CREDENTIALS LEAKING WITH SUBDOMAIN TAKEOVER

Summary from the TLDR InfoSec newsletter

Truffle Security's team provides a deep dive into how localStorage can be abused in a subdomain takeover. They discovered a subdomain takeover vulnerability on Readme.io that could allow an attacker to compromise any credentials entered in the original or compromised page. The Readme team originally did not intend to fix the issue so Truffle Security created custom domains for 600 vulnerable companies and contacted them directly.