23 Million Gyazo Records Hit in Server Attack

Gyazo is a cross-platform tool that lets you capture screenshots, GIFs, and short screen recordings, then instantly share them via a link. Millions of people use it daily for quick visual communication. On 11 September, a hacker found a vulnerability in Gyazo's image upload server and used it to run malicious commands on the system, according to SecurityWeek. Helpfeel, the Japanese company behind Gyazo, removed the attacker the following day — but not quickly enough.

In that window, the hacker accessed roughly 23.6 million user records. What's in them: names, email addresses, password hashes (scrambled versions of passwords), device IDs, X (Twitter) integration tokens, billing information, and usage data. Payment card numbers were not taken.

The more alarming number is 490 million — that is how many image metadata records were also accessed. That metadata could allow someone to reconstruct URLs for images users may have believed were private. A list of private images was also compromised, though Helpfeel has not confirmed how many.

What you should do: Change your Gyazo password now, and change it anywhere else you used the same one. Enable two-factor authentication on your account if you haven't already. If you stored anything sensitive in a Gyazo screenshot — a document, a login screen, anything confidential — treat that content as potentially exposed.

Spain's data protection authority, the AEPD, this week described a confirmed incident in which a hacker used an AI agent (an autonomous AI system that can chain tasks together and act without step-by-step human instruction) to breach an unnamed organisation's internal systems, according to Dark Reading.

The attacker directed the AI to scan for exposed files belonging to the target. That sweep turned up corporate credentials. The AI then logged into an internal application and searched for further vulnerabilities inside it — finding one. The attacker used that access to modify personal data records and pull corporate invoices.

The concern here is speed. A human attacker pauses, thinks, and reacts. An AI agent runs continuously, adapting at machine speed. Incident response built around human-paced attacks is not designed for this.

What you should do: If you manage any corporate systems, audit what is publicly accessible — exposed configuration files and credential stores are exactly what these scans hunt for.

What Orkes Conductor is: Conductor is an open-source enterprise framework used by organisations to coordinate microservices, automated workflows, and AI agents — think of it as the traffic controller that tells different software components what to do and when.

What it is: A critical RCE (remote code execution — a flaw that lets an attacker run their own commands on your server) that requires no login to exploit. An attacker can send a single crafted request to the workflow API and gain full control of the server.

Who's at risk: Any organisation running Conductor versions older than 3.30.2 with the workflow API reachable from outside their internal network.

CVSS: 9.8 (Critical — patch today).

Root cause: Conductor's INLINE task type evaluates user-supplied JavaScript or Python expressions. The evaluator runs inside a GraalVM context — a runtime environment for code — configured with all host access enabled. That setting disables the sandbox (the protective barrier that normally stops code from touching the underlying system). Attacker-supplied code escapes directly into the Java runtime and executes OS commands. The server enforces no authentication by default, so the API endpoint is entirely open.

Attack vector: An attacker sends a single unauthenticated HTTP POST request to Conductor's workflow API. The request registers a new workflow containing a hostile INLINE task with embedded malicious code. Conductor evaluates the expression, the sandbox check fails silently, and the code executes as the Conductor process — which commonly runs with root privileges. No credentials, no phishing, no foothold required. Proof-of-concept code has been public since early August, and Fortinet recorded roughly 1,300 exploitation attempts in a single 48-hour window in September, per SecurityWeek.

Detection strategies: Look for unexpected POST requests to /api/workflow endpoints in your web server logs, particularly from external IPs. Monitor for unusual process execution spawned by the Conductor service — commands like curl, wget, or shell invocations are red flags. Review running workflows for any INLINE tasks you did not create.

Recommended actions:

1. Upgrade to Orkes Conductor version 3.30.2 or later immediately.
2. Place Conductor behind a firewall and block all external access to its workflow API endpoints.
3. Enable monitoring for suspicious workflow submissions and review any system running a vulnerable version for signs of prior compromise.

CISA (the US Cybersecurity and Infrastructure Security Agency) is retiring its weekly vulnerability bulletins on 28 September, shifting focus to its Known Exploited Vulnerability (KEV) Catalogue — a curated list of flaws that attackers are actively using in real attacks, per Dark Reading.

The reasoning is sound: vulnerability disclosures are surging (Microsoft recently disclosed close to 1,000 in a single monthly update), but the subset attackers actually exploit remains small. Chasing every CVE is a losing game. Prioritising the ones in the KEV list is not.

What you should do: Bookmark CISA's KEV Catalogue. Check it weekly. If any software you run appears on it, treat that patch as urgent — this list only includes vulnerabilities with confirmed real-world exploitation.

The European Commission has outlined the EU KIDS Act, a proposal that would bar children under 13 from social media entirely and require parental "mini accounts" for 13–15 year olds, with screen time capped at one hour per day, according to The Record. Platforms would be required to deploy age verification tools and build services that are safe by default — not something parents have to configure themselves. The proposal still needs approval from the European Parliament and member states before becoming law.