A researcher discovered a CSRF protection bypass on IBM's account management endpoint by exploiting Referer header validation. The vulnerability allowed changing user email addresses via GET requests using a path traversal technique (hosting the IBM URL as a path on an attacker's domain) to bypass Referer checks.
Iran's state media published a list of 29 tech infrastructure facilities owned by US companies (Amazon, Google, Microsoft, IBM, Nvidia, Oracle, Palantir) across the Middle East designated as legitimate targets for retaliatory strikes, following Iran's claimed drone attacks on AWS datacenters in the UAE and Bahrain.
Iranian state media has publicly named major U.S. tech companies (Google, Microsoft, Palantir, IBM, Nvidia, Oracle) as potential military targets, warning that the regional conflict is expanding into digital infrastructure. Recent Iranian drone strikes have already damaged AWS data centers in the UAE and Bahrain, demonstrating practical capability to target critical cloud and data-center operations.