Threat reportData BreachTL-2026-4172
ThreatsDay Roundup: AI API Key Leaks (OpenCode Console), PingCAP Source Code Theft, Zeabur Breach, NVIDIA AIStore CVE-2026-65162, Signal CVE-2026-113380, Laravel CVE-2026-114509
ThreatsDay Roundup (TL-2026-4172), also tracked as ShadowForge, is a critical-severity data breach, first published 2026-10-22. It has no confirmed attribution, affects NVIDIA AIStore, references 16 CVEs (CVE-2026-65162, CVE-2026-114509, CVE-2026-113380), maps to 14 MITRE ATT&CK techniques (T1021.002, T1059.001, T1059.004), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 16Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4172
- Threat ID
- TL-2026-4172
- Also known as
- ShadowForge, ThreatsDay Roundup October 2026
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud-hosting, development, critical-infrastructure, enterprise-software, health
- Target regions
- Global, North America, 005 - South America, Europe, australia, india, mexico, united kingdom, malaysia
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in ThreatsDay Roundup
Malware and tooling: RedTail, safepay, Rclone - S1040
How ThreatsDay Roundup works
The Hacker News ThreatsDay bulletin (2026-10-22) aggregates October 2026 incidents: PingCAP source code and customer data theft via stolen service account credentials, an OpenCode Console breach exposing AI provider API keys for 1.4% of users, the Zeabur breach (3.2M environment variable records) and critical flaws in NVIDIA AIStore (CVSS 10.0), Signal RingRTC (9.3) and Laravel TokenGuard (9.2). It also covers SafePay ransomware (CISA AA26-293A) and Flax Typhoon-linked exploitation infrastructure.
This record tracks a multi-incident roundup published by The Hacker News on 2026-10-22. The items are independent incidents, not one campaign. Primary sources were checked for the main items.
Secret and credential theft. PingCAP disclosed on 2026-10-19 that attackers used stolen service account credentials between 2026-09-09 and 2026-10-07 to access internal systems, copy data and obtain source code. Exposed data included TiDB Cloud usernames, emails and organization/project associations, customer contacts, contract, pricing and billing details, encrypted API keys, SQL editor content and error logs. PingCAP found no evidence that data stored in TiDB was affected. It disabled the compromised accounts, patched four vulnerabilities (identified 2026-10-12/13, patched 2026-10-14) and added cloud storage access logging. Zeabur reported a second breach on 2026-10-14 after an August 2026 incident. The roundup reports 3.2 million environment variable records and 321,810 account records stolen via leaked internal credentials; Zeabur announced it will shut down by 2026-12-31 and its own post does not specify the vector or exact data scope. OpenCode Console suffered a breach the roundup describes as a large-scale distillation attack affecting 1.4% of Console users and exposing Anthropic, OpenAI and Google AI model API keys. Andromeda AI (identified 2026-10-13, suspected start 2026-10-09) and Genesys internal LMS/CRM systems (2026-10-16) also disclosed incidents.
AI developer tooling. Pillar Security disclosed a remote code execution flaw in opencode (npm opencode-ai, 1.0.137 through 1.18.32, Windows and WSL only). During MCP OAuth discovery, an attacker-controlled remote MCP server returns a malicious authorization_endpoint URL. The URL is passed unvalidated to the open package, which on Windows/WSL hands it to powershell -EncodedCommand, where a $(...) subexpression inside a double-quoted string executes. No user interaction beyond connecting to the server is needed. Reported 2026-08-29, fixed in 1.18.33 on 2026-09-28 (the real fix is the open package upgrade from 10.1.2 to 11.0.4), disclosed 2026-10-04 with no CVE because the vendor did not request one. The roundup also notes an indirect prompt injection against the ChatGPT GitHub connector via public repositories, which OpenAI deemed out of scope.
Critical vulnerabilities. NVIDIA AIStore CVE-2026-65162 (ShadowForge, CVSS 3.1 10.0, CWE-502) lets the legacy ETL InitSpecMsg API forward attacker-supplied Kubernetes PodSpecs without stripping privileged:true or hostPID:true, enabling a privileged pod and nsenter host escape; fixed in AIStore v5.0 on 2026-10-13 (NVIDIA bulletin 5889). Laravel CVE-2026-114509 (CVSS 4.0 9.2) is a TokenGuard authentication bypass on MySQL/MariaDB using crafted non-string credentials; fixed in 13.29.0 and 12.68.0. Signal CVE-2026-113380 (CVSS 9.3) in RingRTC lets a malicious caller keep audio/video tracks enabled after the victim hangs up. Eptura Archibus CVE-2026-107186/107187/107188 (CVSS 8.6/8.5/9.6) cover authentication bypass, full database read and file upload to RCE. GLPI 11.0.8 unauthenticated SQL injection (fixed 11.0.9) and 20 Roundcube issues (fixed 1.6.20/1.7.5) were also reported.
Active adversary activity. CISA advisory AA26-293A (2026-10-20) describes SafePay ransomware, active since August 2024 with 600+ victims. It gains access through VPN/edge-device CVEs (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766), brute force or exposed credentials, then moves laterally with PsExec/WinRM, exfiltrates with RClone/FileZilla/WinRAR/7-Zip, disables security software and encrypts files with a .SafePay extension. VulnCheck analysis of Flax Typhoon-attributed infrastructure shows two clusters: hands-on XWiki (CVE-2025-24893) exploitation from Taiwan IPs escalating to reverse shells against India, and automated RedTail-family botnet scanning from a Hong Kong IP against Mexico, the UK and Malaysia, exploiting PHPUnit CVE-2017-9841, Apache CVE-2021-41773, PHP-CGI CVE-2024-4577 and ThinkPHP CVE-2022-47945. Defenders should rotate service-account and API credentials, patch the listed CVEs, and hunt for the TTPs and IOCs below.
MITRE ATT&CK techniques used in TL-2026-4172
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Credential Access
T1110 Brute Force; T1552.001 Unsecured Credentials: Credentials In Files
Persistence
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Reconnaissance
T1595.002 Active Scanning: Vulnerability Scanning
Privilege Escalation
defense-impairment
Affected products and versions in ThreatsDay Roundup
- NVIDIA — AIStore
Vulnerable versions: < 5.0
Fixed in: 5.0 - Laravel — Laravel Framework (TokenGuard)
Vulnerable versions: < 13.29.0; < 12.68.0
Fixed in: 13.29.0; 12.68.0 - Anomaly — opencode (opencode-ai)
Vulnerable versions: 1.0.137 - 1.18.32 (Windows/WSL)
Fixed in: 1.18.33 - Signal — RingRTC
Vulnerable versions: Android, iOS, Desktop (versions not stated) - Eptura — Archibus
Vulnerable versions: versions not stated
Fixed in: vendor fixed release - GLPI — GLPI
Vulnerable versions: 11.0.8
Fixed in: 11.0.9 - Roundcube — Roundcube Webmail
Vulnerable versions: < 1.6.20; 1.7.x < 1.7.5
Fixed in: 1.6.20; 1.7.5 - PingCAP — TiDB Cloud / internal systems
- Zeabur — Zeabur platform
- XWiki — XWiki
Vulnerable versions: CVE-2025-24893 affected versions
Remediation for ThreatsDay Roundup
Patches
- NVIDIA AIStore v5.0 (CVE-2026-65162)
- Laravel 13.29.0 / 12.68.0 (CVE-2026-114509)
- opencode 1.18.33
- GLPI 11.0.9
- Roundcube 1.6.20 / 1.7.5
- Eptura Archibus vendor fixes (CVE-2026-107186/107187/107188)
- Vendor patches for CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766, CVE-2025-24893, CVE-2024-4577, CVE-2021-41773, CVE-2022-47945, CVE-2017-9841
Immediate actions
- Rotate service-account credentials, environment variables and AI provider API keys (Anthropic, OpenAI, Google) held in OpenCode Console, Zeabur or PingCAP/TiDB Cloud integrations
- Block the network IOCs at the perimeter and hunt historical logs for them
- Upgrade opencode to 1.18.33 or later and avoid connecting to untrusted remote MCP servers
- Hunt for SafePay tooling (PsExec, RClone, ShareFinder.ps1, SharpShares.exe, NetExec) and .SafePay encrypted files
Workarounds
- Remove or isolate the legacy AIStore ETL InitSpecMsg API until upgraded
- Disable PHPUnit eval-stdin.php and block public access to vendor directories
- Limit Laravel TokenGuard routes to validated string inputs until patched
Longer-term hardening
- Enforce least privilege and short-lived credentials for service accounts, with access logging on cloud storage
- Segment networks and keep encrypted, immutable offline backups
- Deploy EDR with lateral-movement detection and enforce MFA on VPN and remote access
- Restrict Kubernetes admission (disallow privileged and hostPID pods) around storage and ETL components
CVEs associated with ThreatsDay Roundup
Weaknesses (CWE) in ThreatsDay Roundup
Timeline of ThreatsDay Roundup
- SafePay ransomware group becomes active; CISA later counts 600+ victims across North America, South America, Europe and Australia
- Pillar Security privately reports the opencode MCP OAuth RCE via GitHub Security Advisory
- Attackers begin using stolen service account credentials to access PingCAP internal systems
- opencode 1.18.33 released, upgrading the open package to 11.0.4 to fix the PowerShell injection
- Pillar Security publicly discloses the opencode MCP OAuth RCE; no CVE issued
- PingCAP discovers the intrusion and begins disabling compromised credentials
- NVIDIA releases AIStore v5.0 (Security Bulletin 5889) removing the vulnerable InitSpecMsg feature for CVE-2026-65162
- Zeabur detects a second breach; PingCAP completes patching of four vulnerabilities and blocks attacker access paths
- ShadowForge research on NVIDIA AIStore CVE-2026-65162 is publicly disclosed
- PingCAP publicly discloses the incident; the roundup also reports the Roundcube 1.6.20/1.7.5 security releases on this date
- CISA publishes advisory AA26-293A on SafePay ransomware
- The Hacker News publishes the ThreatsDay bulletin covering these incidents
Sources cited for ThreatsDay Roundup
- ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
- PingCAP Security Update October 2026
- CISA AA26-293A: SafePay Ransomware
- VulnCheck: Integrity Technology Group advisory analysis (Flax Typhoon)
- Pillar Security: Open and Shut - RCE in opencode via MCP OAuth
- Zeabur is shutting down
- Laravel Framework advisory GHSA-f9x3-7vq9-cph6 (CVE-2026-114509)
- ShadowForge: NVIDIA AIStore CVE-2026-65162
- Signal RingRTC CVE-2026-113380 notes
- Rapid7: Eptura Archibus authentication bypass, RCE and database read
- Andromeda AI October 2026 security incident
Detection coverage for TL-2026-4172
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4172 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4172
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.