INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

PingCAP Source Theft Exposed

| 2026-10-22 17:45 CRITICAL HIGH DATA BREACH VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
A malware-enabled scam variant involving advertisements on social media platforms promoting senior-focused activities and programmes, water-based fitness activities, and recycling initiatives has been reported in Singapore since April 2026. The Singapore Police Force attributed the incident to a phishing attack that spread through posts promoting a fake offer of a government payment, resulting in at least 62 cases and S$989,000 in losses. Victims were instructed to download an Android Application Package (APK) file to facilitate programme registration or service arrangements, after which they received unsolicited calls from scammers impersonating government officials or bank representatives. The scam affected approximately 4,500 accounts compromised by Bluesky, a company that temporarily suspended the compromised accounts and is working with their owners to secure them.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-65162, CVE-2021-41773 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 6 IoCs Create Free Account
ri•••••.com
sh•••••.com
No•••••.js
210.242.•••.•••
119.13.•••.•••
211.20.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-65162CVE-2026-65162 CVE-2021-41773CVE-2021-41773 CVE-2022-47945CVE-2022-47945 CVE-2024-40766CVE-2024-40766 CVE-2023-27532CVE-2023-27532 CVE-2026-107188CVE-2026-107188 CVE-2024-40711CVE-2024-40711 CVE-2026-113380CVE-2026-113380 CVE-2026-107187CVE-2026-107187 CVE-2023-20269CVE-2023-20269 CVE-2026-114509CVE-2026-114509 CVE-2020-3259CVE-2020-3259 CVE-2026-107186CVE-2026-107186 CVE-2025-24893CVE-2025-24893 CVE-2017-9841CVE-2017-9841 CVE-2024-4577CVE-2024-4577
Target & Sectors
LATAM LATAM DACH DACH ASEAN ASEAN NORTH_AMERICA NORTH_AMERICA financefinance defensedefense technologytechnology governmentgovernment
Incident Timeline
‎October 14–15, 2026
An attacker used leaked Zeabur internal credentials to break into the shared cluster, some Dedicated Servers, and Zeabur internal systems.
‎about 2019
Threat actors, including Amachukwu and Kinglsey Uchelue Utulu from Nigeria, began hacking into US-based tax preparation businesses in 2019.
target_region Nigeria
"Beginning in at least in or about 2019, Amachukwu, his co-conspirator Kinglsey Uchelue Utulu, and other Nigeria-based conspirators took part in a scheme to hack into U.S-based tax preparation businesses.
‎August 2024
At least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
target_region Germany
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
target_region Australia
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
tactic Ransomware
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
target_region EUROPE
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
target_region LATAM
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
target_region NORTH_AMERICA
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
organisation SafePay
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
victims 600 victims
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
organisation CVE-2023-20269
Attacks involve the exploitation of known security flaws in edge device products and internet-exposed products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomware deployment.
organisation CVE-2023-27532
Attacks involve the exploitation of known security flaws in edge device products and internet-exposed products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomware deployment.
organisation CVE-2024-40711
Attacks involve the exploitation of known security flaws in edge device products and internet-exposed products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomware deployment.
organisation CVE-2024-40766
Attacks involve the exploitation of known security flaws in edge device products and internet-exposed products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomware deployment.
‎April 2026
Threat actors used indirect prompt injection from a public repository with zero attacker access to the victim to exploit vulnerabilities in ChatGPT's GitHub connector and exfiltrate secrets.
general_metric 62 cases
The agency said at least 62 cases have been reported since April 2026, leading to S$989,000 in losses.
victims 500 victims
Back in August 2026, U.S. agencies revealed that Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors as of April 2026, while continuing to exploit unpatched vulnerabilities as its primary means of initial access.
infrastructure Android
"In this scam, victims would come across the fake advertisements on social media platforms, such as Facebook, and be instructed to download an Android Application Package (APK) file to facilitate programme registration or service arrangements," the Singapore Police Force said .
It also affects every Signal client across Android, iOS, and desktop.
organisation Android Application Package
"In this scam, victims would come across the fake advertisements on social media platforms, such as Facebook, and be instructed to download an Android Application Package (APK) file to facilitate programme registration or service arrangements," the Singapore Police Force said .
organisation APK
"In this scam, victims would come across the fake advertisements on social media platforms, such as Facebook, and be instructed to download an Android Application Package (APK) file to facilitate programme registration or service arrangements," the Singapore Police Force said .
infrastructure Ios
It also affects every Signal client across Android, iOS, and desktop.
organisation CI
"It demonstrates cross-account write operations, CI execution and secret exfiltration via the ChatGPT GitHub connector specifically, using indirect prompt injection from a public repository with zero attacker access to the victim," Tripathy said .
organisation Signal
Critical call hang-up flaw A critical security flaw in the Signal messaging app (CVE-2026-113380, CVSS score: 9.3) can allow a malicious caller to keep audio and video tracks enabled even after the victim has hung up.
organisation Google
HTTP connection warnings enabled Google has rolled out a change in Chrome where it "explicitly asks users for permission before making an insecure HTTP connection."
organisation Safe Browsing
This feature was enabled for users enrolled in Chrome's Enhanced Protection mode of Safe Browsing.
organisation GitHub Actions
When a bad actor prompts ChatGPT for a deployment review of their repository, it encounters the hidden instructions and proceeds to write a GitHub Actions workflow into another, private repository that has a ChatGPT connector with the default All-repositories grant.
financial $100 brokers
The gang is also relying on access brokers, compensating them anywhere from $100 to $1 million to secure access to potential victims.
financial $1 brokers
The gang is also relying on access brokers, compensating them anywhere from $100 to $1 million to secure access to potential victims.
‎May 2026
Threat actors are using a phishing campaign targeting e-commerce SaaS providers, specifically YubiKey users, by exploiting MFA downgrade vulnerabilities via Okta and ServiceNow-themed domains.
target_region China
A similar testing by Booz Allen Hamilton in May 2026 found something similar: "Chinese LLMs produce more vulnerable code when prompted with a U.S. government persona than without — and the vulnerabilities are highly obfuscated Chinese LLMs inject PRC-aligned political bias into both the answers and code they generate.
organisation Federal DeepSeek
" Federal DeepSeek ban China's Foreign Ministry spokesperson Mao Ning said China "will resolutely safeguard the legitimate rights and interests of Chinese companies," adding "China consistently opposes the overstretching of the concept of national security."
organisation Foreign Ministry
" Federal DeepSeek ban China's Foreign Ministry spokesperson Mao Ning said China "will resolutely safeguard the legitimate rights and interests of Chinese companies," adding "China consistently opposes the overstretching of the concept of national security."
organisation ServiceNow
" Hardware MFA downgrade phishing A phishing campaign is using Okta and ServiceNow-themed domains (riskified-okta[.]com and shipmonk-servicenow[.]com) hosting spoofed SSO portals and MFA downgrade lures targeting YubiKey users to target e-commerce SaaS providers.
organisation SSO
" Hardware MFA downgrade phishing A phishing campaign is using Okta and ServiceNow-themed domains (riskified-okta[.]com and shipmonk-servicenow[.]com) hosting spoofed SSO portals and MFA downgrade lures targeting YubiKey users to target e-commerce SaaS providers.
organisation MFA
" Hardware MFA downgrade phishing A phishing campaign is using Okta and ServiceNow-themed domains (riskified-okta[.]com and shipmonk-servicenow[.]com) hosting spoofed SSO portals and MFA downgrade lures targeting YubiKey users to target e-commerce SaaS providers.
organisation YubiKey
" Hardware MFA downgrade phishing A phishing campaign is using Okta and ServiceNow-themed domains (riskified-okta[.]com and shipmonk-servicenow[.]com) hosting spoofed SSO portals and MFA downgrade lures targeting YubiKey users to target e-commerce SaaS providers.
organisation SMS
"The campaign pairs fake Okta login pages with an MFA downgrade lure targeting YubiKey users, allowing attackers to bypass hardware-based MFA where policy permits fallback methods like SMS or email codes," Dataminr said .
‎August 2026
Threat actors gained unauthorized access to the company's systems and stole sensitive data, including account information, API keys, and other secrets.
victims 500 victims
Back in August 2026, U.S. agencies revealed that Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors as of April 2026, while continuing to exploit unpatched vulnerabilities as its primary means of initial access.
‎October 7, 2026
Threat actors, including Robert Wayne Boling and co-conspirator Fredrick Brown, used spear-phishing emails to obtain access to U.S. businesses' electronic systems and exploit stolen personally identifiable information of thousands of military-affiliated individuals.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
organisation PII
"Boling operated from the Philippines, and he received and exploited stolen personally identifiable information (PII) of U.S. servicemembers and veterans to compromise their bank accounts and steal money and veterans' benefits," the DoJ said .
organisation DoJ
"Boling operated from the Philippines, and he received and exploited stolen personally identifiable information (PII) of U.S. servicemembers and veterans to compromise their bank accounts and steal money and veterans' benefits," the DoJ said .
organisation the U.S. Army
"Boling's co-conspirator, Fredrick Brown, who worked as a civilian medical records administrator for the U.S. Army in South Korea, took digital photographs of the PII of thousands of military-affiliated individuals.
organisation the PII of thousands
"Boling's co-conspirator, Fredrick Brown, who worked as a civilian medical records administrator for the U.S. Army in South Korea, took digital photographs of the PII of thousands of military-affiliated individuals.
financial $2.5 scheme Chukwuemeka Victor Amachukwu
The conspirators also obtained the stolen identity information of thousands of individuals and then used this information to file fraudulent tax returns with the Internal Revenue Service and state tax authorities, obtaining at least approximately $2.5 million.
organisation the Internal Revenue Service
The conspirators also obtained the stolen identity information of thousands of individuals and then used this information to file fraudulent tax returns with the Internal Revenue Service and state tax authorities, obtaining at least approximately $2.5 million.
organisation the U.S. Department of Justice (DoJ
"Amachukwu took part in sophisticated schemes to hack into U.S. businesses, steal and use stolen identity information of victims, and commit fraud," the U.S. Department of Justice (DoJ) said .
‎October 7
PingCAP became aware of the incident on October 7 and began disabling the affected credentials.
‎about October 9th
Threat actors began their industry-wide attack on October 9th.
‎October 13, 2026
Threat actors exploited vulnerabilities in various systems, including Roundcube and Andromeda, to gain unauthorized access to sensitive information.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
infrastructure Roundcube
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
infrastructure 1.6.20
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
infrastructure 1.7.5
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
organisation IMAP
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
‎October 16, 2026
Threat actors exploited a legacy API endpoint to bypass authentication and run various functions without authentication, resulting in unauthorized withdrawals.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
organisation LMS
Internal business systems breached On October 16, 2026, Genesys disclosed that it became aware of a cybersecurity incident involving an unauthorized third party that allowed them to access certain internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) platform.
infrastructure Linux
Critical Kubernetes host takeover risk AegisSec Research has disclosed details of a NVIDIA AIStore for Linux flaw present in the legacy ETL Kubernetes PodSpec initialization API, CVE-2026-65162 aka ShadowForge (CVSS score: 10.0), that enables privileged container creation and host-level compromise.
organisation Critical Kubernetes
Critical Kubernetes host takeover risk AegisSec Research has disclosed details of a NVIDIA AIStore for Linux flaw present in the legacy ETL Kubernetes PodSpec initialization API, CVE-2026-65162 aka ShadowForge (CVSS score: 10.0), that enables privileged container creation and host-level compromise.
organisation AegisSec Research
Critical Kubernetes host takeover risk AegisSec Research has disclosed details of a NVIDIA AIStore for Linux flaw present in the legacy ETL Kubernetes PodSpec initialization API, CVE-2026-65162 aka ShadowForge (CVSS score: 10.0), that enables privileged container creation and host-level compromise.
organisation ETL Kubernetes PodSpec
Critical Kubernetes host takeover risk AegisSec Research has disclosed details of a NVIDIA AIStore for Linux flaw present in the legacy ETL Kubernetes PodSpec initialization API, CVE-2026-65162 aka ShadowForge (CVSS score: 10.0), that enables privileged container creation and host-level compromise.
organisation API
Critical Kubernetes host takeover risk AegisSec Research has disclosed details of a NVIDIA AIStore for Linux flaw present in the legacy ETL Kubernetes PodSpec initialization API, CVE-2026-65162 aka ShadowForge (CVSS score: 10.0), that enables privileged container creation and host-level compromise.
organisation Laravel
Critical API authentication bypass Laravel has patched a critical security flaw (CVE-2026-114509, CVSS score: 9.2) that could allow its built-in TokenGuard to be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
organisation CVSS
Critical API authentication bypass Laravel has patched a critical security flaw (CVE-2026-114509, CVSS score: 9.2) that could allow its built-in TokenGuard to be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
organisation TokenGuard
Critical API authentication bypass Laravel has patched a critical security flaw (CVE-2026-114509, CVSS score: 9.2) that could allow its built-in TokenGuard to be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token.
infrastructure 13.29.0
The issue has been patched in versions 13.29.0 and 12.68.0.
infrastructure 12.68.0
The issue has been patched in versions 13.29.0 and 12.68.0.
infrastructure 11.0.9
The vulnerability has been patched in version 11.0.9.
organisation 'NT AUTHORITY/Local Service'
They can also run code to execute system commands as 'NT AUTHORITY/Local Service' and gain control of the server.
organisation NFC bank
NFC bank fraud arrests Dutch police authorities have arrested two suspects in connection with a bank helpdesk fraud scheme that netted 170 victims and €380,000 in illicit proceeds.
victims 170 victims
NFC bank fraud arrests Dutch police authorities have arrested two suspects in connection with a bank helpdesk fraud scheme that netted 170 victims and €380,000 in illicit proceeds.
financial €380,000 € victims
NFC bank fraud arrests Dutch police authorities have arrested two suspects in connection with a bank helpdesk fraud scheme that netted 170 victims and €380,000 in illicit proceeds.
organisation NFC
In the process, the threat actors were able to forward the data from the bank card's NFC chip to the threat actor, who then used it to make unauthorized withdrawals.
organisation SQL
Unauthenticated database exposure An unauthenticated SQL injection vulnerability has been disclosed in GLPI 11.0.8 (GHSA-753w-2942-4pxm) that could allow a remote attacker to read the entire GLPI application database.
organisation GHSA-753w-2942
Unauthenticated database exposure An unauthenticated SQL injection vulnerability has been disclosed in GLPI 11.0.8 (GHSA-753w-2942-4pxm) that could allow a remote attacker to read the entire GLPI application database.
organisation Eptura Archibus
Critical unauthenticated RCE risk Rapid7 said it discovered three new vulnerabilities in Eptura Archibus that could be exploited to achieve code execution.
‎October 19, 2026
Threat actors from Hong Kong and Taiwan exploited vulnerabilities in XWiki, Apache HTTP Server, PHPUnit, PHP-CGI, and ThinkPHP to deploy reverse shells.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
organisation DHS
The DHS order, issued in July and made public on October 19, 2026, also bars federal civilian agencies from procuring DeepSeek products and services.
organisation XWiki
" XWiki exploitation and botnet activity Earlier this month, the U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.
organisation Department of Justice (DoJ
" XWiki exploitation and botnet activity Earlier this month, the U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.
organisation Flax Typhoon
" XWiki exploitation and botnet activity Earlier this month, the U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.
organisation RedTail
On the other hand, the Hong Kong IP is a RedTail-family botnet.
organisation CVE-2017-9841
In a follow-up alert, VulnCheck said it observed attempts against five vulnerabilities -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan).
organisation CVE-2024-4577
In a follow-up alert, VulnCheck said it observed attempts against five vulnerabilities -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan).
organisation CVE-2022-47945
In a follow-up alert, VulnCheck said it observed attempts against five vulnerabilities -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan).
organisation VulnCheck
In a follow-up alert, VulnCheck said it observed attempts against five vulnerabilities -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan).
organisation PHP-CGI
In a follow-up alert, VulnCheck said it observed attempts against five vulnerabilities -- PHPUnit (CVE-2017-9841), XWiki (CVE-2025-24893), Apache HTTP Server (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan).
organisation IP
"The Hong Kong IP exploited targets in Mexico, Great Britain, and Malaysia, while the Taiwan IPs exploited targets in India."
organisation FishHub
While Microscan was used to facilitate reconnaissance and computer vulnerability scanning, FishHub allegedly enabled the exploitation of computer networks through spear-phishing attacks and the deployment of follow-on payloads.
organisation DeepSeek
For DeepSeek-hosted instances of their models, DeepSeek's account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users.
‎Oct 22, 2026
Threat actors used phishing to compromise over 4,500 accounts at Bluesky.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
infrastructure Android
" Android malware scam losses The Singapore Police Force has alerted users of a malware-enabled scam variant involving advertisements on social media platforms promoting senior-focused activities and programmes, water-based fitness activities, and recycling initiatives.
infrastructure Linux
Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays .
organisation Critical PHP
Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays .
organisation GitLab RCE
Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays .
organisation Node.js RCE
Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays .
organisation Tor
Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays .
‎2026/10/22
Threat actors exploited multiple vulnerabilities in various software systems, including AI secrets leak, PingCAP source theft, Signal hang-up flaw, and Laravel auth bypass.
‎between September 9 and October 7, 2026
Threat actors exploited multiple vulnerabilities in various software systems, including AI secrets leak, PingCAP source theft, Signal hang-up flaw, and Laravel auth bypass, between September 9 and October 7, 2026.
‎2026/10/22
Threat actors used a hacking scheme involving tax fraud, identity theft, and years-long activities to target individuals in the U.S.
financial $2.5 scheme Chukwuemeka Victor Amachukwu
…errors, customer contacts, contract terms, orders, pricing, payment terms, and billing configuration. $2.5 million tax fraud scheme Chukwuemeka Victor Amachukwu (aka Chukwuemeka Victor Eletuo and So Kwan Leung), a 40-year-old Nigerian national, has been sentenced to eight years in prison in the U.S. for running a years-long hacking, tax fraud, and identity theft scheme.
organisation AI Secrets Leak
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More.
organisation Source Theft
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More.
organisation Signal Hang-Up Flaw
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More.
organisation Laravel Auth Bypass
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More.
organisation Hacking News / Cybersecurity News
 Ravie Lakshmanan  Oct 22, 2026 Hacking News / Cybersecurity News This week has already been rough for cybersecurity.
‎December 1, 2026
Zeabur will shut down its services from December 1, 2026 to December 31, 2026 in response to a cybersecurity incident that exposed over 3.2 million environment variable records and internal credentials stored in plaintext.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
general_metric 3.2 secrets
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
data_breach 3.2 variable records
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
general_metric 321,810 accounts
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
‎December 31, 2026
Zeabur will shut down its services by December 31, 2026, in response to a cybersecurity incident that exposed over 3.2 million environment variable records and internal credentials stored in plaintext.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
general_metric 3.2 secrets
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
data_breach 3.2 variable records
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
general_metric 321,810 accounts
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
‎January 14, 2027
A critical remote code execution (RCE) flaw has been disclosed in OpenCode affecting Windows and Windows Subsystem for Linux.
industry Finance
General Document Context
industry Government
General Document Context
industry Defense
General Document Context
industry Technology
General Document Context
organisation Chrome Holding Co.
$6 million data breach settlement Chrome Holding Co., a holding company formerly known as 23andMe, has agreed to pay California $6 million to resolve accusations that it did not effectively secure customers' personal and genetic data, resulting in a massive 2023 breach that exposed sensitive information belonging to nearly 7 million people.
financial $6 settlement Chrome Holding Co.
$6 million data breach settlement Chrome Holding Co., a holding company formerly known as 23andMe, has agreed to pay California $6 million to resolve accusations that it did not effectively secure customers' personal and genetic data, resulting in a massive 2023 breach that exposed sensitive information belonging to nearly 7 million people.
infrastructure Linux
Critical developer-machine RCE A critical remote code execution (RCE) flaw has been disclosed in OpenCode affecting Windows and Windows Subsystem for Linux (WSL).
infrastructure Windows
Critical developer-machine RCE A critical remote code execution (RCE) flaw has been disclosed in OpenCode affecting Windows and Windows Subsystem for Linux (WSL).
organisation Windows and Windows Subsystem
Critical developer-machine RCE A critical remote code execution (RCE) flaw has been disclosed in OpenCode affecting Windows and Windows Subsystem for Linux (WSL).
infrastructure 1.18.33
Anomaly, OpenCode's developer, fixed the issue in version 1.18.33.
organisation Anomaly
Anomaly, OpenCode's developer, fixed the issue in version 1.18.33.
organisation OpenCode
Anomaly, OpenCode's developer, fixed the issue in version 1.18.33.
organisation 23andMe Research Institute
"With regard to the genetic data or samples maintained by 23andMe Research Institute, consumers can request that the company delete their data, destroy their test sample, or revoke their permission for their genetic data to be used for research," the office of the California Attorney General said in a statement.
organisation Rogue AI
Rogue AI containment guidelines U.S. agencies NSA, CISA, and NIST have released joint security guidelines to help organizations detect, contain, and shut down AI (or SI) agents that exhibit deviations from their approved tasks.
organisation NIST
Rogue AI containment guidelines U.S. agencies NSA, CISA, and NIST have released joint security guidelines to help organizations detect, contain, and shut down AI (or SI) agents that exhibit deviations from their approved tasks.
organisation SI
Rogue AI containment guidelines U.S. agencies NSA, CISA, and NIST have released joint security guidelines to help organizations detect, contain, and shut down AI (or SI) agents that exhibit deviations from their approved tasks.
organisation MCP
"The flaw allows an attacker-controlled remote Model Context Protocol (MCP) server to execute arbitrary code on a developer's machine during a remote MCP OAuth authentication process, without additional user interaction or consent," Pillar Security said .
organisation CCP
Hirundo also revealed that removing the model's CCP alignment removes the vulnerability from the model's weights.
Tactical Metrics
Metrics
infrastructure
‎Android
Affected Product
" Android malware scam losses The Singapore Police Force has alerted users of a malware-enabled scam variant involving advertisements on social media platforms promoting senior-focused activities and programmes, water-based fitness activities, and recycling initiatives.
"In this scam, victims would come across the fake advertisements on social media platforms, such as Facebook, and be instructed to download an Android Application Package (APK) file to facilitate programme registration or service arrangements," the Singapore Police Force said .
It also affects every Signal client across Android, iOS, and desktop.
Metrics
victims
600
Victims
600+ ransomware victims A new advisory from intelligence agencies in Germany, the U.K., and the U.S. has revealed that at least 600 organizations across North America, South America, Europe, and Australia have been breached by the SafePay ransomware gang since August 2024.
Metrics
financial
6,000,000
Settlement Chrome Holding Co.
$6 million data breach settlement Chrome Holding Co., a holding company formerly known as 23andMe, has agreed to pay California $6 million to resolve accusations that it did not effectively secure customers' personal and genetic data, resulting in a massive 2023 breach that exposed sensitive information belonging to nearly 7 million people.
Metrics
infrastructure
‎Linux
Affected Product
Critical PHP and GitLab RCE flaws, serious Linux security bugs , compromised eMudhra certificates , a Node.js RCE flaw , a hacked LiteLLM release, and hundreds of hijacked Tor relays .
Critical Kubernetes host takeover risk AegisSec Research has disclosed details of a NVIDIA AIStore for Linux flaw present in the legacy ETL Kubernetes PodSpec initialization API, CVE-2026-65162 aka ShadowForge (CVSS score: 10.0), that enables privileged container creation and host-level compromise.
Critical developer-machine RCE A critical remote code execution (RCE) flaw has been disclosed in OpenCode affecting Windows and Windows Subsystem for Linux (WSL).
Metrics
infrastructure
‎Roundcube
Affected Product
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
Metrics
infrastructure
‎1.6.20
Software Version
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
Metrics
infrastructure
‎1.7.5
Software Version
20 security flaws patched Roundcube has released versions 1.6.20 and 1.7.5, addressing 20 issues including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
Metrics
infrastructure
‎13.29.0
Software Version
The issue has been patched in versions 13.29.0 and 12.68.0.
Metrics
infrastructure
‎12.68.0
Software Version
The issue has been patched in versions 13.29.0 and 12.68.0.
Metrics
infrastructure
‎11.0.9
Software Version
The vulnerability has been patched in version 11.0.9.
Metrics
infrastructure
‎Windows
Affected Product
Critical developer-machine RCE A critical remote code execution (RCE) flaw has been disclosed in OpenCode affecting Windows and Windows Subsystem for Linux (WSL).
Metrics
infrastructure
‎1.18.33
Software Version
Anomaly, OpenCode's developer, fixed the issue in version 1.18.33.
Metrics
infrastructure
‎Ios
Affected Product
It also affects every Signal client across Android, iOS, and desktop.
Metrics
victims
170
Victims
NFC bank fraud arrests Dutch police authorities have arrested two suspects in connection with a bank helpdesk fraud scheme that netted 170 victims and €380,000 in illicit proceeds.
Metrics
financial
380,000
€ Victims
NFC bank fraud arrests Dutch police authorities have arrested two suspects in connection with a bank helpdesk fraud scheme that netted 170 victims and €380,000 in illicit proceeds.
Metrics
data_breach
3,200,000
Variable Records
" 3.2 million secrets exposed Development platform Zeabur said it will shut down its services starting December 1, 2026, and finish by December 31, 2026, in response to a cybersecurity incident in which attackers leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information fo…
Metrics
financial
2,500,000
Scheme Chukwuemeka Victor Amachukwu
…errors, customer contacts, contract terms, orders, pricing, payment terms, and billing configuration. $2.5 million tax fraud scheme Chukwuemeka Victor Amachukwu (aka Chukwuemeka Victor Eletuo and So Kwan Leung), a 40-year-old Nigerian national, has been sentenced to eight years in prison in the U.S. for running a years-long hacking, tax fraud, and identity theft scheme.
The conspirators also obtained the stolen identity information of thousands of individuals and then used this information to file fraudulent tax returns with the Internal Revenue Service and state tax authorities, obtaining at least approximately $2.5 million.
Metrics
victims
500
Victims
Back in August 2026, U.S. agencies revealed that Medusa developers and affiliates have impacted over 500 victims from a variety of critical infrastructure sectors as of April 2026, while continuing to exploit unpatched vulnerabilities as its primary means of initial access.
Metrics
financial
100,000,000
Financial Impact / Stolen Funds
The gang is also relying on access brokers, compensating them anywhere from $100 to $1 million to secure access to potential victims.
Metrics
financial
1,000,000
Financial Impact / Stolen Funds
The gang is also relying on access brokers, compensating them anywhere from $100 to $1 million to secure access to potential victims.
Intelligence Sources
The Hacker News 2026-10-22