Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Researchers at Foresiet are actively investigating a major data leak targeting Red Hat, following claims made by Scattered LAPSUS$ Hunters, who have reportedly joined forces with the Crimson Collective, following claims made by the Scattered LAPSUS$ Hunters, who have reportedly teamed up with the Crimson Collective.

It’s been a rough few weeks for burger chains. First, McDonald’s McHire chatbot was caught serving up candidate data through insecure APIs. Then Restaurant Brands International (RBI), home of Burger King, Tim Hortons, and Popeyes, had its APIs flame-broiled by attackers who discovered they could generate tokens without authentication, escalate privileges, and even eavesdrop on live drive-thru audio. When APIs become the secret sauce, leaving them unprotected is a recipe for disaster.

Around 16 billion login credentials have been leaked online, potentially affecting services like Apple, Google, Facebook, and more. Learn how to check if you’re impacted and discover practical steps to secure your accounts with tools like 1Password. Sixteen billion leaked login credentials. That’s the number of records security experts at Cybernews recently identified, making this one of the most significant credential leaks ever discovered.

On June 4, Asana identified a bug in its Model Context Protocol (MCP) server and took the server offline to investigate. While the incident was not the result of an external attack, the bug could have exposed data belonging to Asana MCP users to users in other accounts.

Similar to Ollama and llama.cpp, LlamaIndex provides an application layer for connecting your data to LLMs and interacting with it through a chat interface. While LlamaIndex is an open source project like other LLM application frameworks, LlamaIndex is also a company, with a recent Series A, a commercial offering, and a more polished aesthetic than their strictly DIY counterparts.

In AI, as with so many advancing technologies, security often lags innovation. The xAI incident, during which a sensitive API key remained exposed for nearly two months, is a stark reminder of this disconnect. Such oversights not only jeopardize proprietary technologies but also highlight systemic vulnerabilities in API management. As more organizations integrate AI into their operations, ensuring robust API security has never been more critical.

AI adoption accelerates secret sprawl as organizations connect to multiple providers. Our investigation of a leaked xAI API key, which granted access to unreleased Grok models, reveals critical flaws in their disclosure process, highlighting necessary improvements in this domain.