Threats Day: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

Summary: This week's roundup covers a Bluesky phishing attack that compromised more than 4,500 accounts through posts promoting a fake government payment offer, and a Singapore Police Force warning about a malware scam using social media ads for senior-focused activities that led to at least 62 cases and S$989,000 in losses since April 2026. It also details a Laravel TokenGuard authentication bypass (CVE-2026-114509, CVSS 9.2) patched in versions 13.29.0 and 12.68.0, a GLPI 11.0.8 SQL injection patched in 11.0.9, and PingCAP's disclosure that stolen service account credentials were used between September 9 and October 7, 2026 to copy source code and customer records.
Why it matters: Zeabur is shutting down entirely after attackers used internal credentials stored in plaintext to steal over 3.2 million environment variable records and data on 321,810 accounts - its second breach this year - which is the concrete cost of leaving secrets unencrypted in your own infrastructure.

Read the original at The Hacker News ↗