Attention: You are using an outdated browser, device or you do not have the latest version of JavaScript downloaded and so this website may not work as expected. Please download the latest software or switch device to avoid further issues.
| 2 Mar 2026 | |
| Written by Gabi Gerber | |
| Attacks & Threats |
| Security Operation Center, Hacking Topics |
Thousands of Public Google Cloud API Keys Exposed with Gemini Access — New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The problem occurs when users enable the Gemini API on a Google Cloud project (i.e., Generative Language API), causing the existing API keys in that project, including those accessible via the website JavaScript code, to gain surreptitious access to Gemini endpoints without any warning or notice. With a valid key, an attacker can access uploaded files, cached data, and even rack up LLM usage charges, Truffle Security said. The issue has since been plugged by Google. Read more
Threat actors behind the "Phantom Deal" campaign are studying companies in extreme detail, aiming to dupe midlevel employees into initiating large financial transfers. More...
The "Spring Ring" operation aims to compromise users of the collaboration suite to remotely access their sessions, sprea… More...
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a m… More...
OpenAI's Hugging Face attack postmortem shows agents don't care about rules — they need strong controls. More...
An untold number of ZBT routers sold around the world as white-label products come with several implants built by the ma… More...
You can't make an omelet without breaking a few eggs, and you can't patch nearly 1,000 CVEs without a few glitches. More...
Threat actors behind the "Phantom Deal" campaign are studying companies in extreme detail, aiming to dupe midlevel emplo… More...
The "Spring Ring" operation aims to compromise users of the collaboration suite to remotely access their sessions, sprea… More...
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a m… More...
OpenAI's Hugging Face attack postmortem shows agents don't care about rules — they need strong controls. More...
