AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
13 Aug 2026, 9:32 PM	The Register	6.5	Mystery attacker spent a year raiding Salesforce and ServiceNow portals Researchers at Reco have tracked an attacker dubbed "City-Forum" spending over a year harvesting data from over-permissioned Salesforce and ServiceNow guest portals worldwide, targeting telecoms, banks, cybersecurity firms, and public sector bodies since at least March 2025. The attacker used custom tooling against Salesforce Lightning Web Runtime sites via the UI API's GraphQL layer and a little-documented ServiceNow Service Portal search endpoint, exploiting misconfigured guest permissions rather than platform vulnerabilities. The busiest target logged over 560,000 enumeration events from the attacker's IP. Why: If you ship customer or partner portals on Salesforce or ServiceNow, audit your guest user permissions and disable self-registration where possible—this campaign proves over-permissioned guest accounts are being actively and systematically raided right now. The attack vector is configuration, not a CVE, so no patch will save you; only tightening guest access and reviewing what records guests can read will. security salesforce servicenow misconfiguration data-leak

Date

Provider

Score

Summary

13 Aug 2026, 9:32 PM

The Register

6.5

Mystery attacker spent a year raiding Salesforce and ServiceNow portals

Researchers at Reco have tracked an attacker dubbed "City-Forum" spending over a year harvesting data from over-permissioned Salesforce and ServiceNow guest portals worldwide, targeting telecoms, banks, cybersecurity firms, and public sector bodies since at least March 2025. The attacker used custom tooling against Salesforce Lightning Web Runtime sites via the UI API's GraphQL layer and a little-documented ServiceNow Service Portal search endpoint, exploiting misconfigured guest permissions rather than platform vulnerabilities. The busiest target logged over 560,000 enumeration events from the attacker's IP.

Why: If you ship customer or partner portals on Salesforce or ServiceNow, audit your guest user permissions and disable self-registration where possible—this campaign proves over-permissioned guest accounts are being actively and systematically raided right now. The attack vector is configuration, not a CVE, so no patch will save you; only tightening guest access and reviewing what records guests can read will.