X is investigating a surge of unsolicited password reset emails following the launch of its X Money payments service. The company believes the incidents may be connected to the new platform.
X users have reported receiving unexpected password reset notifications, prompting the platform to launch a formal investigation into potential account compromises.
The timing coincides with X Money's rollout, X's newly introduced payments feature. While X has not confirmed a direct link between the two events, the company suspects a connection based on the wave's onset.
Password reset emails are a common vector for account takeovers, particularly when users receive them unsolicited. Attackers typically use such messages to either reset credentials or identify vulnerable accounts.
X has not disclosed the number of affected users or whether any accounts were successfully compromised. The company has not provided guidance on whether the incidents stem from compromised credentials, database vulnerabilities, or social engineering tactics.
Users reporting suspicious activity have been advised to monitor their accounts and change passwords if needed. X Money remains in limited rollout as the company continues its investigation.
Threat actors are leveraging the legitimate Faronics Deploy endpoint-management platform to gain administrative control over targeted computers and install ScreenConnect remote support software.
Aesto Health disclosed a data breach affecting over 9.5 million individuals. The company discovered the unauthorized access to patient information recently.
Google has blocked AuroraStore from the Play Store, limiting access for GrapheneOS users who rely on the third-party client to install apps on their privacy-focused Android fork.
Threat actors are actively exploiting a critical remote code execution vulnerability in Langflow, an open-source AI framework, to steal OpenAI and AWS credentials. The unauthenticated flaw (CVE-2026-0768) requires no login to trigger.