Overview
This roundup condenses the notable items from The Hacker News ThreatsDay bulletin of October 22, 2026. Figures are as reported by the original sources.
Breaches and Incidents
| Item | Details |
|---|---|
| PingCAP | Stolen service account credentials were used between September 9 and October 7, 2026 to copy source code and customer records, including SQL editor content, encrypted API key values, contract and billing details, and contact data. Credentials were disabled starting October 7 |
| Zeabur | Leaked plaintext internal credentials were used on October 14 and 15 to reach shared clusters, some dedicated servers, and internal systems. Reportedly over 3.2 million environment variable records and data for 321,810 accounts were taken. Services shut down December 1 to 31, 2026, after an August breach |
| Genesys | Disclosed October 16. An unauthorized party accessed internal business systems, including a learning management system and CRM, and downloaded business and account information. Genesys Cloud and Genesys Engage were not compromised |
| Andromeda | AI infrastructure provider detected credential access on October 13, believed to have begun around October 9 as part of an industry-wide attack. A limited number of accounts were affected |
| Bluesky | More than 4,500 accounts were compromised through posts advertising a fake government payment |
| OpenCode Console | A breach affected 1.4% of users and may have exposed linked API keys for Anthropic, OpenAI, and Google |
Vulnerabilities
| Product | Identifier | Issue |
|---|---|---|
| NVIDIA AIStore | CVE-2026-65162 (CVSS 10.0) | Legacy ETL Kubernetes PodSpec initialization API allows privileged container creation and host compromise |
| Laravel | CVE-2026-114509 (CVSS 9.2) | TokenGuard bypass on MySQL or MariaDB with a crafted non-string credential. Fixed in 13.29.0 and 12.68.0 |
| Signal | CVE-2026-113380 (CVSS 9.3) | A malicious peer can flood RingRTC's call event queue so hang-up is never processed, leaving the microphone or camera active |
| Eptura Archibus | CVE-2026-107186, -107187, -107188 (up to 9.6) | Legacy API auth bypass, full database read, and insecure file upload leading to RCE |
| GLPI 11.0.8 | GHSA-753w-2942-4pxm | Unauthenticated SQL injection. Fixed in 11.0.9 |
| Roundcube | 1.6.20, 1.7.5 | 20 fixes including IMAP command injection and an SSRF filter bypass. No exploitation seen |
| OpenCode (Windows/WSL) | Fixed in 1.18.33 | A malicious remote MCP server could execute code during OAuth authentication |
| ChatGPT GitHub Connector | Prompt injection | Hidden instructions in a public repository can make ChatGPT write a workflow into a private repository that exfiltrates secrets. OpenAI classified the report as out of scope |
Threat Activity and Law Enforcement
- SafePay ransomware: a joint German, UK, and US advisory says the group has breached at least 600 organizations since August 2024, using edge device CVEs or credential brute-forcing.
- VulnCheck observed exploitation of XWiki (CVE-2025-24893), PHPUnit, Apache (CVE-2021-41773), PHP-CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) following the FBI's disruption of Flax Typhoon tools.
- Dutch NFC relay fraud: two suspects were arrested over a scheme that hit 170 victims for about €380,000 using AI-generated voice calls and NFC card relay.
- Singapore: at least 62 malicious APK scam cases since April 2026, with about S$989,000 lost.
- Okta/ServiceNow-themed phishing uses lookalike domains and MFA downgrade lures aimed at YubiKey users.
- Sentencing: Amachukwu received eight years for tax fraud and hacking schemes. Boling pleaded guilty to wire fraud and money laundering conspiracy, with sentencing set for January 14, 2027.
Policy and Platform Changes
- NSA, CISA, and NIST released voluntary guidance with 10 practices for detecting and containing AI agents that deviate from approved tasks.
- Chrome now asks permission before making insecure HTTP connections by default for all users.
- DeepSeek: a DHS order made public October 19 bars DeepSeek-related technology from federal civilian IT and procurement.
- 23andMe successor Chrome Holding Co. agreed to pay California $6 million over its 2023 breach.
Recommended Actions
- Patch Laravel, GLPI, Roundcube, Signal, and OpenCode where deployed.
- Rotate credentials and API keys for PingCAP, Zeabur, Andromeda, and OpenCode Console if you use them.
- Review edge devices against the SafePay advisory and enforce MFA.
- Restrict AI connector scopes to the specific repositories required.