GOOGLE FIXES BUG THAT COULD REVEAL USERS' PRIVATE PHONE NUMBERS

Summary from the TLDR InfoSec newsletter

A security researcher discovered a Google bug that allowed attackers to reveal any account's private recovery phone number in under 20 minutes without owner notification. The exploit bypassed anti-bot protections through automated brute-force attacks. Google confirmed the fix after the researcher disclosed the vulnerability in April. It paid a $5,000 bounty and found no confirmed exploits occurred.