Loading story…
A critical insecure direct object reference (IDOR) vulnerability in the American Archive of Public Broadcasting (AAPB) website allowed unauthorized downloading of protected and private media since at least 2021. The flaw, exploited via a simple Tampermonkey script, was patched within 48 hours after recent disclosure. The extent of unauthorized access and distribution of archival content remains unknown.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The American Archive of Public Broadcasting addressed a website bug that had exposed restricted media content. Multiple reports on September 22-23, 2025 indicate the issue was remediated by the time of publication.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Archive confirmed a breach that exposed data tied to **31 million user accounts** after attackers displayed a malicious JavaScript pop-up on the site announcing the intrusion. According to reporting validated by security researcher Troy Hunt and others, the stolen data dated to September 2024 and included **email addresses, screen names/usernames, bcrypt password hashes, and other system data** from the organization's digital library platform. The disclosure unfolded as Internet Archive was also contending with **intermittent distributed denial-of-service attacks** that disrupted availability and a site defacement linked to a compromised JavaScript library. Founder Brewster Kahle said security upgrades were underway; hacktivist group **BlackMeta** claimed responsibility for the DDoS activity, while the actor behind the underlying data theft was not identified. The breach was later cataloged by Have I Been Pwned as affecting 31 million records.
Jun 29, 2026
A critical, **zero-click unauthenticated OS command injection** vulnerability was disclosed in the open-source video hosting/streaming platform **AVideo**, tracked as **CVE-2026-29058**. The flaw affects versions **prior to 7.0** (including **6.0**) and allows remote attackers to execute arbitrary operating system commands on the server without user interaction or prior privileges, creating a path to **full server compromise**, **data exfiltration** (e.g., configuration secrets, internal keys, credentials), and **service disruption**. The issue stems from `objects/getImage.php`, where attacker-controlled input in the `base64Url` GET parameter is Base64-decoded and incorporated into a double-quoted `ffmpeg` shell command without proper escaping/neutralization of shell metacharacters and command substitution (CWE-78). The vulnerability was reported by security researcher **Arkmarta**, and remediation is available by upgrading to **AVideo 7.0 or later**, which includes the official patch.
Jun 29, 2026
Nine PBS in St. Louis lost access to more than **50TB of archival and programming data** spanning roughly **70 years** after its contracted cloud storage provider, Open Source Storage (OSS), apparently ceased operations and stopped responding. The broadcaster said OSS's website disappeared and the company was listed as delinquent with the Colorado Secretary of State, leaving Nine PBS unable to retrieve decades of television history and organizational records. Court filings cited by reports say the data was being hosted by **Iron Mountain** on OSS's behalf, but Iron Mountain refused to release the archive on the grounds that OSS owned the stored materials. A court ruled that Nine PBS has the right to access its data and that OSS should facilitate transfer to a new vendor, yet the broadcaster is now also pursuing action against Iron Mountain to prevent deletion and recover the archive. Discussion of the case has also highlighted the operational risk of relying on a single third-party storage provider without accessible backup paths.
Aug 17, 2026