OSF discloses security incident exposing user names, emails and project metadata
peterwildeford · x · 2026-10-30
The Open Science Framework disclosed an October 2026 security incident: an access-control issue across 16 endpoints in an internal admin app allowed unauthorized external access to user names, email addresses, and three metadata fields (GUIDs, titles, descriptions) for public and private projects, registrations, and preprints. Earliest logged access was October 24, 3:42 pm ET; the team detected it October 27 and disabled the app by 10:00 am. The issue has been resolved.
Related event: Open Science Framework discloses access control breach exposing user data(2 posts)→
More from Safety
- Frog and Toad meme nails the HSM paradox: keys stay safe, but compromised servers can still sign — rickasaurus · 2026-10-31
- Heads Of Security: paper pinpoints and rewires attention heads behind prompt injections — jonasgeiping · 2026-10-31
- House Democrats resolution: no bailouts for failing AI companies — your data goes to bankruptcy court — alex_verem · 2026-10-31
- Amazon Echo kills local voice storage: everything goes to the cloud from March 28 — alex_verem · 2026-10-31
- DOJ's first crackdown on AI-assisted "ghost students" seizes $750K+ in crypto — Ars Technica AI · 2026-10-31
- Researcher Finds 600+ Bugs in LLM Kernel Code; Claude Blocks Safety Analysis — pmddomingos · 2026-10-31