Security researchers at Strix discovered a critical authorization vulnerability in a Department of Defense-backed startup that could allow unauthorized access across multiple tenant environments. The flaw went undetected until responsible disclosure.
The vulnerability stemmed from improper multi-tenant authorization checks, enabling potential attackers to access resources belonging to other organizations sharing the same infrastructure. Strix identified the zero-auth issue through systematic security testing and reported findings through coordinated disclosure channels.
The affected DoD contractor operates in a high-stakes environment where authorization failures pose significant national security risks. The vulnerability highlighted gaps in access control implementation—a common oversight when scaling multi-tenant systems.
Details of the discovery gained traction on Hacker News, accumulating 128 points and 52 comments from the security community. Discussions emphasized the critical importance of proper tenant isolation in defense-sector applications and the value of third-party security audits.
The incident underscores persistent challenges in cloud architecture security, particularly when serving government contracts requiring stringent compliance standards. Organizations managing sensitive data must implement rigorous authorization validation across all tenant boundaries.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.
McKesson, a major healthcare and pharmaceutical distributor, confirmed a cybersecurity incident involving unauthorized access to third-party applications. Extortion group ShinyHunters claims responsibility for stealing 284 million patient data records.
Fraudsters are exploiting Microsoft Teams and similar enterprise chat apps to deceive Chinese users into sending large sums of money. The trend has sparked a wave of complaints across the region.