Annie Altman Amends Sexual Abuse Lawsuit Against OpenAI CEO Sam Altman 
Meta Ties Executive Pay to Aggressive Stock Price Targets in Major Retention Push 
Rubio Directs U.S. Diplomats to Use X and Military Psyops to Counter Foreign Propaganda 
Chinese Universities with PLA Ties Found Purchasing Restricted U.S. AI Chips Through Super Micro Servers 
OpenAI Pulls the Plug on Sora, Ending $1 Billion Disney Partnership 
Nintendo Switch 2 Production Cut as Holiday Sales Miss Targets 
Meta and Google just lost a landmark social media addiction case. A tech law expert explains the fallout 
Nanya Technology Shares Surge 10% After $2.5 Billion Private Placement from Sandisk and Cisco 
TSMC Japan's Second Fab to Produce 3nm Chips by 2028 
SpaceX IPO Filing Expected This Week as Valuation Could Surpass $75 Billion 
Golden Dome Missile Defense: Anduril and Palantir Join Forces on Trump's $185B Space Shield 
Palantir's Maven AI Earns Pentagon "Program of Record" Status, Reshaping Military AI Strategy 
SMIC Allegedly Supplies Chipmaking Tools to Iran's Military, U.S. Officials Warn 
Elliott Investment Management Takes Multibillion-Dollar Stake in Synopsys 
Microsoft Eyes $7B Texas Energy Deal to Power AI Data Centers 
NASA Artemis II: First Crewed Moon Mission Since Apollo Takes Four Astronauts on 10-Day Lunar Journey 
A security flaw was recently discovered hiding in T-Mobile domain that could have been exploited to gather customers’ private information.
According to reports, the vulnerability was found in one of T-Mobile’s subdomains intended for the company’s customer care staff. The flawed network, promotool.t-mobile.com, is exclusively being used by the company’s customer support staff and serves as their online portal to access T-Mobile internet services.
Though the said subdomain is not popularly known to the public, ZDNet noted that it was not actually hidden from search engines as well. So if an unauthorized element knows where to look, they can easily abuse the exploit and mine vital account information of T-Mobile customers.
The exploit was found in a hidden API within the domain. And requesting customer information from the website did not require any sort of password. According to the reports, a person using the domain can easily gather account details by simply affixing a customer’s mobile number at the end of the domain address due to the found vulnerability.
Once the exploit was successfully executed, the bugged subdomain returned an array of important customer information including their full name, address, account number.
The flawed domain was also found leaking other sensitive details. ZDNet added that, while account PINs were not released, the bugged domain returned data including “references” to security-related account information. This can then be provided to customer service agents if someone is motivated to manipulate the actual T-Mobile customer’s account.
Meanwhile, other sensitive details such as a T-Mobile customer’s tax identification number was also some of the data returned. The bug also allowed an unauthorized person to view whether a customer has suspended their T-Mobile subscription or if they have an outstanding bill.
Meanwhile, the bugged API has been taken down by T-Mobile after they were notified by security researcher Ryan Stevenson. And as of this writing, the bugged domain has been reportedly fixed. Stevenson was later rewarded with $1,000 under T-Mobile’s bug bounty program.
“The bug was patched as soon as possible and we have no evidence that any customer information was accessed,” a T-Mobile representative said.
