/
← Voltar ao feed
high technology cloud social media finance government military healthcare

ThreatsDay bulletin: Zeabur, PingCAP, Genesys and Andromeda breaches, Bluesky phishing, Laravel, GLPI and Eptura Archibus flaws

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 14:45 · coletado há 7 horas

This weekly roundup covers a cluster of breaches, critical vulnerabilities and law-enforcement actions. Bluesky confirmed more than 4,500 accounts compromised in a phishing campaign using a fake government payment offer. Zeabur will shut down after a second breach this year that exposed over 3.2 million environment variable records and data for 321,810 accounts. PingCAP, Genesys and Andromeda also disclosed intrusions involving stolen credentials, source code or CRM data. Critical flaws were patched or disclosed in Laravel, GLPI, Eptura Archibus, NVIDIA AIStore and Roundcube.

Entenda a falha

A vulnerabilidade

Most severe first. CVE-2026-65162 (ShadowForge, CVSS 10.0) is in NVIDIA AIStore for Linux, in the legacy ETL Kubernetes PodSpec initialization API, and allows privileged container creation and host-level compromise. Eptura Archibus has CVE-2026-107188 (insecure file upload leading to RCE, 9.6, code runs as NT AUTHORITY/Local Service), CVE-2026-107186 (auth bypass, 8.6) and CVE-2026-107187 (database read, 8.5). Laravel CVE-2026-114509 (9.2) is a TokenGuard authentication bypass on MySQL/MariaDB: an unauthenticated attacker with a crafted non-string credential authenticates as another user. Fixed in 13.29.0 and 12.68.0. GLPI 11.0.8 has an unauthenticated SQL injection (GHSA-753w-2942-4pxm) that reads the whole database and, depending on version, can lead to admin takeover and RCE. Fixed in 11.0.9. Roundcube 1.6.20 and 1.7.5 fix 20 issues, including IMAP command injection and SSRF filter bypass.

Como funciona

The articles give little mechanism detail. For AIStore, the flaw sits in the legacy ETL API that initializes a Kubernetes PodSpec; the result is that a privileged container can be created, which gives control of the host. For Laravel, a credential that is not a string reaches TokenGuard when the app uses MySQL/MariaDB, and the guard ends up authenticating the request as a different user. For GLPI, attacker-supplied input reaches a database query without authentication, so the database can be read. The sources do not describe the internal steps of the Archibus or Roundcube bugs beyond their type.

Por que é vulnerável

The articles state causes only by class. Laravel's bug is an authentication bypass triggered by a non-string credential, which points to input that is not validated or typed as expected before it is used to look up the user, though the articles do not spell out the code-level reason. GLPI's is an SQL injection, and Archibus includes an insecure file upload. The AIStore flaw lets a PodSpec produce privileged containers. Roundcube's fixes cover command injection, a filter bypass and unsafe attachment handling. The articles do not say why these went unnoticed or what each patch changes in detail.

Onde está

AIStore: the legacy ETL Kubernetes PodSpec initialization API; Laravel: the TokenGuard component; GLPI: public advisory GHSA-753w-2942-4pxm. No files, functions or commits are named.

Como foi descoberta

AegisSec Research reported and disclosed details of the NVIDIA AIStore flaw CVE-2026-65162. Rapid7 found the three Eptura Archibus CVEs. Mobeta reported the GLPI SQL injection. The articles do not say who found the Laravel bug or how. Roundcube published 1.6.20 and 1.7.5 with 20 fixes, and there is no evidence any of them have been exploited.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 16:16.

Detalhes técnicos

  • Bluesky: phishing posts promoting a fake government payment compromised more than 4,500 accounts. The accounts were suspended while owners recover them.
  • Singapore Police Force: Android malware scam spread through fake Facebook ads for senior, fitness and recycling programmes that push an APK. Victims then get calls from scammers impersonating officials or banks. At least 62 cases since April 2026 caused S$989,000 in losses.
  • Andromeda: unauthorized access to credentials was identified on October 13, 2026. The company believes it began around October 9 as part of an "industry-wide attack". A limited number of customer accounts were affected, with no evidence that customer models, datasets or training data were accessed.
  • Genesys: disclosed on October 16, 2026 that a third party accessed its internal LMS and CRM and accessed or downloaded business and account information. Genesys Cloud, Engage and Engage Cloud were not compromised.
  • Zeabur: on October 14–15, 2026 an attacker used leaked internal credentials stored in plaintext to break into the shared cluster, some Dedicated Servers and internal systems, and read the platform database. More than 3.2 million environment variable records and data for 321,810 accounts were stolen. Services close between December 1 and December 31, 2026. An earlier breach in August 2026 exposed account information, API keys and other secrets.
  • PingCAP: between September 9 and October 7, 2026 an unauthorized party used stolen service account credentials to copy source code and customer records. These included SQL editor content, encrypted API-key values, user names, emails, contacts, contract terms, orders and billing configuration.
  • NVIDIA AIStore: CVE-2026-65162 (ShadowForge, CVSS 10.0), reported by AegisSec Research, is in the legacy ETL Kubernetes PodSpec initialization API. It allows privileged container creation and host-level compromise.
  • Laravel: CVE-2026-114509 (CVSS 9.2) is a TokenGuard authentication bypass on MySQL/MariaDB. A crafted non-string credential lets an unauthenticated attacker authenticate as another user. It is fixed in 13.29.0 and 12.68.0.
  • GLPI: an unauthenticated SQL injection in 11.0.8 (GHSA-753w-2942-4pxm), reported by Mobeta, allows reading the whole database. Depending on version it can lead to admin takeover and RCE. It is fixed in 11.0.9.
  • Eptura Archibus: Rapid7 found CVE-2026-107186 (auth bypass, CVSS 8.6), CVE-2026-107187 (database read, 8.5) and CVE-2026-107188 (insecure file upload leading to RCE, 9.6). Code runs as NT AUTHORITY/Local Service.
  • Roundcube: versions 1.6.20 and 1.7.5 fix 20 issues, including IMAP command injection, SSRF filter bypass and unsafe attachment handling. No exploitation is known.
  • Law enforcement and policy:
    • Dutch police arrested two suspects in an AI-voice bank helpdesk and NFC card relay fraud (170 victims, €380,000).
    • A Nigerian national, Chukwuemeka Victor Amachukwu, was sentenced to eight years for a spear-phishing-driven tax identity theft scheme (about $2.5 million).
    • Robert Wayne Boling pleaded guilty to defrauding US service members and veterans.
    • Chrome Holding Co. (formerly 23andMe) will pay California $6 million over the 2023 breach.
    • NSA, CISA and NIST released voluntary guidance on containing rogue AI agents.

Remediação

  • Upgrade Laravel to 13.29.0 or 12.68.0, GLPI to 11.0.9, and Roundcube to 1.6.20 or 1.7.5.
  • Apply vendor fixes for Eptura Archibus and NVIDIA AIStore.
  • Rotate credentials and API keys for affected Zeabur, PingCAP and Andromeda accounts.
  • Do not install APKs from social media ads, and treat unsolicited bank or government calls and requests to scan bank cards as fraud.

Linha do tempo

  1. thehackernews.com ↗ · pub. 22/10/2026 14:45 · coletado 22/10 16:00 primeiro registro

    ThreatsDay bulletin: Zeabur, PingCAP, Genesys and Andromeda breaches, Bluesky phishing, Laravel, GLPI and Eptura Archibus flaws

    ler a análise desta fonte

    This weekly roundup covers a cluster of breaches, critical vulnerabilities and law-enforcement actions. Bluesky confirmed more than 4,500 accounts compromised in a phishing campaign using a fake government payment offer. Zeabur will shut down after a second breach this year that exposed over 3.2 million environment variable records and data for 321,810 accounts. PingCAP, Genesys and Andromeda also disclosed intrusions involving stolen credentials, source code or CRM data. Critical flaws were patched or disclosed in Laravel, GLPI, Eptura Archibus, NVIDIA AIStore and Roundcube.

    Technical Details

    • Bluesky: phishing posts promoting a fake government payment compromised more than 4,500 accounts. The accounts were suspended while owners recover them.
    • Singapore Police Force: Android malware scam spread through fake Facebook ads for senior, fitness and recycling programmes that push an APK. Victims then get calls from scammers impersonating officials or banks. At least 62 cases since April 2026 caused S$989,000 in losses.
    • Andromeda: unauthorized access to credentials was identified on October 13, 2026. The company believes it began around October 9 as part of an "industry-wide attack". A limited number of customer accounts were affected, with no evidence that customer models, datasets or training data were accessed.
    • Genesys: disclosed on October 16, 2026 that a third party accessed its internal LMS and CRM and accessed or downloaded business and account information. Genesys Cloud, Engage and Engage Cloud were not compromised.
    • Zeabur: on October 14–15, 2026 an attacker used leaked internal credentials stored in plaintext to break into the shared cluster, some Dedicated Servers and internal systems, and read the platform database. More than 3.2 million environment variable records and data for 321,810 accounts were stolen. Services close between December 1 and December 31, 2026. An earlier breach in August 2026 exposed account information, API keys and other secrets.
    • PingCAP: between September 9 and October 7, 2026 an unauthorized party used stolen service account credentials to copy source code and customer records. These included SQL editor content, encrypted API-key values, user names, emails, contacts, contract terms, orders and billing configuration.
    • NVIDIA AIStore: CVE-2026-65162 (ShadowForge, CVSS 10.0), reported by AegisSec Research, is in the legacy ETL Kubernetes PodSpec initialization API. It allows privileged container creation and host-level compromise.
    • Laravel: CVE-2026-114509 (CVSS 9.2) is a TokenGuard authentication bypass on MySQL/MariaDB. A crafted non-string credential lets an unauthenticated attacker authenticate as another user. It is fixed in 13.29.0 and 12.68.0.
    • GLPI: an unauthenticated SQL injection in 11.0.8 (GHSA-753w-2942-4pxm), reported by Mobeta, allows reading the whole database. Depending on version it can lead to admin takeover and RCE. It is fixed in 11.0.9.
    • Eptura Archibus: Rapid7 found CVE-2026-107186 (auth bypass, CVSS 8.6), CVE-2026-107187 (database read, 8.5) and CVE-2026-107188 (insecure file upload leading to RCE, 9.6). Code runs as NT AUTHORITY/Local Service.
    • Roundcube: versions 1.6.20 and 1.7.5 fix 20 issues, including IMAP command injection, SSRF filter bypass and unsafe attachment handling. No exploitation is known.
    • Law enforcement and policy:
      • Dutch police arrested two suspects in an AI-voice bank helpdesk and NFC card relay fraud (170 victims, €380,000).
      • A Nigerian national, Chukwuemeka Victor Amachukwu, was sentenced to eight years for a spear-phishing-driven tax identity theft scheme (about $2.5 million).
      • Robert Wayne Boling pleaded guilty to defrauding US service members and veterans.
      • Chrome Holding Co. (formerly 23andMe) will pay California $6 million over the 2023 breach.
      • NSA, CISA and NIST released voluntary guidance on containing rogue AI agents.

    Remediation

    • Upgrade Laravel to 13.29.0 or 12.68.0, GLPI to 11.0.9, and Roundcube to 1.6.20 or 1.7.5.
    • Apply vendor fixes for Eptura Archibus and NVIDIA AIStore.
    • Rotate credentials and API keys for affected Zeabur, PingCAP and Andromeda accounts.
    • Do not install APKs from social media ads, and treat unsolicited bank or government calls and requests to scan bank cards as fraud.