Author: HackWatchit

Updated title to reflect thats these are not 64 million unique applicants, but rather applications on the job chatbot. Cybersecurity researchers discovered a vulnerability in McHire, McDonald’s chatbot job application platform, that exposed the chats of more than 64 million job applications across the United States. The flaw was discovered by security researchers Ian Carroll and Sam Curry, who found that the ChatBot’s admin panel utilized a test franchise that was protected by weak credentials of a login name “123456” and a password of “123456”. McHire, powered by Paradox.ai and used by about 90% of McDonald’s franchisees, accepts job applications…

Google and its tracking of user activity is nothing now but a recent study by SafetyDetectives, conducted across the US, UK, Switzerland, and Sweden, reveals the pervasive nature of Google’s tracking mechanisms across the internet. The research, shared with Hackread.com, indicates that while privacy-focused search engines like DuckDuckGo can reduce exposure, completely escaping Google’s reach remains a significant challenge. The study simulated locations using a virtual machine and VPN to ensure accurate regional data collection. The findings reveal that Google’s tracking extends far beyond its own products, embedded deeply within countless websites through tools like Google Analytics, AdSense, and YouTube…

The world of software development is changing fast. AI isn’t just influencing software – it’s reshaping how software is written and the components it’s made of. First, AI-generated code is accelerating development. Code is produced faster, in larger volumes, and often without the same level of review or accountability as human-written code. Second, teams are.. The post Why your AppSec Tool Stack Is Failing in the Age of AI appeared first on Security Boulevard.

Internet neutrality isn’t guaranteed by swapping one watchdog for another. Lately, we’re all increasingly exposed to ads inviting us — or pushing us — to subscribe to a VPN. They use an almost coercive tone: “They’re watching you,” “Your IP isn’t safe,” “Browse with real privacy.” It’s often said that marketing doesn’t create needs, it discovers them. And maybe that’s true. As we solve many of our basic issues — food, clothing, shelter, health, education — our “self” evolves toward new concerns: we still want to live well, but now also without being watched. New fears arise, but also new…

Here’s a look at the most interesting products from the past week, featuring releases from Barracuda Networks, Cynomi, Lepide, Tosibox, and Zenni Optical. Cynomi’s platform updates enable service providers to prioritize their security efforts Cynomi has launched new business impact analysis (BIA) and business continuity planning (BCP) features. Designed to help cybersecurity professionals identify and protect mission-critical business processes, these new capabilities enable service providers to prioritize security efforts, streamline continuity planning, and drive business resilience. TosiANTA delivers anomaly detection for OT environments Unlike security tools adapted from IT environments, TosiANTA operates as a native module within the Tosibox Platform,…

Financial institutions are building stronger defenses against direct cyberattacks, but they may be overlooking a growing problem: their vendors. According to Black Kite’s new report, third-party risk has become one of the biggest cybersecurity threats facing the financial sector. Ransomware attacks by finance subindustry (Source: Black Kite) The vendor blind spot The report finds that while financial institutions themselves are getting better at defending against ransomware and other threats, the companies they rely on, including software providers, infrastructure partners, and external service firms, often don’t meet the same security standards. That’s putting banks, insurers, and other financial organizations at risk,…

McDonald’s job app exposes data of 64 Million applicants Pierluigi Paganini July 12, 2025 Vulnerabilities in McDonald’s McHire chatbot exposed data from 64 million job applicants due to insecure internal APIs. Security researchers Ian Carroll and Sam Curry discovered multiple vulnerabilities in the McDonald’s chatbot recruitment platform McHire that exposed the personal information of over 64 million job applicants. The security duo found that McDonald’s hiring bot, built by Paradox.ai, had major flaws, like a test account with username and password both set to “123456” and an insecure API. This let them access private chats between job seekers and the…

Never miss a new edition of The Variable, our weekly newsletter featuring a top-notch selection of editors’ picks, deep dives, community news, and more. The debate around AI’s impact on tech careers has been polarizing—to put it very, very mildly. The utopians are pointing towards a future where data scientists and programmers can focus on management, strategy, and deep thinking, instead of on boring, repetitive tasks. The pessimists, meanwhile, are dreading a future in which there are no more data scientists and programmers. This week, we invite you to explore the space between these positions and the opportunities that arise amid uncertainty. The articles we’ve…

WIRED reported this week on public records that show the United States Department of Homeland Security urging local law enforcement around the country to interpret common protest activities and surrounding logistics—including riding a bike, livestreaming a police encounter, or skateboarding—as “violent tactics.” The guidance could influence cops to use everyday behavior as a pretext for police action.An AI hiring bot used on the McDonald’s “McHire” site exposed tens of millions of job applicants’ personal data because of a group of web-based security vulnerabilities—including use of the classically guessable password “123456” on an administrator account. The site’s chatbot, known as Olivia,…