Topic
An attack that replays stolen username and password pairs against login endpoints at scale to find accounts where the credentials still work.
The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.
Perspective Coverage
10 publishersReality
Shinhan Bank exposed data on about 25,000 customers through a loan-broker inquiry platform kept apart from its core banking systems. Yonhap reports AI may have automated the credential stuffing, so the side systems that touch customer data are where lenders' security spending now gets tested.
Perspective Coverage
4 publishersReality
Domino's has reset a "very small number" of customer accounts that attackers opened with passwords leaked in breaches at other sites. The company says its own systems held, but a correct stolen password was all an attacker needed to get in.
Reality
Cloudflare launched an Early Access fraud dashboard built on per-account login and signup histories, arguing AI-faked identities now beat one-time checks. How much it catches depends on how much of a site's login traffic Cloudflare's edge actually sees.
Reality
The argument for Cloudflare's new bot engine is economic: attackers iterate in days while defenses ship in discrete managed releases, so the plan is to give automated probes nothing stable to learn from.
Perspective Coverage
3 publishersReality
DataDome measured malicious bot activity up 124% in the year to June 2026 against 13.2% growth for humans, and its own detection test found most popular sites challenged none of ten simulated bots.
Reality
DataDome says malicious automated traffic grew 124% in the year to June. Its June test of 21,491 popular sites found that claiming a trusted crawler's name is usually enough to get through the door.
Reality
A dev.to layering guide for self-hosted Laravel admins runs from ufw defaults through ModSecurity to a five-per-minute login limiter. Both fail2ban and that limiter depend on resolving the real client IP.
Reality
The notifications describe logins with valid passwords, data down to partial payment card numbers, and service changes made without the customer's consent. Telus did not say how many accounts were affected.
Reality
The 5% comes from one dev.to post's worked example, and it holds only if an attacker's hit rate against your login is near 0.3% and a stolen account resells near $20. At a 0.03% hit rate the same bill is half of revenue.
Reality