Misconfiguration
ExfilSquad's Power Pages Rampage Hits UK Police Legal Database, 14 Other Victims
A new extortion group, ExfilSquad, is scraping data straight out of misconfigured Microsoft Power Pages portals with no exploit required — its highest-profile victim so far is the UK's Police National Legal Database, exposing contact data for 135,000 officers and justice staff.
Gitea CVE-2026-20896: Docker Images Trusted a Spoofable Header for Admin Access, Now Under Active Probing
Gitea's official Docker images shipped with reverse-proxy header trust wide open by default, letting anyone who can reach the port impersonate any user including an admin — Sysdig has now caught the first in-the-wild probing, 13 days after disclosure.