News archive · 64 stories
October 2026
- BreachBinance ties its $6.3 billion theft to a compromised DevOps engineer's laptopBinance said on October 30 that attackers used a DevOps engineer's compromised laptop to reach a service container and submit unauthorized withdrawals, moving about $6.3 billion on October 29. TRM Labs attributes the theft to North Korea's TraderTraitor; about $2.7 billion was frozen.
- Zero-dayCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patchCISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576 chained with the CVE-2026-104935 login bypass. Federal deadlines are November 2 and November 13.
- Social engineeringMicrosoft: fake Teams help desk calls led to AD CS certificates for privileged accounts and a domain controllerMicrosoft investigated two intrusions that began with attackers posing as IT support on Teams and ended with Active Directory Certificate Services abuse. ESC1 yielded certificates for 11 privileged accounts, ESC8 one for a domain controller, and one account left out of automated containment carried the data out.
- BreachNorthflank tells customers to assume every environment variable was decrypted after AI keys are abusedAfter a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.
- Machine identity26,400 working cloud and AI credentials found in public Gitee repositoriesA researcher scanned 7.25 million public repositories on Gitee, China's largest Git platform, and found 26,400 unique credentials that still worked, led by Alibaba Cloud access keys. One was an active organization-admin credential for a major enterprise AI platform.
- VulnerabilityLangflow flaws let attackers bypass authentication and run code; only 1.13.0 fixes themIBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public Metasploit module already cites, and unauthenticated code execution through MCP tool enumeration. Upgrade to 1.13.0.
- VulnerabilityLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificateCanonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate to their own TLS chain. Fixed in LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1.
- AI agentsOne scanner posed as 32 AI bots to hunt for .env files and SSH keys, Cequence saysCequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Perplexity, to request .env files, cloud credential files and private SSH keys. On one day it reached 48% of monitored organizations that saw AI bot traffic.
- Token theftA shared ChatGPT link could read the victim's session token and private chats, Parameter saysParameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's APIs as them, including pulling private chats. OpenAI fixed it by October 26 and paid a $5,000 bounty.
- AI agentsBank of America tells customers not to give AI agents their banking passwordBank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to act on their behalf, and reminded them they are responsible for activity from shared credentials. A spokesperson confirmed the email to TechCrunch on October 27.
- AI agentsIBM makes Agent Identity and HashiCorp Vault 2.2 generally available to govern AI agentsAt TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle and granted authority, while Vault gives agents their own accounts, renews their credentials and revokes them on unauthorized actions.
- AI agentsInfisical raises a $40 million Series B to build secrets and credential access for AI agentsInfisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in secrets, certificate and privileged access management and in Agent Vault, which brokers AI agent access without exposing credentials.
- BreachSony's So-net says an intruder took 2.6 million member records and 54,401 email passwordsSony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala records plus 54,401 email addresses with their passwords. It reset those mail passwords the same day.
- Social engineeringArctic Wolf counts 400-plus fake IT help desk intrusions over Teams external chatArctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.
- Tailscale SSH forwarding flaws let permitted sessions reach root-only socketsTailscale published four security bulletins on October 26, fixed in 1.104.4. The worst, TS-2026-014, let an authenticated Tailscale SSH peer allowed to forward ports reach root-only sockets such as Docker or the tailscaled local API.
- VulnerabilityAuthMask flaw let any Android app pull work-account tokens from Microsoft AuthenticatorEnclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and receive Microsoft Graph tokens for the signed-in work account. CVE-2026-80097 was fixed in 6.2606.4246.
- VulnerabilityHPE fixes three ArubaOS authentication bypass flaws among eight maximum-severity bugsHPE patched 72 ArubaOS vulnerabilities, eight of them maximum severity, including authentication bypasses CVE-2026-79844 and CVE-2026-79845 in AOS-10 and CVE-2026-79850 in AOS-8. HPE knew of no public exploit code or in-the-wild use.
- Machine identityLiteLLM traces its poisoned release to an admin key leaked in May and never revokedLiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it returned a GitHub org owner's unscoped CLI OAuth token, which led to stolen maintainer tokens and the 1.107.0 release.
- Token theftHuntress tracks stolen-session replay into 79 Microsoft 365 organizations without a passwordHuntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.
- VulnerabilityOkta Access Gateway flaw lets an admin run system commands as the gateway's service accountOkta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute system commands as the OAG service account. CVSS 9.1; fixed in 2026.10.2.
- BreachRailway says an attacker decrypted environment variables in up to 100,000 workspacesRailway's October 22 preliminary report says an attacker pulled encrypted customer environment variables, obtained CI credentials to decrypt a subset, and hunted for AI provider keys. At most 1.85% of workspaces, about 100,000, may be affected; all Railway API tokens were revoked.
- Access broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentialsGroup-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute force, decrypted stolen FortiGate configs, and exposed more than 70,000 credentials tied to network devices and LDAP dumps.
- VulnerabilityGitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoningGitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both on, plus OAuth/OIDC discovery cache poisoning and a SAML/LDAP membership lock gap.
- AI agentsPoisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hoursLiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.
- AI agentsMicrosoft names Storm-0940 behind ConnectWise app abuse that reached 2,250 Microsoft 365 tenantsMicrosoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in to more than 2,250 tenants, in some cases reaching privileged cloud access in under three hours.
- PasskeysAmazon says more than 500 million customers have turned on passkeysAmazon updated its passkey announcement on October 20 to say more than 500 million customers have enabled passkeys, which it says sign in about six times faster than passwords. Passwords remain available; Amazon calls a password-free account a goal, not a current default.
- Machine identityBrowsers block eight eMudhra intermediate CAs after their private keys are exposedA researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later found to be trivially weak). Chrome and Firefox blocked them within hours; Apple, Microsoft and Go followed, and Mozilla is removing the emSign ECC root.
- PasskeysFIDO Alliance to publish its wallet certification documents and opens a forum for issuers and regulatorsAt Authenticate 2026 on October 20, the FIDO Alliance said it will publish the Credential Manager Reference Architecture and a Framework for Verifier Identification in the coming weeks, and opened an External Advisory Forum for issuers, governments and regulators.
- BreachICO reprimands Ogi and Data Cymru after a 12-year-old test account with Password1 let ransomware inThe UK ICO reprimanded Ogi Networks and Data Cymru on October 20 over a November 2024 ransomware attack that entered through a test account named Test2, created in 2012 with the password Password1, and exposed data on 3,300 people, mostly children.
- Social engineeringFIDO and Imprivata survey: frontline authentication friction costs 32,400 hours a yearA Sapio Research survey of 700 IT and security leaders for Imprivata and the FIDO Alliance finds 95% have seen frontline workers work around authentication, 33% by sharing credentials, and only 15% use passkeys without a password. 60% report social engineering against the service desk.
- Token theftGhostAction phish completes a GitHub device flow, then hides a stealer in a font fileOpenSourceMalware found a fake GitHub security alert that proxied a maintainer's password and 2FA code, then silently completed an OAuth device flow for repo, workflow and read:org scopes. A second stage planted a credential stealer named fa-solid-400.woff2 in 94 repositories.
- VulnerabilityQilin and INC use the GlobalProtect auth bypass to skip MFA, then dump domain controller disksUnit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then in one case pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.
- BreachZeabur to shut down after a non-expiring admin token opened its shared clusterZeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private config repo, to read 3.2 million environment-variable records. The developer hosting platform will close by December 31, 2026.
- Token theftOne ConnectWise app credential opened Microsoft 365 tenants across MSP customersHuntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens in 162 tenants by October 16 and using a Cloud Management app to grant itself Global Administrator. ConnectWise has disabled seven app identities.
- VulnerabilityPEERSTITCH implant tags FortiOS VPN sessions to skip security checksUnit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.
- Zero-dayBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vaultCVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. Mandiant says the attacker pulled every admin credential from the appliance vault and raised Jump Item roles. CISA added it to KEV on October 16.
- PasskeysFIDO Passkey Index 2026: passkeys now carry 36% of sign-ins, and FIDO estimates 7 billion in useThe FIDO Alliance's Passkey Index 2026, built on data from 15 consumer services, finds 36% of successful sign-ins use a passkey, up from 26%, with a 93% success rate against 78% for passwords and traditional MFA. FIDO now estimates 7 billion passkeys are in use worldwide.
- SecretsGhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 reposGitGuardian counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in GhostAction's October wave, which committed workflows that dump Actions secrets and scan git history for credentials. Some victims were hit in 2025 and never rotated.
- Social engineeringIndia mandates registered caller name display (CNAP) on 4G and 5G networks from November 1India's Department of Telecommunications has ordered all access providers to show callers' subscriber-registered names on incoming calls from November 1, 2026, a network-level identity signal aimed at spam and fraud calls.
- Zero-dayIvanti Connect Secure auth bypass exploited; CISA gave agencies three daysCVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by an actor that went on to harvest LDAP and Active Directory credentials. KEV deadline October 16.
- VulnerabilityNGINX session ticket bug can skip client certificate checks in mTLS setupsCVE-2026-97629 lets a forged TLS session resume on NGINX 1.23.2 through 1.31.6 when a shared session cache is set without a ticket key file, which can bypass client-certificate verification. Fixed in 1.30.6 and 1.31.7; no exploitation reported.
- BreachPassword "123456" linked to the breach of Denmark's national CPR register covering 8.8 million peopleSomeone abused a private company's lawful search access to Denmark's CPR register and pulled names, addresses and CPR numbers for about 8.8 million people. A person claiming responsibility says the account password was 123456.
- DOJ charges 14 and shuts 40 laptop farms in North Korean IT worker identity schemeThe Justice Department charged 14 people, including aggravated identity theft, and seized about 187 computers and KVM devices after dismantling more than 40 Texas laptop farms that let North Korean IT workers pose as US employees at more than 70 companies.
- Supply chainSlugFest: npm trusted publishing trusted repository names, so reclaimed names could publishBloom Security found npm trusted publishing matched GitHub repositories by owner/name until first publish, letting anyone who reclaimed a renamed or deleted slug mint publish tokens for more than 1,500 packages. npm now expires unvalidated configurations after 48 hours.
- VulnerabilitySAP Cloud SDK for Python flaw sends OAuth client secrets to attackersCVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check went missing again in later releases.
- AI agentsWorkday to acquire C1.ai, formerly ConductorOne, to govern agent accessWorkday signed a definitive agreement to buy C1.ai, the access governance vendor that renamed itself from ConductorOne in April. Price undisclosed, close expected by January 31, 2027. The plan is to tie access for people and AI agents to Workday's HR lifecycle.
- VulnerabilityDocker Hub GhostPat flaw let account conversion hand access tokens to any victimCVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owner, without consent. An attacker could mint a token, convert, name a victim, and push to the victim's repositories. Docker found no exploitation.
- Machine identityIonQ to acquire Elisity, an identity-based microsegmentation vendor, for up to $1.3 billionQuantum computing company IonQ agreed to buy Elisity in an all-stock deal worth up to $1.3 billion, including a $150 million earnout. Elisity enforces least-privilege network policy per identity, covering users, devices, workloads and AI agents. Close is expected in Q4 2026.
- BreachASOS breach began with an employee tricked out of their loginASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.
- AI agentsOne prompt pulled AWS AgentCore role credentials from IMDS, and the default role reached every agent in the regionZenity Labs showed a prompt could make an Amazon Bedrock AgentCore agent fetch its execution role credentials from the instance metadata service. The default role could invoke other agents, read their conversations, plant memories and read Secrets Manager. AWS has since narrowed it.
- Token theftShai-Hulud reaches the Tensorlake npm SDK, with a wiper that fires when you revoke the stolen tokentensorlake@0.5.144, published from the project's own release workflow after commits pushed under a maintainer's name, carried a ChainDrop/Shai-Hulud credential stealer. A token monitor wipes the home directory if the stolen GitHub token is revoked first.
- PhishingUAT-11985 uses fake event invites to hit Taiwan research affiliates with Google AitM phishingCisco Talos tracks UAT-11985, a spear-phishing campaign that lures Taiwan research affiliates with event invitations, then relays their Google passwords and MFA challenges through an adversary-in-the-middle login page.
- FBI and Secret Service: FortiBleed is still active and locking victims outA joint FBI and USSS advisory says the FortiBleed credential campaign is still scanning FortiGate VPNs with stolen logins, and some victims are being locked out when attackers delete or change the original admin accounts. No CVE is involved.
- VulnerabilitySonicWall SMA1000 gets a third CVSS 10 pre-auth SSRF this yearCVE-2026-102255 lets an unauthenticated attacker use an unintended access path in the SMA1000 WorkPlace interface to reach internal functions. CVSS 10.0, fixed in 12.4.3-03670 and 12.5.0-03082, with no workaround.
- AI agentsAn encrypted web page tricked GitHub Copilot CLI into leaking a .env fileAdversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with encrypted instructions. GitHub validated the report but does not consider it a vulnerability.
- PhishingFake ChatGPT, Gemini and Claude ad portals capture credentials and MFA codes with operator-driven phishingIsland found a human-operated phishing platform posing as AI advertising tools. A browser-in-the-browser Connect window steals Google and Okta credentials while a live operator picks which MFA challenge to show next.
- BreachFBI removes contractor after a missed patch led to the ShinyHunters breach of employee dataThe FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters names the platform as Oracle PeopleSoft and the firm as Accenture.
- Digital IDNIST opens an implementation hub for SP 800-63-4, with machine-readable conformance criteriaNIST launched a resource site for the Digital Identity Guidelines, Revision 4, with FAQs, version 0.1 conformance criteria in Excel, PDF and OSCAL, a subscriber-controlled wallet explainer, and an authenticator reference. It adds no new requirements.