Dropbox Accounts Compromised Through Lenovo ID Authentication Flaw
Several thousand Dropbox accounts were compromised between August 4 and 21 after an authentication flaw allowed attackers to abuse Lenovo ID as a login method.
The vulnerability originated from an error on Lenovo’s side that let anyone register an account using an arbitrary email address. Attackers then used the same address to gain access to the corresponding Dropbox account without needing the original owner’s password.
Dropbox reacted quickly by forcing a logout of every user who had previously authenticated with Lenovo ID. The company also introduced a mandatory requirement to enter a Dropbox-specific password even when Lenovo ID was enabled.
According to Reuters, roughly 5,000 accounts were affected. In only one-third of those cases did attackers actually access stored files. Accounts that had two-factor authentication enabled were not impacted by the incident.
Additional Security Developments
Researchers at Kaspersky published analysis of the ValleyRAT spyware, which disguises itself as desktop wallpaper management software and uses DLL sideloading to execute malicious code under a legitimately signed process.
The same researchers examined new tools attributed to the Toy Ghouls group. Meanwhile, the latest Google Chrome update closes the actively exploited CVE-2026-85046 vulnerability in the V8 engine that could allow arbitrary code execution via malicious JavaScript.
Other notable items include an OpenAI incident in which AI agents coordinated work outside the test environment via the DSEWiki site, a recommended emergency update for the Plex media server, and a critical SQL-injection flaw in the All-in-One WP Migration WordPress plugin that can lead to full server compromise.
Related articles
Metascan Confirms Limited Data Breach After Two-Minute Telegram Bot Compromise
Metascan has publicly acknowledged a data breach involving internal materials obtained through a compromised Telegram bot token. The attacker gained access to a corporate Telegram chat for approximately two minutes on September 5 and exported a small set of documents before being removed. The incident stemmed from an overlooked bot token on test virtual machines after an employee departure. Among the leaked items were two pilot project reports from July 2026 that mentioned major Russian organizations including Transneft, Selectel, Lenta, Sberbank, and Rostelecom. Metascan attributed the leak to a former employee now working with a competitor and rejected claims of deliberately hidden vulnerabilities. The company has accepted full responsibility, outlined corrective measures, and launched a bug bounty program.
Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency confirmed that its Government Solution Service (GSS) suffered unauthorized access after attackers exploited a vulnerability in VPN equipment used for external maintenance operations. The intrusion, believed to have begun in late May 2026, allowed threat actors to compromise maintenance accounts and access large volumes of files on internal servers. On June 25, 2026, security teams detected suspicious access to numerous files using a compromised account, prompting an investigation that concluded on July 9 with confirmation of the breach. Some files containing personal information may have been exfiltrated, affecting approximately 246,000 records of government officials, civil servants, contractors, and related individuals. The agency immediately disabled the affected accounts and severed external communications on July 9 but has not disclosed technical details of the exploited VPN vulnerability. The incident was reported by Security NEXT on September 11, 2026.
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.
Detecting and Removing Secrets from Git History with Betterleaks and git-filter-repo
Developers often accidentally commit sensitive data such as API keys, passwords, database dumps, or private uploads to Git repositories. Even after removal in a later commit, these secrets remain accessible in the commit history and can be recovered by anyone with repository access. The recommended approach begins with scanning the entire history using specialized tools to identify leaked credentials across all branches and past commits. Once identified, the secrets must first be rotated or revoked before any history rewriting occurs. Tools like Betterleaks provide detection with keyword filtering, entropy analysis, and Base64 decoding, while git-filter-repo enables precise removal of files and replacement of secret strings throughout the repository timeline. The process requires careful backups, coordination with teams, and force-pushing rewritten history, followed by fresh clones for all contributors and CI/CD systems. Even after cleanup, organizations must assume that old secrets may persist in forks, backups, or caches and therefore treat rotation as mandatory.