@infosec.exchange