Artificial Intelligence · Cybersecurity
ThreatsDay rounds up account thefts, flaws and breaches
The Hacker News gathered a week of security disclosures, ranging from account compromise at Bluesky and a Singapore scam warning to patched flaws, internal system access and source-code theft at several firms.
- The article was a ThreatsDay roundup of several security incidents and vulnerability disclosures from the same week.
- Bluesky said a phishing campaign had compromised more than 4,500 accounts, while the Singapore Police Force said a scam involving social media adverts and APK downloads had produced at least 62 cases and S$989,000 in losses.
- Roundcube, Genesys, AegisSec Research, Laravel, GLPI and Rapid7 each disclosed or patched issues involving authentication bypass, SQL injection, internal system access or possible remote code execution.
- Zeabur and PingCAP said attackers used stolen or leaked credentials to reach internal systems and take data, and the article also noted separate criminal cases and a settlement involving Chrome Holding Co.
Bluesky said a phishing campaign had affected more than 4,500 accounts after users were lured by posts about a fake government payment. The Singapore Police Force warned about a scam that used social media adverts and APK files, and said it had seen 62 cases and S$989,000 in losses since April 2026. Andromeda said it found unauthorised access to credentials on 13 October and said it had not seen access to models, datasets or training data.
Roundcube released versions 1.6.20 and 1.7.5 to fix 20 issues, including IMAP command injection, SSRF filter bypass and unsafe attachment handling. Genesys said an unauthorised third party had reached internal business systems on 16 October, including a learning management system and a CRM platform, but said its cloud products were not compromised.
AegisSec Research disclosed CVE-2026-65162 in NVIDIA AIStore for Linux and said it could allow privileged container creation and host compromise. Laravel said CVE-2026-114509 could let an attacker authenticate as another user without a valid token, while GLPI 11.0.8 had an SQL injection flaw that Mobeta said could expose the full application database. Rapid7 said three flaws in Eptura Archibus included one that could lead to remote code execution.
Zeabur said attackers used leaked internal credentials on 14 and 15 October to reach shared infrastructure, some dedicated servers and internal systems, then read the platform database and take more than 3.2 million environment variable records and details for 321,810 accounts. PingCAP said stolen service-account credentials were used between 9 September and 7 October to reach internal systems, copy source code and take customer-related records.
The roundup also noted Dutch arrests over an NFC bank-fraud scheme and U.S. cases involving Chukwuemeka Victor Amachukwu and Robert Wayne Boling. It also said Chrome Holding Co., formerly known as 23andMe, agreed to pay California $6 million over claims tied to the 2023 breach.
Named in this story
People
- Chukwuemeka Victor Amachukwu
- was sentenced in the United States for a tax fraud scheme
- Kinglsley Uchelue Utulu
- was named as a co-conspirator in the tax fraud scheme
- Robert Wayne Boling
- pleaded guilty to identity theft and fraud charges
- Fredrick Brown
- supplied stolen military-related personal data to Boling
Companies
- Bluesky
- said more than 4,500 accounts were compromised in a phishing attack
- Andromeda
- said a security incident exposed customer credentials
- Genesys
- said an unauthorised party accessed internal business systems
- Zeabur
- said attackers used leaked credentials to reach its systems and later shut down service
- PingCAP
- said stolen credentials were used to copy source code and customer records
- Chrome Holding Co.
- agreed to pay California to resolve 23andMe breach claims
Organisations
- AegisSec Research
- disclosed the NVIDIA AIStore for Linux flaw
- Mobeta
- said the GLPI flaw could expose the application database
- Rapid7
- said it found three vulnerabilities in Eptura Archibus
Governments and agencies
- Singapore Police Force
- warned about a malware-enabled scam and reported 62 cases
- U.S. Department of Justice
- described the tax fraud and identity theft cases
Products and systems
- Roundcube
- released versions 1.6.20 and 1.7.5 to fix 20 issues
- NVIDIA AIStore for Linux
- was the affected software in the disclosed flaw
- Laravel
- patched a critical TokenGuard authentication bypass
- GLPI
- had an SQL injection vulnerability disclosed in version 11.0.8
- Eptura Archibus
- was the software affected by the disclosed vulnerabilities
How the source tells it
The register was promotional and urgency-led, using teaser language and broad claims about a rough week to make the roundup feel more pressing.
- urgency broad time-pressure framing and a prompt to subscribe to the bulletin
- hype teaser language that presented the roundup as containing overlooked surprises
- threat inflation sweeping claims that the week was already exceptionally bad and that the major headlines were only part of the story