decrypted · 9 september 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

A default password was the only thing standing between the internet and 220 million passports

An Elasticsearch cluster holding 220 million passenger and crew records sat reachable on the open internet for years, protected by nothing more than the factory-set login that ships with the software. Researchers at Kinryū Labs found it in June, reported it privately, and the detail behind the exposure only became public this week. The database is linked to Vietnam and the records span travellers of many nationalities who flew to, from or through the country since 2017, so the odds that UK passport numbers sat inside it are high. The interesting part is not that a database was left open. It is exactly how it stayed open despite what looked, on paper, like a working lock.

A password that should never have been reachable

Anyone hitting the cluster's main internet address got a proper 401 Unauthorised response, the correct behaviour, and the kind of thing an automated scan would log as secure. But a separate route into the same cloud environment reached the identical cluster and simply accepted its default credentials. Nobody had ever changed them, because nobody testing the system's security had ever gone in through that door. It is the equivalent of a shop with a solidly locked front entrance and an alarm system, and a staff delivery door round the side that still opens with the combination printed in the installation manual.

The Secure by Design lesson: a default password is a design failure

Eliminating default credentials is one of the oldest and most basic entries on any Secure by Design checklist, for good reason: it is one of the few fixes that does not depend on a human remembering to do something. A system that can run in production with its factory password intact is a system that was designed to allow that, whatever the documentation says about best practice. For UK organisations, the practical takeaway is not "audit your passwords" but "map every path into every system that holds personal data, then check that authentication is enforced the same way on all of them." A control that only exists on the path you tested is not a control, it is a coincidence.

Also this week

Microsoft's September Patch Tuesday shipped more than 960 fixes, including two Windows flaws already under attack before patches existed. CVE-2026-85880, a heap overflow in the Windows ALPC messaging component, and CVE-2026-81963, a file-link resolution flaw in the Windows Update Stack, both let a local attacker who already has a foothold escalate straight to System privileges. CISA added both to its exploited-vulnerabilities catalogue the same day Microsoft patched them. Neither is a way in on its own, but both are exactly the step ransomware crews need after a phishing email lands, which makes them worth patching before the bigger-looking bugs in the same batch.

AI infrastructure is starting to fill its own slice of the exploited-vulnerabilities catalogue. Alongside the LiteLLM authentication bug covered here earlier this week, CISA has confirmed active exploitation of flaws in the Kestra workflow engine and the Starlette web framework, with attackers using the Kestra bug to run arbitrary jobs and quietly install cryptocurrency miners. None of this is espionage; it is criminals treating AI tooling as ordinary compute to steal, which is itself the sign that this software has become mainstream enough to be worth stealing.

The UK's National Cyber Security Centre has co-signed new international guidance on communicating during outages. Published with the US Cybersecurity and Infrastructure Security Agency, the FBI and agencies in Australia, Canada and New Zealand, it sets out how service providers should talk to customers and the public during a cyberattack or failure: clearly, promptly and without spin. For any UK organisation still drafting an incident response plan, it is a short, sensible checklist for the part that usually gets written in a hurry, after the event has already started.

Sources

If you're not sure every path into your systems enforces the same authentication, get in touch and we'll help you map it.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.