Sikkerhed 24 september 2025 - 4 februar 2026

A security researcher discovered an unsecured database with 149 million usernames and passwords, including tens of millions linked to Gmail and Facebook accounts. The cache, traced to infostealer malware, was taken offline after the alert. The data included emails, passwords, and login URLs for banking, streaming, and crypto services. The database lacked encryption and had been exposed for nearly a month.

A database with 149 million stolen usernames and passwords, including 48 million Gmail accounts, was found unsecured online and later taken offline after researcher Jeremiah Fowler alerted the host. The cache also contained logins for social media, streaming, crypto, and some government domains. Analysts warned the data could enable automated account takeovers. The database grew in size before it was removed.

Apple said two WebKit vulnerabilities patched in iOS 26.2 may have been used in targeted attacks. Security researchers urge iPhone users to update and restart devices, warning that many have delayed due to dislike of iOS 26’s design. Apple’s December 12 update also covered macOS, Safari, and other platforms. WebKit flaws have been linked to commercial spyware in highly targeted campaigns.

Apple released fixes for two WebKit vulnerabilities used in targeted attacks against iOS versions before iOS 26. Updates were issued on December 12 for iPhone 11 and newer (iOS 26.2) and older models (iOS 18.7.3). Uptake of iOS 26.2 remains low, leaving many devices on older software. Apple urges users to update and restart, but has not disclosed the number or identity of affected users.

Millions of X users were locked out of their accounts over the past 24 hours due to a failed migration of security keys from twitter.com to x.com. Users faced endless two-factor authentication loops and repeated prompts to re-register YubiKeys, even if they never owned one. X had warned affected users to re-enroll keys before November 10. Partial recovery is underway, but many remain unable to log in.

AppLovin shut down its Array app-installation platform in Q3 2025, citing lack of economic viability, the company told Bloomberg. Researcher Ben Edelman collected about 200 user complaints alleging apps appeared on devices without consent after ad interactions; his analysis found hidden code that could trigger background downloads. AppLovin denies any secret installations, insisting all downloads required explicit user approval. The SEC has launched a probe into AppLovin’s data practices.