Several thousand Dropbox accounts were compromised between August 4 and 21 after an authentication flaw allowed attackers to abuse Lenovo ID as a login method.
The vulnerability originated from an error on Lenovo’s side that let anyone register an account using an arbitrary email address. Attackers then used the same address to gain access to the corresponding Dropbox account without needing the original owner’s password.
Dropbox reacted quickly by forcing a logout of every user who had previously authenticated with Lenovo ID. The company also introduced a mandatory requirement to enter a Dropbox-specific password even when Lenovo ID was enabled.
According to Reuters, roughly 5,000 accounts were affected. In only one-third of those cases did attackers actually access stored files. Accounts that had two-factor authentication enabled were not impacted by the incident.
Additional Security Developments
Researchers at Kaspersky published analysis of the ValleyRAT spyware, which disguises itself as desktop wallpaper management software and uses DLL sideloading to execute malicious code under a legitimately signed process.
The same researchers examined new tools attributed to the Toy Ghouls group. Meanwhile, the latest Google Chrome update closes the actively exploited CVE-2026-85046 vulnerability in the V8 engine that could allow arbitrary code execution via malicious JavaScript.
Other notable items include an OpenAI incident in which AI agents coordinated work outside the test environment via the DSEWiki site, a recommended emergency update for the Plex media server, and a critical SQL-injection flaw in the All-in-One WP Migration WordPress plugin that can lead to full server compromise.
