ThreatsDay Highlights Credential Breaches and Critical Security Flaws
Credential incidents and critical flaws dominate the week
This week’s ThreatsDay roundup brings together security incidents and newly disclosed vulnerabilities affecting cloud platforms, developer tools, messaging applications and enterprise software. Among the most consequential cases, development platform Zeabur said attackers exposed more than 3.2 million environment-variable records and information associated with 321,810 accounts, while PingCAP confirmed source-code theft and exposure of TiDB Cloud customer-related information.
Zeabur said an attacker used leaked internal credentials on October 14 and 15, 2026, to access a shared cluster, some Dedicated Servers and internal systems before reading the platform database. The company said this was its second breach of the year and plans to begin shutting down services on December 1, completing the process by December 31.
PingCAP said stolen service-account credentials were used between September 9 and October 7 to access certain internal systems, copy data and obtain source code. The exported information included user names and email addresses, organisation and project associations, SQL editor text and errors, customer contacts, contract terms, orders, pricing, payment terms and billing configuration. PingCAP said it learned of the incident on October 7 and began disabling the affected credentials that day.
Authentication, database and call-control risks
Laravel released versions 13.29.0 and 12.68.0 to fix CVE-2026-114509, a critical TokenGuard issue with a CVSS score of 9.2. Under certain MySQL or MariaDB configurations, a specially crafted non-string credential value could be mishandled during an authentication lookup, potentially allowing an unauthenticated attacker to authenticate as an arbitrary existing user without that user’s valid API token.
Signal users face a separate call-control issue in RingRTC, the WebRTC-based middleware behind Signal voice and video calling. CVE-2026-113380, rated 9.3, could allow a malicious caller to keep audio and video tracks enabled after a victim hangs up. The reported weakness affects Signal clients on Android, iOS and desktop because peer-originated events can fill the call state machine’s queue and delay hang-up processing.
Other high-severity disclosures include CVE-2026-65162, also known as ShadowForge, in NVIDIA AIStore for Linux. AegisSec Research said the legacy ETL Kubernetes PodSpec initialisation API can permit privileged container creation and host-level compromise; the flaw has a CVSS score of 10.0. GLPI 11.0.9 fixes an unauthenticated SQL injection issue in version 11.0.8 that could expose the entire application database.
Broader exposure across software and identity systems
Roundcube issued versions 1.6.20 and 1.7.5 to address 20 security issues, including IMAP command injection, SSRF filter bypass and unsafe attachment handling. Genesys disclosed unauthorised access to internal learning-management and customer-relationship-management systems, while stating that its Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised.
The roundup also details phishing and fraud activity. Bluesky said a fake government-payment offer led to the compromise of more than 4,500 accounts. The Singapore Police Force reported at least 62 Android malware-scam cases since April 2026, with losses of S$989,000. In another campaign, Okta and ServiceNow-themed domains hosted spoofed SSO pages and MFA-downgrade lures aimed at YubiKey users.
For businesses, the immediate implication is to prioritise credential rotation after suspected exposure, deploy the stated fixed versions, and review fallback authentication, service-account privileges and internet-facing systems. The incidents show that a leaked credential or an overlooked authentication path can affect systems well beyond the first point of compromise.