FlagThis — Daily Cybersecurity Intelligence Briefing

On September 11, 2026, an unauthenticated attacker exploited a missing authorization check on Gyazo’s image‑upload endpoint, gaining direct read access to the application’s PostgreSQL databases. The intrusion resulted in the exfiltration of 23.62 million user records (email addresses and bcrypt password hashes) and 490 million image‑metadata rows, including session IDs, integration tokens, OCR‑extracted text, and private‑image flags. The exposed data enables credential‑stuffing, token‑reuse attacks, phishing, and potential leakage of corporate‑sensitive screenshots, necessitating immediate password resets, token revocation, and metadata encryption.