northflank breached

another one, northflank has been breached:

All users should assume their environment variables are decrypted and begin rotation immediately.

https://news.ycombinator.com/item?id=50305025 https://www.reddit.com/r/cybersecurity/comments/1xjhoby/northflank_breached_rotate_environment_variables/

never heard about them but some companies using their services - hopefully they rotate their keys quickly and protect their networks:

  • Figma - Uses Northflank for backend developer workloads.
  • Factorio (Wube Software) - Integrates Northflank endpoints to power the authentication and infrastructure of its Mod Portal.
  • Sentry - Hosts application monitoring and production error-tracking services on the platform.
  • Singapore Government (GovTech) - Deploys secure public-sector digital and cloud infrastructure solutions.
  • Writer - Manages heavy generative AI pipelines and enterprise language models.
  • Clock - Orchestrates over 70 complex cloud environments for major gaming and entertainment clients like Riot Games, Epic Games, and Critical Role.
  • V7 Labs - Runs and trains large-scale computer vision models and AI data platforms.
  • Weights & Biases (WandB) - Utilizes the infrastructure for MLOps tracking and machine learning experiments.
  • ProjectDiscovery - Operates open-source cybersecurity and automated vulnerability scanning platforms.
  • Catalog - Powers CPU-intensive audio transcoding and multi-node read-write databases for a web3 music platform.
  • Cedana - Deploys and manages containerized, production-grade microVM workloads.
  • CommonLit - Runs staging builds and observability metrics for an ed-tech literacy platform.
  • Yavendio - Scales AI-driven WhatsApp e-commerce tools across regional markets.
  • Mandel AI - Coordinates multi-region AI developer stacks and infrastructure.
  • Trustflight - Secures digital workflow systems and safety management software for the aviation industry.

Describe image+

coldcard bitcoin hack

Following the endless threads on reddit/r/Bitcoin about the coldcard is kind of heartbreaaking. There are many people who lost a fortune, because they used a cold wallet instead of trusting an exchange or multisig. Coldcard had a wrong crypto implementation firmware-bug users should upgrade firmware (security advisory). "hackers" abused that vulnerability last week to drain the funds.

So beside the exchange hacks, crypto draining contracts and websites, now the cold wallets become your enemy as well, multisig or regulated exchanges might be better - but I think most people will tie cryptocurrencies to some unstable, hacky thing. Too complex to use, too unregulated to keep your money safe. That's a huge trust issue I see arising.

Never put all your money on one thing.