Password manager Dashlane disclosed that attackers compromised some customer accounts by brute-forcing its two-factor authentication system, gaining access to encrypted password vaults.
Dashlane, one of the largest password management services, confirmed hackers successfully bypassed its 2FA security layer through brute-force attacks. The breach allowed unauthorized access to customer accounts and the ability to download password vaults stored within the platform.
The company did not specify how many customers were affected or provide additional technical details about the attack method. Password managers store sensitive login credentials for users, making them high-value targets for cybercriminals.
The incident raises questions about the effectiveness of Dashlane's two-factor authentication implementation. Users relying on the service for credential storage face potential exposure if their master passwords were weak or previously compromised on other platforms.
Dashlane has not yet announced specific remediation steps or whether customer notifications are underway. The breach underscores ongoing security challenges even among dedicated password management providers.
WordPress disclosed an unauthenticated path traversal vulnerability that could lead to conditional remote code execution. The issue affects WordPress core and has been documented in an official security advisory.
Security researchers have demonstrated an attack allowing hackers with privileged access to register fake MFA providers and harvest user passwords during login. The vulnerability exploits the authentication process itself.
GrapheneOS, a privacy-focused Android fork, is on track to ship preinstalled on commercial devices within three years. The project has gained significant momentum in developer circles.
A Chinese-speaking threat actor has exploited vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to compromise 996 devices and steal over 18,500 database records from government systems.