The safest lock is the one whose design you can hand to a thief

Cybersecurity 5 min 80 sources

A critical flaw in EV chargers, a server bug that ignored its own rules, and a fresh push to weaken encryption all turned on the same mistake this week - trusting a hidden secret.

Key takeaways

A critical flaw in Autel EV chargers, two server bugs in Apache Tomcat, and a fresh push to weaken encryption all came down to the same error - trusting a secret hidden in the design instead of a strong key.
A Russian state group is using a "zero-click" flaw to steal Western government email, including saved passwords and two-factor codes, just by having a message opened.
Breaches hit tens of millions this week (Suno 55M+, DentaQuest 23M+); reused passwords are what turn one leak into many, so a different password per important account is the cheapest defence.

The most useful idea in security is almost 150 years old, and this week it kept proving itself. A lock should stay shut even if the thief can read the blueprint. The only thing that must stay secret is the key. Systems that lean on a hidden design instead of a strong key keep failing - because the design always gets out.

A master key baked into the hardware

Researchers at CyberDanube found that Autel’s MaxiCharger, a widely sold electric-vehicle charger, ships with a secret password built straight into its software [12]. The flaw, tracked as CVE-2026-8983, carries the top severity score of 10.0 [12]. Anyone who knows the built-in token can control the charger’s management functions without ever logging in [12]. It landed in the US cyber-defence agency CISA’s list of the week’s serious flaws [10].

A hard-coded credential is exactly what it sounds like: a username or password written permanently into a device’s code, the same on every unit that ships. The maker treats it as a secret. But firmware - the software burned into a device - can be pulled apart and read. Once one researcher extracts the token, it works on every charger of that model. The safety rested on nobody looking, and someone always looks.

The same week, the widely used Apache Tomcat web server - software that runs behind countless websites - patched two flaws where the server simply ignored its own access rules. One, CVE-2026-55276, rated 9.1, let requests slip past permission checks that were supposed to stop them [64]. A second bug meant the default settings failed to apply the very constraints an administrator had written [61]. The lock was there; it just didn’t hold. Fixes shipped in Tomcat versions 11.0.23, 10.1.56 and 9.0.119 [61][64].

The same mistake, proposed on purpose

While engineers spent the week patching accidental hidden weaknesses, governments kept pushing to build one in deliberately. A new academic paper, flagged by the cryptographer Bruce Schneier, maps what it calls “Round 3” of the decades-old “going dark” fight [8]. Governments around the world have proposed, and in some places passed, laws to limit end-to-end encryption so police can read messages [8].

End-to-end encryption means only the sender and receiver can read a message - not the app, not the company, not anyone in between [8]. Law enforcement wants a way in for lawful cases. The trouble is technical, not political: a way in for one party is a way in for anyone who finds it. That is the same lesson the EV charger taught. A deliberately built secret door is still a hidden weakness, and hidden weaknesses get found. The paper notes this encryption is not just for chat apps - it quietly protects web browsing, remote logins, and company networks too [8].

Russia’s zero-click reach into Western inboxes

The week’s sharpest live threat needed no hidden door at all - it used a plain, unpatched flaw. CISA and allied agencies issued a joint alert about a Russian state-backed group, tracked as “Laundry Bear,” breaking into Western government and company email [15]. The group targets Zimbra, a business email system, using a “zero-click” attack [40].

Zero-click means the victim does nothing wrong - no dodgy link, no attachment opened. A hidden piece of code sits inside an ordinary-looking email and runs the moment the message is opened [40]. From there the attackers try to copy the last 90 days of email, saved passwords, contact lists, and two-factor login codes [40]. One government alert noted the group stole email without any trickery aimed at the user at all [37]. The targets span defence, transport, and finance across NATO countries, Ukraine, and Africa [40][50]. Organisations running Zimbra should apply the fix for the flaw, CVE-2025-66376, now [15].

Separately, the security firm Check Point warned that a flaw in its SmartConsole management tool, CVE-2026-16232, was being used against some customers before a patch existed [2]. A flaw attackers exploit before the maker has a fix is called a zero-day - defenders start the race a step behind.

A heavy week for stolen personal data

The breaches kept coming. Hackers leaked names, emails, phone numbers, passwords, and financial details from the AI music service Suno and the platform Paidwork [4]. Suno’s breach alone touched more than 55 million accounts [9]. The US dental-benefits firm DentaQuest said a breach may have exposed data on over 23 million people [11]. In Russia, a leak spilled the tax records of 20 million citizens [7]. Australia’s Origin Energy confirmed customer data was stolen after a hacker claimed to hold information on 2 million people [6][26].

Most of this data ends up feeding the next attack. Stolen email-and-password pairs get tried, by the million and automatically, against other sites - a tactic called credential stuffing. It works only when people reuse passwords. Fast-food chain Chick-fil-A was hit with exactly this kind of attack this week [47]. If you reused a password anywhere it leaked, that one breach becomes five. A different password for each important account is the single cheapest defence.

The quiet accountability story

One under-covered item is worth ending on. Spain’s data regulator fined the genetics-testing firm 23andMe nearly $3 million over the security failings behind its 2023 hack [39]. It is a reminder that the cost of a breach is starting to land on the company that let it happen, not only on the people whose data leaked - slowly, and years later, but it lands.

02 · Lesson · why it matters

The lock you can show the whole world

A system is only as safe as its weakest secret, so the trick is to need just one - the key - and let the rest be seen.

A password nobody could change

Start with the EV charger. A researcher pulled apart its software and found a password sitting inside, the same on every charger sold. The company had treated that password as a secret. But it was printed into the product, shipped to every buyer, and readable by anyone patient enough to look. It was never really a secret. It only felt like one because, for a while, nobody had looked.

That gap - between a secret you keep and a secret you merely hope no one finds - is the whole story of this week. It is also one of the oldest ideas in the field, and worth naming plainly.

Kerckhoffs’s rule

In 1883, a Dutch linguist named Auguste Kerckhoffs wrote down a rule for military codes. A cipher should stay safe even if the enemy knows everything about how it works - every gear, every step. The one thing they must not have is the key. The design can be public. Only the key must be private.

It sounds backwards at first. Surely hiding how your lock works makes it safer? But Kerckhoffs saw the flaw. A design is a big, shared, fixed thing. It sits in the product, in the manuals, in the heads of everyone who built it. You cannot change it easily, and you cannot take it back once it leaks. A key is small, private, and swappable. If a key leaks, you make a new one. If a design leaks, you have to rebuild the world.

So the safe move is to lean the whole weight of your security on the one thing you can actually protect and replace: the key. Assume everything else is already on a billboard.

Why hiding the design always loses

Look at how many of this week’s problems are the same shape. The charger hid a password in its hardware; hardware gets taken apart. The web server trusted its own settings to quietly enforce the rules; the settings had a gap nobody noticed until an attacker did. Each one bet safety on something staying hidden. Each hidden thing came out.

This is not bad luck. It is the nature of the thing. A design leaks through a fired employee, a leaked document, a competitor’s teardown, a bored researcher on a weekend. There is no way to un-know it. Security that depends on the enemy staying ignorant is borrowing against a debt that always comes due. Cryptographers have a blunt name for the opposite temptation: “security through obscurity,” and they mean it as an insult.

The strong systems do the reverse on purpose. The encryption that protects your bank login is completely public. Anyone can read exactly how it scrambles data - the math is published, studied, attacked by thousands of experts for years. It stays safe anyway, because the one secret it needs, your key, is small enough to guard and cheap enough to replace.

The door someone wants to build

Now the harder case, the one governments are arguing over. Several want a way for police to read encrypted messages in lawful cases. On its face that sounds like a rule about who is allowed in. But underneath, it is a request to build a hidden weakness into a design - a spare key held somewhere, a door in the wall.

Kerckhoffs’s rule does not care about intentions. It only tells you what happens to secrets baked into a design: they get out. A spare key that unlocks everyone’s messages is the most valuable secret on earth, which means it is the most hunted. The math does not offer a door that only the good guys can walk through. This is why so many cryptographers, who take no side on the policing question, still say the same thing. You cannot add that door without weakening the wall for everyone standing behind it.

Where this leaves you

You are further inside this than it looks. The rule is why you can change a stolen password in a minute but a company needs months to recover from a leaked design. It is why “just keep it secret” is a promise no one can keep at scale. The systems you actually rely on - your messages, your bank, your logins - are the ones that gave up on secrecy everywhere except the key.

The next time something is sold to you as safe because how it works is confidential, you now have a question worth holding lightly. Not “can I trust them to keep it secret,” but “what happens on the day they can’t.” The oldest answer in the field is that the day always comes. The systems that survive it are the ones that planned for the blueprint to be public, and guarded the one small thing that could be.

03 · Lab · your turn

Where the Secret Lives

Rehearse why a system that hides its design fails while one that publishes it and guards only the key holds.

04 · Hope · carry this

The reassuring part is how old the answer is. We have known since 1883 that the safest lock is the one whose design you could hand to a stranger, and the systems carrying your messages and your money already work exactly that way.