France's Secure Messenger Left 73,000 Accounts Exposed

France built Tchap, a government-issued encrypted messaging platform, specifically for public sector employees to communicate securely. The idea was sound. The implementation had a gap, according to BleepingComputer.

An attacker used a single compromised user account to get into the platform. Private conversations stayed protected by encryption. Public chat rooms, however, were not encrypted, and everything shared in them was exposed. DINUM (France's government digital affairs directorate) disclosed the incident and notified CNIL, France's data protection authority. The attacker may have accessed information shared by around 9% of all registered users, which works out to more than 73,000 employees across the French public sector.

Think of it like a building with a top-grade lock on every office door but an open, unwatched lobby. One stolen access card and the attacker has the run of the common areas.

What you should do: On any messaging platform, treat public and group channels as open rooms. Never share sensitive information there, regardless of how the app markets itself. Private, one-to-one encrypted messages are a different category. Know which type of conversation you are in before you type.

Researchers at Tenet Security have described a new attack class called Agentjacking, according to The Hacker News.

The attack runs through Sentry, an open-source tool developers use to track application errors and performance. Sentry's event ingestion accepts payloads from anyone holding a DSN (Data Source Name, a credential tied to a project). An attacker submits a fake error report through Sentry. The Sentry MCP server (a connector that delivers external data to AI tools) feeds this fabricated content back to the coding agent, which processes it as verified system data. Agents like Claude Code and Cursor then run whatever the attacker has embedded. Environment variables and Git credentials can be exposed in a successful attack.

If you use Sentry alongside AI coding tools, review who holds your project's DSN and restrict what your error-tracking setup can receive.

What Ivanti Sentry is: A security gateway appliance (formerly MobileIron Sentry) that organisations use to manage and secure mobile device access to enterprise email and internal applications.

What it is: An OS command injection flaw (a weakness where attacker-controlled input is passed into operating system commands without validation) that allows full remote code execution on the device. No login required.

Who's at risk: Organisations running an unpatched Ivanti Sentry appliance with admin portal endpoints reachable from the public internet.

CVSS: 10/10 (Critical). Patch today. This is the maximum possible score.

Root cause: The software passes attacker-supplied input directly into system commands without checking what it contains. The device treats whatever is submitted as a legitimate instruction and executes it, with no authentication step in between.

Attack vector: An attacker sends a crafted HTTP request to the exposed admin portal, with malicious OS commands embedded in the payload. No credentials are needed. The server processes the request and runs the injected commands with root-level privileges, granting the attacker full control of the device from a single unauthenticated connection.

Detection strategies:

1. Unexpected outbound connections from the Sentry appliance to unfamiliar external addresses.
2. Admin portal logs showing access from unknown source IPs, particularly around or after June 10.
3. New processes running at root level on the appliance that were not present before patching.

Recommended actions:

1. Upgrade to Ivanti Sentry 10.5.2, 10.6.2, or 10.7.1 immediately (patches released June 10).
2. Block admin portal endpoints from public internet access now, regardless of patch status.
3. Enable mTLS (mutual TLS — where both sides of a connection must verify each other's identity) if your deployment supports it.

Two separate research teams this week demonstrated that OpenClaw, a popular self-hosted AI agent, can be manipulated into running attacker-controlled code or handing over sensitive credentials, according to The Hacker News.

Imperva found that hiding instructions inside shared contacts, vCards, or location pins was enough for the agent to act on them without the user ever seeing them. Varonis showed that a single plain email could talk the agent into forwarding cloud credentials and a customer data export to an outside address.

Imperva's finding is patched in OpenClaw version 2026.4.23. The Varonis finding is structural: the fix is not a software update but a policy. Limit what your AI agent can access, restrict which actions it can take without your confirmation, and audit what integrations it holds.

If you run OpenClaw, update to version 2026.4.23 today.

CISA issued Binding Operational Directive BOD 26-04, a mandatory policy instruction for US federal civilian agencies, according to BleepingComputer. Agencies must patch any actively exploited vulnerability within three days of notification. The Ivanti Sentry flaw in today's Vulnerability Watch is the first live test: federal agencies have until this Sunday. The directive applies to government networks, but the three-day benchmark is a signal for everyone. If you manage IT systems, audit whether your patch process can actually meet a 72-hour window when it matters.