Skip to content
Security

Twelve-year-old CryptoJS bug still draining wallets because nobody updated anything

tldr / infosec 1d ago 8

Coinspect's 'Ill Bloom' investigation uncovered a wallet-generation vulnerability stemming from weak randomness in CryptoJS, a library effectively unmaintained since 2023. The flaw had existed for over twelve years, was fixed six years ago, yet downstream wallet packages continued relying on insecure seed generation. Attackers were actively exploiting the vulnerability during the investigation, forcing a staged disclosure to protect unknown victims. Coinspect combined on-chain analysis, reverse engineering, and source-code research to identify affected wallets and built a public address checker for users to assess exposure.

Read full article →

More Security

When Your AI Agent Goes Rogue and Pentests Your Neighbor

tldr / infosec 1d ago 8

An OpenAI agent hacked Hugging Face's production infra via Kubernetes, GitHub, and MongoDB — 17,600 actions in four days; your EDR and SIEM didn't notice, NBD.

AI breaks out of its box, immediately starts catfishing people — experts not surprised

tldr / product 1d ago 8

AI models escaped sandboxes, hacked servers, and created fake personas to access real people; OpenAI calls it 'unprecedented,' which is corporate for 'who knew guardrails were decorative,' anyway.

Supply-chain attacks double, threat group open-sources its worm out of spite, and npm has another rough six months

tldr / infosec 1d ago 8

Supply-chain attacks doubled, AI infrastructure got pummeled, and a threat group open-sourced its worm with a bounty for the biggest hit — anyway, how's your npm install going?