Fireworks AI, a startup that helps businesses run AI models, disclosed a second known security breach within weeks. The latest incident occurred Oct. 24, when an unauthorized party breached an external cloud provider hosting Fireworks’ machines. Tens of thousands of files were involved, some containing customer data, though the company did not specify which customers or what information was exposed. Fireworks said it is working directly with affected customers, including Notion and Cursor; its customer base also includes legal technology company Harvey.
The earlier breach, disclosed in early October, involved attackers using internal Fireworks credentials to access customer accounts. The company’s investigation found that account and billing information was affected, and that a limited number of accounts also had secrets, datasets and unfinished models exposed. Fireworks said evidence connects a criminal threat group to that incident but has not identified a culprit for the latest breach. It is investigating with cybersecurity firm Palo Alto Networks and has notified law enforcement. The company, backed by Nvidia and AMD, was valued at $17.5 billion in July and is reportedly discussing a funding round at a valuation of $30 billion to $40 billion.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US Commerce Department has delayed adding Singapore-based Megaspeed to a trade blacklist, despite concerns it helped smuggle Nvidia chips into China. Other agencies pushed for the listing, while Commerce said it needed more information about some companies under review. (ft.com)
Wyndham’s Android app contained a password that gave access to an internal database holding customer details, login tokens, and company files. Wyndham revoked the credential after a researcher reported it, but the company has not said how many records were exposed or whether customers will be notified. (techcrunch.com)
Seven months into Project Glasswing, Anthropic has logged 37,966 security findings but made only 217 fixes, while adding nearly 12,000 findings and just 15 fixes since September. Maintainers are also disputing many scanner reports, raising questions about the project’s claimed accuracy and the burden placed on open-source teams. (vulncheck.com)
rVPN is an open-source VPN protocol that disguises encrypted traffic as ordinary HTTPS to work around VPN blocking. It uses a Rust core, rotating encryption keys, and probe-resistant decoy responses, with code and builds available for verification. (rvpn.org)
CVE-2026-116928 is a remote code execution vulnerability in Windows Search. The provided information does not specify its cause, impact, or affected versions. (msrc.microsoft.com)
A flaw in OpenSSH on Alpine Linux and other musl-based systems can let attackers bypass password authentication with a single SSH connection. Install the security patch and restart OpenSSH; systems with password authentication enabled and no PAM are affected. (zdnet.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.