Loading story…
NationStates confirmed a data breach after an unauthorized user achieved remote code execution (RCE) on the game’s production server while testing a newly reported vulnerability. The intruder was described as a long-time community member and prior vulnerability reporter who “crossed a line” by moving beyond authorized testing, enabling access sufficient to copy application code and exfiltrate user data; the site was taken offline for investigation and remediation, and the operator stated it is treating the system and data as compromised because deletion claims cannot be verified.
Reporting attributes the root cause to a flaw in the relatively new “Dispatch Search” feature (introduced 2025-09-02), where insufficient input sanitization combined with a double-parsing bug enabled the exploitation chain leading to RCE. Exposed data reportedly includes email addresses, MD5 password hashes, IP addresses, browser User-Agent strings, and potentially some internal messaging content; the disclosures state no financial or real-world identity data was involved. NationStates indicated it is rebuilding or hardening infrastructure and security controls and has reported the incident to authorities, while technical analysis details the attack path and mitigations based on primary-source evidence.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
As part of remediation, NationStates said it would accelerate migration away from MD5 to a modern password hashing algorithm and urged users to change any reused passwords. It also planned additional security improvements and user data review options once the site returned.
After confirming the compromise, NationStates reported the incident to government authorities and began rebuilding systems on new hardware while auditing and hardening code. The company said it was treating the server and data as fully compromised because it could not verify the attacker's claim that the copied data was deleted.
NationStates publicly confirmed the breach and shut down the game site to investigate and remediate the incident. The company said exposed data included email addresses, MD5-hashed passwords, IP addresses, browser User-Agent strings, and possibly some private telegram content.
A player and prior bug reporter reported a critical vulnerability on NationStates but exceeded authorized testing boundaries on January 27, 2026, achieving remote code execution on the production server and copying application code and user data.
NationStates introduced the "Dispatch Search" feature, which later proved to contain insufficient input sanitization and a double-parsing bug that could be chained into remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcerescana.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026
Hunt.io identified an exposed staging server containing custom tooling, logs, and stolen data linked to intrusions at a Philippine nuclear-research agency and a defense-adjacent marine engineering company serving the Philippine Navy. The operator allegedly exploited ownCloud `CVE-2023-49105` to forge pre-signed WebDAV URLs, impersonate users, and collect nuclear operations, personnel, strategic-planning, and credential data; available records indicate roughly 9 GB of data was exfiltrated. The naval contractor’s WordPress environment was separately compromised through LiteSpeed Cache `CVE-2024-28000` and XML-RPC credential brute forcing, after which the actor staged a full website archive and database dump. Researchers assessed with medium confidence that the activity represented targeted collection aligned with Chinese interests amid South China Sea tensions, but did not attribute it to a named group. A separate EtherHiding/NoChain ClickFix infection was also found on the WordPress site, with no evidence tying it to the intrusion operator.
Sep 5, 2026