FIELD NOTES / THE COMPUTER DISASTERS BLOG
Interrogate the signal.
The internet breaks in ways that don’t always look like an outage. Reviews, evidence, and lessons from the systems shaping what we believe.
CSX: the trains could move, but the railroad could not hand them off
A two-day technology outage left CSX’s safety-control systems operating while disabling or degrading the administrative systems needed to assign crews, create shipment documents and exchange freight with other railroads. The result was a railroad that could still authorize train movements but could not complete much of the work required to move freight end to end.
Open the evidence file →PHP2Shell: the patch window collapsed before it opened
Two critical bugs in PHP exposed web servers to unauthenticated remote code execution, and premature disclosure compressed the response into a global race among patches, precautionary shutdowns and rapidly multiplying exploit attempts.
Open the evidence file →Plex2Shell: four moderate flaws, one critical compromise chain
Plex says attackers are chaining four vulnerabilities in internet-facing media servers to steal administrator authority, write executable code and install miners or proxy software—a case where the combined path matters more than any single severity score.
Open the evidence file →Capcom ID breach exposes 11.7 million account records
Capcom says a third party accessed email addresses and account metadata tied to 11,774,247 CAPCOM ID records worldwide, while 196 accounts had passwords changed without authorization.
Open the evidence file →Times Car: the identity check ended, but the documents stayed
Park24 says an attacker exploited a Times Car web-system vulnerability and exposed data tied to 6,628,007 accounts, including former users and incomplete registrations. The company now plans to delete retained identity-document images and stop keeping them after verification—a costly reminder that data no longer needed is still data that can be stolen.
Open the evidence file →University of Copenhagen: the test environment held real identities
Attackers reached a University of Copenhagen test environment containing personal data on about 525,000 people. A later scope update added PIN codes for roughly 20,000 students and staff, turning a non-production breach into a physical-access problem while the university replaced codes.
Open the evidence file →ZenTech: the coroner’s records went somewhere Justice cannot explain
A cyber incident at New Zealand clinical-research firm ZenTech exposed health and identity data—and, officials now confirm, some Coroners Court information. Current cases were delayed even though court systems were not attacked, revealing a failure of data custody across organizational boundaries.
Open the evidence file →UNM Health: a device-level incident reached the ambulance bay
A cybersecurity event affecting end-user devices at the University of New Mexico Health Sciences Center forced ambulance diversions, appointment and outpatient-surgery cancellations, and academic closures. UNM says core systems and servers were not penetrated, showing that an incident can disrupt care before the central clinical platform is compromised.
Open the evidence file →GMO: the cloud desktop breach reached customers’ trading accounts
A compromise of GMO Internet’s Onamae.com Desktop Cloud installed malicious programs in customer server environments, exposed customer information and reportedly reached active trading accounts. The provider suspended the service and coordinated containment with financial firms; a threatened ransomware phase has not been confirmed.
Open the evidence file →Convertr: one analytics script skimmed every checkout
Attackers appended a payment-card skimmer to a shared analytics file hosted on Brazilian e-commerce platform Convertr’s infrastructure. Because every merchant checkout loaded the file, one modified script could capture card details and CPF identifiers across dozens of stores without visibly breaking purchases.
Open the evidence file →BAE Systems: the courts kept filing, but the notices stopped
A cybersecurity incident at the contractor operating the Bankruptcy Noticing Center halted official bankruptcy notices nationwide. Courts could still accept filings, but the shared delivery layer failed, forcing deadline relief and local workarounds.
Open the evidence file →Google Cloud: one region, thirty broken banking functions
A Google Cloud disruption in London spread through Revolut's banking stack, leaving sign-in, card payments, transfers and ATM withdrawals partially unavailable. The incident shows why regional placement is not the same as tested service continuity.
Open the evidence file →Bullhorn: online again, but not whole
A cyber incident forced staffing-platform provider Bullhorn to disable access across its platform. Regions later returned online, but containment removed technology supporting many features, leaving recruiting workflows, integrations and administrative functions impaired.
Open the evidence file →eMudhra: eight private keys, fewer than 256 guesses each
Eight eMudhra intermediate certificate-authority keys were generated with catastrophically low entropy, making them recoverable from public certificates. Emergency revocation limited the danger, but uneven trust-store behavior left a long tail of software needing updates.
Open the evidence file →
Cold chain. Hot attack.
The French supermarket refrigeration hack: spoiled food, reported fires, and the point where a remote command becomes physical damage.
Open the evidence file →
The OpenCode breach: your keys, someone else’s bill
A weekend breach, linked provider credentials, and the spending controls that may not follow a stolen key. What is known, what remains unanswered, and what affected users should do.
Open the evidence file →
Russia’s influence machine: Trump, bot farms, and the evidence
The historical record, the machinery of manufactured influence, and a close review of the viral Yandex outage video.
Open the evidence file →