DEV Community: BeyondMachines

Django Patches High-Severity File-Write Flaw in GeoDjango and Three Other Vulnerabilities

BeyondMachines — Thu, 06 Aug 2026 09:01:09 +0000

Summary

Django 6.0.8 and 5.2.17 are out, fixing four security issues: most urgently a GeoDjango flaw (CVSS 8.8) that lets any staff user with view permission on a spatial-field model trigger SSRF or file writes, potentially leading to remote code execution.

Take Action:

If you run Django, upgrade now to Django 6.0.8 or 5.2.17. If you're on an older unsupported version like 5.1, 5.0 or 4.2, assume you're vulnerable and plan a move to a supported branch. If you use GeoDjango, test your spatial lookups before deploying because the fix intentionally breaks some old behaviour, and check who has staff/view access to models with map or location fields. That level of access is all an attacker needs for the most serious flaw.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

De Bijenkorf Warns of Potential Data Exposure Following Third-Party Logistics Breach

BeyondMachines — Thu, 06 Aug 2026 08:01:09 +0000

Summary

Luxury department store chain De Bijenkorf reported a data breach originating at its logistics partner, CEVA Logistics, which potentially exposed customer contact details and purchase history.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Actively Exploited IBM Langflow Vulnerability Allows Unauthenticated Remote Code Execution

BeyondMachines — Wed, 05 Aug 2026 20:01:07 +0000

Summary

IBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requires immediate patching/

Take Action:

If you run IBM Langflow OSS (versions 1.0.0 through 1.10.0), update to version 1.10.1 or later immediately. Attackers are already using this flaw to take over servers. If you can't update immediately, take the Langflow instance off the internet, and check your logs for unexpected superuser tokens or odd Python code being run.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Vincennes School District Shuts Down Servers Following IT Provider Ransomware Incident

BeyondMachines — Wed, 05 Aug 2026 12:01:06 +0000

Summary

Vincennes Community School Corporation temporarily shut down its servers after its technology provider, Advanced Micro Electronics, reported a ransomware incident involving one of its customers. The district stated that its systems and data were not compromised, but the precautionary shutdown disrupted phone and internet services across all school buildings.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Bonava Real Estate Developer Confirms Data Breach Affecting 842,000 Records

BeyondMachines — Wed, 05 Aug 2026 11:01:06 +0000

Summary

Swedish real estate developer Bonava suffered a data breach in July 2026 after the ExfilSquad extortion group accessed its CRM and warranty management systems. The incident potentially exposed 842,000 records containing personal information and property ownership data across multiple European countries.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Thai Department of Land Transport Investigates Massive Vehicle Data Leak

BeyondMachines — Wed, 05 Aug 2026 10:01:07 +0000

Summary

The Thai Department of Land Transport is investigating a data breach that exposed vehicle owner records, including those of the Prime Minister, on unauthorized search websites.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Shai-Hulud Supply Chain Attack Compromises keyv and Hundreds of npm Packages

BeyondMachines — Wed, 05 Aug 2026 09:01:07 +0000

Summary

The Shai-Hulud supply chain attack compromised the keyv maintainer's account to inject a self-propagating worm into hundreds of npm packages, stealing cloud credentials and developer secrets from over 2 billion monthly installs.

Take Action:

If you use keyv, cacheable, cache-manager, flat-cache or related packages, immediately remove the malicious versions from all developer machines and CI/CD pipelines, and treat any machine that ran an install as fully compromised. Rebuild it and revoke (not just rotate) your npm, GitHub, cloud and other keys, and delete the hidden persistence files (~/.local/bin/gh-token-monitor.sh, ~/.config/gh-token-monitor/, the LaunchAgent/systemd service, and the hooks in .claude/settings.json and .vscode/tasks.json) before issuing new credentials.

Going forward, turn off npm install lifecycle scripts by default (npm config set ignore-scripts true) and pin your dependencies, because that single setting would have stopped this attack before it started and don't rely on signed provenance to tell you a package is safe, since this one was signed by the real build pipeline.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Azure Cosmos DB "CosmosEscape" Flaw Allowed Full Cross-Tenant Database Takeover

BeyondMachines — Wed, 05 Aug 2026 08:01:06 +0000

Summary

A vulnerability chain in Azure Cosmos DB's Gremlin API allowed attackers to escape sandboxes, steal a platform-wide master key, and gain full read/write access to any customer or internal Microsoft database.

Take Action:

If you use Azure Cosmos DB (especially with the Gremlin API), rotate your primary account keys now, since Microsoft's fix removed the flaw but any keys exposed earlier stay valid until you replace them. Then move away from static keys altogether by switching your apps to managed identities and role-based access control, and review your Cosmos DB access logs for anything unexpected.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Brazilian SISVISA Database Exposes 79GB of Sensitive Records

BeyondMachines — Tue, 04 Aug 2026 17:01:50 +0000

Summary

A publicly accessible database containing records associated with Brazil’s SISVISA health surveillance system exposed 102,215 documents totaling approximately 79GB, including tax identification numbers, contact details, licensing records, and inspection reports. Public access was restricted after cybersecurity researcher Jeremiah Fowler notified multiple Brazilian agencies.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Cardiovascular Institute of New England Email Breach Exposes Patient and Employee Data

BeyondMachines — Tue, 04 Aug 2026 12:01:50 +0000

Summary

The Cardiovascular Institute of New England disclosed a data breach involving unauthorized access to an email account containing personal, financial, and protected health information belonging to patients and employees. The organization is offering potentially affected individuals complimentary credit monitoring and identity restoration services through Epiq.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

CHAOS Ransomware Group Claims Data Theft from Radia Inc.

BeyondMachines — Tue, 04 Aug 2026 11:01:50 +0000

Summary

The CHAOS ransomware group claims to have stolen 655 gigabytes of sensitive data from Radia Inc., P.S., including patient medical records, corporate financial documents, and employee payroll information. Radia Inc. has not officially confirmed the breach or filed notifications with federal health authorities.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines

Sunrise Company Discloses Network Intrusion and Data Theft

BeyondMachines — Tue, 04 Aug 2026 10:01:50 +0000

Summary

Sunrise Company, a luxury real estate developer, suffered a network intrusion on April 23, 2026, resulting in the theft of personal data. The company is providing credit monitoring services.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines