An employee at an e-commerce payments company describes years of neglected security problems and a recent major breach. The company handles millions of dollars in monthly transactions for thousands of clients, yet reportedly used insecure practices including passwords in API query strings, unencrypted client secrets, shared staging and production credentials, default service passwords, and overly broad AWS keys. Its code also contains common vulnerabilities such as cross-site scripting, server-side request forgery, and SQL injection. The employee says PCI audits were handled by temporarily changing systems rather than fixing underlying weaknesses, and that security received little attention until the breach.
In the latest intrusion, attackers reportedly obtained the codebase, databases, client credentials, and card numbers, and gained root access to production servers. The company took roughly two weeks to detect the compromise; the attacker was identified after using the deployment pipeline to alter code or servers. With logs retained for only 30 days, the duration of access remains uncertain, and coworkers recall an earlier breach. The employee believes the incident was preventable and says leadership’s explanation to staff obscured the truth. They are trying to leave but cannot afford to quit, fear unemployment could leave them homeless, and have found little guidance in whistleblower protections. They ask what to do, including whether consulting a lawyer makes sense.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a critical Linux IPv4 TCP handshake use-after-free, remotely exploitable without authentication and potentially allowing root command execution on servers with multipath TCP listeners. Upstream fixes are available, but Ubuntu and RHEL had not yet shipped patched kernels as of October 29, 2026. (atlasum.net)
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
VOLTA infostealer steals credentials, financial data, and personal details, then sends an evidence bundle to an LLM to rank victims by potential value. If a model refuses, the malware tries a chain of other models, making AI a key part of its intelligence-gathering workflow. (blog.talosintelligence.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.