First, through a zero-day SQL injection ... the server’s file system and uncovered credentials for another contractor, ...