doordash

Top must-visit companies at RSAC 2026 RSAC 2026 Conference is taking place at the Moscone Center in San Francisco March 23 – 26. With hundreds of booths, countless product demos, and nonstop buzz, navigating RSAC can be overwhelming. That’s why we’ve done the legwork to highlight the standout companies you won’t want to miss. Whether you’re looking for cutting-edge innovation, industry veterans with new offerings, or rising stars shaking things up, these exhibitors are bringing something special to the floor this year. Be sure to carve out time in your schedule to stop by, as you might just discover your next big opportunity. Booth S-3316 | Book a demo Apiiro is an application security company with offices in New York and Tel Aviv. Its agentic Application Security Posture Management (ASPM) platform helps security and development teams detect, prioritize, and fix risks across the software development lifecycle, from design through code to deployment. Powered by patented Deep Code Analysis technology, the platform provides code-to-runtime context, automated threat modeling, and AI-driven remediation. Apiiro has raised over $135 million in funding from investors including General Catalyst, Kleiner Perkins, and Greylock. Gartner, IDC, and Frost and Sullivan have all recognized Apiiro as a leader in ASPM, and its customers include USAA, BlackRock, Shell, and TIAA. Booth ESE-19 Cline is an open-source AI coding agent that runs inside Visual Studio Code, JetBrains IDEs, and the command line. It goes beyond code completion by reading codebases, creating and editing files, executing terminal commands, automating browser interactions, and connecting to external tools via the Model Context Protocol, all with user approval at each step. Developers can bring their own API keys and connect to any major AI provider, including Anthropic, OpenAI, Google Gemini, AWS Bedrock, and local models. Cline has surpassed 5 million installs and nearly 60,000 GitHub stars, and is trusted by developers at companies including Samsung, Microsoft, Salesforce, Amazon, and Visa. Booth N-5181 | Book a strategy session GlobalSign by GMO is a leading Certificate Authority and digital identity provider founded in Belgium in 1996 and now a subsidiary of Japan’s GMO Internet Group. The company issues SSL/TLS certificates, S/MIME email security certificates, code signing certificates, and document signing solutions to businesses, enterprises, cloud providers, and IoT manufacturers worldwide. Its Atlas platform enables automated certificate lifecycle management at scale. GlobalSign by GMO is a founding member of the CA/Browser Forum and became a Qualified Trust Service Provider under the eIDAS regulation in both the EU and the UK. With over 600 employees across more than a dozen countries, the company serves clients including Microsoft, Cisco, and Johnson and Johnson. Booth S-2452 IDEMIA is a global leader in biometrics and cryptography, providing identity and security solutions to governments and enterprises in more than 180 countries. The company operates through two main divisions: IDEMIA Secure Transactions, which delivers payment cards, eSIM connectivity, and cryptographic security including hardware security modules and post-quantum cryptographic libraries; and IDEMIA Public Security, which provides biometric solutions for border control, law enforcement, access control, and travel. IDEMIA is trusted by more than 600 governmental organizations and 2,400 enterprises. Booth N-5245 | Book a demo Mimecast is a leading cybersecurity company focused on managing and mitigating human risk for organizations worldwide. Its AI-powered, API-enabled platform is built to protect businesses from a broad spectrum of cyber threats by integrating advanced technology with human-centric security pathways. The platform enhances visibility, delivers strategic insight, and enables decisive action to safeguard critical data and collaborative environments. It also actively engages employees in reducing risk and improving productivity. Booth ESE-28 MyCISO is a SaaS cybersecurity platform designed to help organizations assess, improve, and manage their security posture without relying on spreadsheets or fragmented tools. Its Security Operating System centralizes assessments, risk management, compliance, supplier security, incident response, security awareness, and board-ready reporting into a single platform supporting over 65 frameworks. AI-powered insights and automated external and internal vulnerability scans help security leaders prioritize risks, track maturity over time, and demonstrate progress to executives. Booth S-0262 | Book a demo Novee is an AI-powered penetration testing platform that continuously simulates real-world cyberattacks to help organizations find and fix vulnerabilities before hackers do. Unlike traditional annual pentests or generic scanners, Novee deploys a hive-mind of AI agents trained on offensive security tradecraft to map environments, uncover exploit chains, and identify business logic flaws. It can begin with zero knowledge, mirroring how real attackers operate, then expand into deeper coverage. For every issue discovered, Novee validates the finding and delivers personalized, step-by-step remediation guidance. Booth S-3111 | Book a demo Teleport is an infrastructure identity company that provides a unified platform for securing access across classic and AI infrastructure. Its platform consolidates identity for humans, machines, workloads, and AI agents using cryptographic identity and short-lived certificates, eliminating static credentials and standing privileges. Key capabilities include zero trust access, identity governance, privileged access management, machine and workload identity, and security for agentic AI and Model Context Protocol tooling. Teleport has raised over $169 million in funding, and is valued at $1.1 billion. Customers include Nasdaq, DoorDash, Accenture, Discord, and GitLab. Booth ESE-09 Unbound AI is a cybersecurity company that created the Agent Access Security Broker (AASB) category, a governance layer purpose-built for AI coding agents. Its platform helps enterprises discover every AI coding agent in use across their organization, including tools such as Cursor, Claude Code, GitHub Copilot, and Cline, assess their risk, and enforce granular policies over terminal commands, MCP server connections, and sensitive data flows. The platform processes over one million agent tool calls per month and deploys via MDM with no code changes required. Customers include THG Ingenuity, WeWork, Siemens, and Exterro. Booth ESE-11 12Port is a cybersecurity company providing an agentless Privileged Access Management (PAM) platform for enterprises and managed service providers. Its platform secures, monitors, and audits privileged sessions across physical, virtual, and cloud environments without requiring software agents on target endpoints. Core capabilities include a credential vault with FIPS 140-3 validated encryption, automated credential rotation, just-in-time access controls, session recording, MFA enforcement, and AI-powered session intelligence that detects policy violations and anomalies in real time. The platform supports hybrid, multi-cloud, and air-gapped environments, integrating with Active Directory, Entra ID, SSO, SIEM tools, and cloud platforms.

Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records North Korean hackers targeted cryptocurrency e-commerce platform Bitrefill during an attack on March 1, according to a post-mortem from the company published Tuesday. In a lengthy statement, Bitrefill said hackers allegedly tied to North Korea’s Lazarus group accessed around 18,500 purchase records that contained email addresses, crypto payment addresses and metadata including IP addresses. Bitrefill is designed to allow people to live off of cryptocurrency, enabling users to buy digital gift cards or pay bills online with it. The company has partnerships with Amazon, Doordash, Apple, Uber, Walmart and more. The company first announced issues on March 1 and eventually was forced to take systems offline when it was discovered to be a security breach. The company restored its website and app on March 5, intimating at the time that North Korea was responsible for the attack. Law enforcement and cybersecurity experts assisted in the investigation. In its post-mortem, the company confirmed that based on the tactics, malware, IP addresses, email addresses and blockchain activity, the incident was attributed to hackers connected to North Korea's Lazarus Group. “The initial access originated through a compromised employee laptop, from which a legacy credential was exfiltrated,” the company said. “That credential provided access to a snapshot containing production secrets. From there, the attackers were able to escalate their access to our broader infrastructure, including parts of our database and certain cryptocurrency wallets.” The breach was discovered because they noticed suspicious purchasing patterns with certain suppliers — tipping off that their gift card stock and supply lines were being exploited. Some company cryptocurrency wallets were drained and funds were transferred to hacker-controlled wallets. The statement does not say how much was taken and whether those funds were clawed back. Bitrefill did not respond to requests for comment. The company said it plans to absorb the losses through its operational capital. Bitrefill claims the hackers were not after their entire customer database and conducted “a limited number of queries consistent with probing to understand what there was to steal, including cryptocurrency and Bitrefill gift card inventory.” In November, the Justice Department said it was able to seize more than $15 million that had been stolen by Lazarus during four separate incidents in 2023. Lazarus is allegedly organized within the North Korean Reconnaissance General Bureau and has stolen billions worth of cryptocurrency over the last nine years, with blockchain monitoring firm Chainalysis saying hacking groups connected to North Korea’s government stole $1.3 billion worth of cryptocurrency across 47 incidents in 2024. Chainalysis reported that more than $2 billion worth of crypto was taken by North Korean hackers last year. Much of the figure is attributed to the $1.5 billion theft from Dubai-based platform Bybit in February, South Korean officials also accused North Korea of stealing $30 million worth of cryptocurrency from crypto platform Upbit. As seen in the attack on Bitrefill, North Korean actors have typically focused on stealing private keys or secrets that grant a person full control over digital assets. Since Chainalysis began tracking the figures in 2022, North Korea has stolen $6.8 billion in crypto. The United Nations said in 2024 that it is tracking dozens of incidents over a five-year period that have netted North Korea about $3 billion. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Georgia man charged for robbing NBA, NFL players through stolen Apple account details The Justice Department charged a Georgia man for allegedly breaking into the Apple accounts of professional athletes and using their card details to make purchases for himself. Kwamaine Jerell Ford, 34, is accused of defrauding multiple NFL and NBA players by impersonating a prominent adult film actress as part of the scheme to steal funds through Apple accounts. He was arrested and appeared in an Atlanta court on Friday, where he pleaded not guilty to dozens of counts of wire fraud, computer fraud, aggravated identity theft, access device fraud and sex trafficking. A judge ordered that Ford be held without bail. In addition to the monetary theft, Ford is accused of coercing a woman to have sex with several of the players and keeping unauthorized videos of the interactions. Prosecutors also said he hacked into the security cameras that one athlete had installed at his home. Ford allegedly did all of this while on probation for conducting similar phishing attacks and spending nearly $325,000 through the stolen financial information of his victims. “While serving time for stealing credit card numbers from athletes and celebrities to fund his lifestyle, Ford allegedly engaged in the same conduct again,” said U.S. Attorney Theodore Hertzberg. “Disturbingly, the indictment alleges that Ford went even further and used a fraudulent online persona to traffic a young woman and coerce her to produce hidden camera videos of commercial sex acts with unknowing individuals.” Ford previously pleaded guilty to hacking charges for a similar account takeover scheme in 2019 and was sentenced to three years in prison. But due to the COVID-19 pandemic, he was released in September 2020 and was allowed to serve the rest of his sentence with an ankle monitor at home. Prosecutors said information seen on his seized devices showed that within two days of being home, Ford began phishing professional athletes again. He eventually obtained the login credentials for Apple accounts belonging to the athletes through a two-pronged approach. Posing as an adult film star who prosecutors identified with the initials “T.T.,” Ford offered the athletes sexually explicit videos. Ford would then contact the same athletes posing as an Apple customer service representative, saying that in order for them to access the explicit videos they needed to send their username, password, and multifactor authentication codes. Through the Apple accounts, Ford gained access to the athletes’ credit and debit cards. He used them on thousands of dollars worth of purchases, including direct fund transfers, DoorDash orders and more. In total, he conducted more than 2,000 transactions. Ford allegedly evolved the scheme by 2021, continuing to pose as the adult film actress but coercing a novice adult film actress to engage in prostitution with professional athletes. Ford, posing as “T.T.,” said he would advance the woman’s career and effectively sold her sexual services to the athletes — eventually arranging her travel and payment for sex. Ford forced the woman to film several of the sexual encounters without the athletes’ consent. Prosecutors also found evidence that Ford hacked into the security cameras of one victim and stole videos from inside the person’s home. Ford “obtained videos of victims engaging in sexual acts without their knowledge or consent.” “In short, the allegations here go far beyond lying for money. The fact that Ford allegedly committed this conduct while serving a prison term for similar conduct — indeed, the new conduct is an escalation of his prior criminal conduct — drives home how dangerous he is,” prosecutors said. In court documents, prosecutors argued Ford could not be released on bail because he likely would continue to phish athletes as he had done when he was released for his previous charges. “Ford can easily continue doing the same thing if he is not detained. Probation does not have the ability to monitor his electronic devices in a way that can stop him from committing more crimes,” prosecutors said during a hearing on Friday. “And it would be exceedingly difficult, if not impossible, to prevent Ford from possessing electronic devices that can access the internet.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

DoorDash is known for delivering takeout food, but last month the company accidentally served up a tasty plate of personal data, too. It disclosed a breach on October 25, 2025, where an employee fell for a social engineering attack that allowed attackers to gain account access. Breaches like these are sadly common, but it’s how DoorDash handled this breach, along with another security issue, that have given some cause for concern. Information stolen during the breach varied by user, according to DoorDash, which connects gig economy delivery drivers with people wanting food bought to their door. It said that names, phone numbers, email addresses, and physical addresses were stolen. DoorDash said that as well as telling law enforcement, it has added more employee training and awareness, hired a third party company to help with the investigation, and deployed unspecified improvements to its security systems to help stop similar breaches from happening again. It cooed: “At DoorDash, we believe in continuous improvement and getting 1% better every day.” However, it might want to get a little better at disclosing breaches, warn experts. It left almost three weeks in between the discovery of the event on October 25 and notifying customers on November 13, angering some customers. Just as irksome for some was the company’s insistence that “no sensitive information was accessed”. It classifies this as Social Security numbers or other government-issued identification numbers, driver’s license information, or bank or payment card information. While that data wasn’t taken, names, addresses, phone numbers, and emails are pretty sensitive. One Canadian user on X was angry enough to claim a violation of Canadian breach law, and promised further action: “I should have been notified immediately (on Oct 25) of the leak and its scope, and told they would investigate to determine if my account was affected—that way I could take the necessary precautions to protect my privacy and security. […] This process violates Canadian data breach law. I’ll be filing a case against DoorDash in provincial small claims court and making a complaint to the Office of the Privacy Commissioner of Canada.” How soon should breach notifications happen? How long is too long when it comes to breach notification? From an ethical standpoint, companies should tell customers as quickly as possible to ensure that individuals can protect themselves—but they also need time to understand what has happened. Some of these attacks can be complex, involving bad actors that have been inside networks for months and have established footholds in the system. In some jurisdictions, privacy law dictates notification within a certain period, while others are vague. Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) simply requires notification as soon as is feasible. In the US, disclosure laws are currently set on a per-state level. For example, California recently passed Senate Bill 446, which mandates reporting breaches to consumers within 30 days as of January 1, 2026. That would still leave DoorDash’s latest breach report in compliance though. Another disclosure spat This isn’t the only disclosure controversy currently surrounding DoorDash. Security researcher doublezero7 discovered an email spoofing flaw in DoorDash for Business, its platform for companies to handle meal deliveries. The flaw allowed anyone to create a free account, add fake employees, and send branded emails from DoorDash servers. Those mails would pass various email client security tests and land without a spam message in email inboxes, the researcher said. The researcher filed a report with bug bounty program HackerOne in July 2024, but it was closed as “Informative”. DoorDash didn’t fix it until this month, after the researcher complained. However, all might not be as it seems. DoorDash has complained that the researcher made financial demands around disclosure timelines that felt extortionate, according to Bleeping Computer. What actions can you take? Back to the data breach issue. What can you do to protect yourself against events like these? The Canadian X user explains that they used a fake name and forwarded email address for their account, but that didn’t stop their real phone number and physical address being leaked. You can’t avoid using your real credit card number, either—although many ecommerce sites will make saving credit card details optional. Perhaps the best way to stay safe is to use a credit monitoring service, and to watch news sites like this one for information about breaches… whenever companies decide to disclose them. Your name, address, and phone number may already be for sale. Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.

Food delivery service DoorDash has confirmed it suffered a data breach in October 2025 where some personal customer information was accessed. In an email to customers, which was shared on social media, the company confirmed the incident and indicated that names, phone numbers, physical addresses and email details were affected. In response to the cybersecurity incident posted on the company’s website, it stated that there is no indication the data has been misused for fraud or identity theft at this time. DoorDash detailed that an employee was targeted in a social engineering scam which led to the breach. “The response team identified the incident, shut down the unauthorized party’s access, started an investigation and referred the matter to law enforcement,” the company said. The company also noted that sensitive information, including Social Security numbers or other government-issued identification numbers, driver’s license information or bank or payment card information, was not accessed. In response to the data breach, the company said it has deployed new enhancements to its security systems to help prevent and detect malicious activities of this nature. Additional awareness training for employees relating to social engineering scams has also been issued. The company brought in an external firm to assist in the investigation and provide specialized support. The matter has also been referred to law enforcement. Wolt or Deliveroo customers have not been affected by the data breach. The two firms operated under the DoorDash umbrella. This is DoorDash's third breach in the last six years, following incidents affecting 5 million users in 2019 and a third-party vendor compromise in 2022. “For a platform handling millions of daily transactions and maintaining detailed delivery records for hundreds of millions of users, this pattern demands a fundamental security reassessment,” commented Kiran Chinnagangannagari, chief product and technology officer at Securin. Image credit: T. Schneider / Shutterstock.com

A vulnerability in DoorDash's systems could allow anyone to send "official" DoorDash-themed emails right from company's authorized servers, paving a near-perfect phishing channel. DoorDash has now patched the issue, but a contentious dispute has erupted between the researcher who reported the vulnerability and the company, with both sides accusing each other of acting improperly. Anyone could send 'official' DoorDash emails A simple flaw in DoorDash for Business platform could let anyone send fully branded "official" emails directly from [email protected]. Discovered by a pseudonymous security researcher doublezero7, the flaw could be exploited by threat actors to launch highly convincing phishing campaigns and social engineering scams. Put simply, anyone could create a free DoorDash for Business account and then use backend admin dashboards to add a new 'Employee' (with an arbitrary name and email address), assign them meal-expense budgets, and craft emails containing arbitrary HTML. The resulting message, bearing DoorDash's official template, would arrive seamlessly in the recipient's mailbox, not spam: The security researcher behind this discovery recently approached BleepingComputer and provided evidence of the vulnerability to demonstrate how it could be exploited by nefarious actors. "The root was Budget name input field. It was stored as raw text in database and forwarded to email where it would be rendered," the researcher told BleepingComputer. "Using unclosed tags I could have altered the entire block of text about Budget information and using display:none it was possible to hide it completely and replace with crafted payload." "It relied completely on email client defensive layers. Everything that passed, would be rendered. The input field enabled even on* events except for 'onerror' but these are filtered by email platforms," continued the researcher. The "Claim Free 20$ Voucher" text shown in the above screenshot is a proof-of-concept HTML injection exploit crafted by the researcher on the DoorDash for Business backend, shown below: The researcher stated that emails sent by misuse of this feature was not limited to DoorDash customers or merchants—in other words, a threat actor could target almost any recipient with DoorDash-themed emails. The vulnerability is identical to the unaddressed flaw in Uber's email systems that let just about anyone send emails from Uber.com, as revealed in 2022 by BleepingComputer. Escalated after 15 months Prior to contacting BleepingComputer, the researcher, frustrated with the long disclosure, published a brief vulnerability report summarizing the flaw and his disclosure attempts, while withholding any concrete technical details or proofs-of-concept. "The technical flaw was never complex—it was a classic stored payload rendered in a trusted email template," they wrote at the time. The discoverer, however, took issue with the fact that the HackerOne report (# 2608277) filed for the vulnerability was closed as "Informative" around 17th of July, 2024, and "never escalated," leaving the flaw exploitable for more than 15 months. According to the publicly visible timeline, and the researcher's narration of events to BleepingComputer, it wasn't until the week of November 3rd, that the flaw was patched, after the researcher directly emailed DoorDash repeatedly. "Without my public pressure, this vulnerability would still be active today," claims the researcher. Ethical disclosure derailed, no bounty offered To establish a clear timeline, BleepingComputer performed an independent verification, and this is where the researcher's account and DoorDash's version of events begin to diverge. The researcher contends the company ignored the issue until pressured. The company says the pressure itself crossed ethical lines. According to a person familiar with the company's handling of the vulnerability report, the interaction between the researcher and DoorDash broke down after the researcher demanded a substantial payment tied to disclosure timelines—something the source said the company viewed as outside the bounds of ethical bug bounty research. According to the source, the researcher also refused an offer of mediation and reiterated the financial demand. The researcher framed the report as a legitimate security finding deserving compensation. DoorDash has, however, deemed the issue out of scope and characterised the approach as feeling like extortion. A DoorDash spokesperson told BleepingComputer: "DoorDash operates a bug bounty program to work with security researchers to help find and fix potential security vulnerabilities. In this case, this individual attempted to extort DoorDash for money. They were subsequently banned from our bug bounty program. The issue reported fell outside the scope of our bug bounty program. Our security team has taken action to address the issue reported. We will continue to work with researchers who operate in good faith to protect our platform." BleepingComputer also reached out to HackerOne to get full context. The bug bounty platform did not comment on why the researcher's report was closed as "Informative." A HackerOne spokesperson, however, shared with BleepingComputer: "We’ve reviewed this matter in coordination with our customer and confirmed that appropriate actions were taken consistent with HackerOne’s Code of Conduct and the customer’s program policy. HackerOne takes our Terms of Service seriously to ensure the safety and security of the platform, our customers, and the HackerOne community. If we determine that a community member has violated HackerOne's Terms of Service, we will take prompt, appropriate action, which may include a permanent platform ban." In emails to BleepingComputer, the researcher reiterated that the flaw went unpatched for an extended period and acknowledged using a "less ethical" approach when contacting the company directly, including demanding a payment: "My final email to DoorDash was a conditional offer to enter a compensated NDA in exchange for silence, given the history of severe neglect," they wrote to BleepingComputer. "DoorDash fixed the bug within hours of the ultimatum (proving its criticality) but chose to ignore my payment demand and silently patch the flaw." The now-patched flaw, while useful for spoofing convincing DoorDash emails, did not expose DoorDash user data or provide access to internal systems. Like any phishing vector, it required the recipient to be tricked into taking action, raising questions about its actual 'criticality'. The researcher, however, sees the "silent fix" and their subsequent removal from the bug bounty program as retaliatory. "My decision to [disclose the vulnerability] stems directly from the fact that the company took my service for free, tried to hide their 16-month failure, and then attempted to silence me, which I believe is an unethical approach to security research." "I honestly did not know if all my actions were right or not. But ultimately they patched the flaw so at least I accomplished that," concluded the researcher to BleepingComputer. The case illustrates how vulnerability reporting can become fraught, and how misaligned expectations between researchers and companies can quickly lead to conflict. A source briefed on the matter told BleepingComputer the flaw is unrelated to the October DoorDash breach disclosed this month. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

DoorDash has disclosed a data breach that hit the food delivery platform this October. Beginning yesterday evening, DoorDash, which serves millions of customers across the U.S., Canada, Australia, and New Zealand, started emailing those impacted by the newly discovered security incident. Your personal information affected "On October 25, 2025, our team identified a cybersecurity incident that involved an unauthorized third party gaining access to and taking certain user contact information, which varied by individual," states the email notification from DoorDash. The information may have included: First and last name Physical address Phone number Email address "Our investigation has since confirmed that your personal information was affected." The incident has been traced to a DoorDash employee falling victim to a social engineering scam. Upon becoming aware, the company's incident response team shut down the unauthorized party's access, started an investigation, and referred the matter to law enforcement. The disclosure does not specify how many users were affected, though the company says the incident impacted a mix of consumers, Dashers, and merchants. This marks the third notable security incident suffered by the delivery giant. In 2019, a data breach at DoorDash had exposed the information of roughly 5 million customers, Dashers and merchants to an unauthorized party. In August 2022, the company encountered another data breach from threat actors who had also attacked Twilio that year. La traduction française suit What's interesting is that a French translation of the notice is appended to these emails: At this time, it appears that the emails primarily went to DoorDash Canada users (including myself). However, an undated security advisory posted on DoorDash's website suggests the incident may extend beyond Canada. It has references to U.S.-specific data types, like Social Security Numbers (SSNs), which DoorDash says were not accessed (Canadian counterpart would be Social Insurance Numbers (SINs)). BleepingComputer approached the DoorDash press team to clarify whether the breach also affects users in the U.S. or other regions where the company operates. 'Took 19 whole days' Some users on social media have rebuked DoorDash, questioning the company's handling of the incident and the timing of the notifications. "I'm sorry - if this isn't sensitive information, what is? Don't downplay this just because they didn't get credit card or password information. It's gone deaf," posted Chris from Toronto. Cybersecurity professional Kostas T. also reacted to the email's phrasing, expressing that the statement "no sensitive information was accessed" conflicted with the personal information that the company acknowledged was accessed. "DoorDash took 19 whole days to notify me of a data breach that has leaked my personal information. Thankfully I used a fake name and forwarded email address for my account, but my real phone number and physical address have been leaked," wrote X user Ohqay. "This is incredibly unprofessional, dangerous, and potentially illegal behaviour from DoorDash... This process violates Canadian data breach law. I'll be filing a case against DoorDash in provincial small claims court and making a complaint to the Office of the Privacy Commissioner of Canada." Users should be wary of unsolicited communications or targeted phishing emails appearing to originate from DoorDash. DoorDash warns that you should avoid clicking on links or attachments within suspicious emails, and to refrain from providing any personal information to unfamiliar websites. "We have already taken steps to respond to the incident, including deploying enhancements to our security systems, implementing additional training for our employees, bringing in a leading cybersecurity forensic firm to assist in our investigation of this issue, and notifying law enforcement for ongoing investigation," states the company. DoorDash users with questions related to the incident can further call the toll-free number +1-833-918-8030 and cite reference code: B155060. BleepingComputer did not hear back from DoorDash on the exact scope of the incident. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report