Post mortem on Typefully security incident on June 9th, 2026

On June 9, 2026, an attacker exploited a vulnerability in Typefully's changelog system, publishing a malicious entry that executed unauthorized code in users' browsers. The unsanitized content allowed the code to access account details.