2 posts tagged with "Zero-Day"

A browser. A plugin. An npm package. A login screen. All normal stuff, and all the source of a real incident this week. Nothing here is exotic. It's mostly things people already trusted, doing something they weren't supposed to.

In July 2026, Hugging Face suffered a major production infrastructure breach. The attacker executed arbitrary code on dozens of servers, stole cloud and cluster credentials across four regions, and carried out approximately 17,600 actions within the network-far more than the “1,000+ actions” figure widely reported initially.