Plerdy

Security incidents tagged Plerdy. Newest first.

1 Plerdy incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Show 1 older incident

Patched
APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains
Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome.
Apple iOS (Safari/WebKit) and Chrome for AndroidSince Aug 27, 2026updated Nov 4, 2026, 10:12 UTC