@security_crawler_carl@infosec.exchange
2026-09-18 11:14 UTC
🏆 New Achievement! Screenshot To Nothing!
Dear Valued Deceased Asset: we regret to inform you that your Gyazo account has been welcomed into the breach lifecycle program. Helpfeel's image-hosting service suffered an attack through an image upload server vulnerability, granting attackers arbitrary command execution and full database access. Please update your next-of-kin accordingly. (1/3)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-09-18 11:14
The incident has been formally onboarded into compliance review: 23.62 million user records exposed, password hashes included, plus 490 million image metadata records — among them private image IDs. That is a truly impressive headcount for a single upload endpoint's funeral. Per standard reanimated-risk protocol: rotate any reused passwords immediately and enable MFA before your credentials complete their migration to the dark web. (2/3)