Leak news archive

An attacker who can reach the SSH port can log in without the password by sending a password of 257 to 1024 bytes. This affects sshd built without PAM on Linux with musl libc, which includes Alpine's openssh-server package. A server is exposed only if PasswordAuthentication is yes (the default), one account has * as its password field (key-only users, the alpine user on cloud images) and another account has a $5$ or $6$ password hash. Root itself is reachable only with PermitRootLogin yes, but an exposed account that can use doas can become root. Alpine's openssh-server-pam with UsePAM yes is not affected. Attack code is public; CISA doesn't list it as exploited so far. OpenSSH 10.6p2 has the fix, and Alpine has fixed packages back to 3.16. Linux with glibc (Debian, Ubuntu, RHEL), macOS and FreeBSD are not affected. A server taken over this way gives away the keys and passwords stored on it.

Read the notice

Binance says an attacker used a DevOps engineer's compromised laptop to get into a service container and submit unauthorised withdrawals; it puts the impact at about $6.3 billion. It first reported a security issue at 21:29 GMT on 29 October, paused withdrawals (and for a time deposits), and has frozen about $3 billion of the stolen funds. On 30 October it said it had found further points of breach besides the laptop. Binance says it has found no evidence that wallet private keys leaked, that user funds are safe and that it will cover every loss from its SAFU fund and company funds. It has not said whether customer API keys, logins or personal data were reached, so replace your Binance API keys and expect scams that use the hack as bait.

Read the notice

Sony Network Communications says an attacker got into the So-net member database on 19 October 2026. It found the intrusion on 23 October, stopped the servers and cut the attacker off. Taken: name, phone number, email address, user ID, date of birth, gender and internet connection ID of 2,141,986 So-net and 443,495 plala (S course) members, including people who left from March 2026; the addresses and mailbox passwords of 54,401 accounts on Mail Service (G), A-Box, So-net VAIO Mail and PostPet mail, which Sony reset on 27 October; 16 bank account records; and 7 password-reset notices. Member login passwords and card details were not taken, and NURO and other services are not affected. Set a new mail password in My Page if you used one of those mail services, and expect convincing scam messages that use your real details.

Read the notice

An attacker reached the system where Railway stores environment variables and decrypted some of them: API keys, database passwords and private registry credentials. Railway believes the attackers were after AI provider keys. Rotate every secret you keep in Railway variables, paste the new value into Railway and redeploy, then revoke the old one at its vendor.

Keys most likely to be affected: OpenAI, Anthropic, OpenRouter, xAI (Grok), Stripe (secret key), GitHub

Read the notice

Node.js 26.12.1, 24.22.1 and 22.23.4 (21 October 2026) fix ten flaws. The worst, CVE-2026-111497, lets malformed Brotli data passed to node:zlib corrupt memory, which can mean remote code execution in a server that decompresses what others send it. Three more let a TLS certificate be accepted for the wrong IP address, so a client could send its API key or password to an impostor. The release also stops trusting the compromised eMudhra intermediates. No attacks have been reported. Node.js 20 and older get no fix.

Read the notice

LiteLLM 1.107.0 on PyPI (21 October 2026, 11:39–13:23 UTC) and the Docker Hub and GHCR images tagged v1.107.0, latest, main-latest and main-stable (until 14:20 UTC) were built by an attacker and steal credentials: AI provider keys, including those stored in a LiteLLM proxy's database, cloud and Kubernetes credentials, SSH and Git keys, and Claude, Codex, Gemini and Cursor sign-ins. The code runs every time Python starts, even if LiteLLM is never imported. If a machine or container installed it, assume everything it could reach was stolen: clean it first, then rotate. The attackers got in with GitHub tokens found in logs that had recorded Claude Code output.

Keys most likely to be affected: OpenAI, Anthropic, Google (Gemini), OpenRouter, Amazon Bedrock API key, GitHub

Read the notice

GitLab fixed CVE-2026-110264 (CVSS 10.0) on 21 October 2026: anyone, without signing in, could run code on a self-managed GitLab server with a crafted regular expression. Every version since 7.0 is affected; GitLab.com and GitLab Dedicated are already fixed. It is one of several regular-expression flaws GitLab fixed this month, and one fixed on 12 October already has a public exploit. GitLab has not reported attacks, but a server taken over this way gives away its CI/CD variables, tokens and repositories. Update now; if the server was reachable from the internet, rotate its secrets too.

Keys most likely to be affected: GitLab

Read the notice

ThreeTrader emailed customers about possible unauthorised access to its systems, in the same days as the Onamae.com Desktop Cloud VPS attack and unauthorised trades at other FX brokers. It has published no details. Change your client portal password and the password of every MetaTrader account, and turn on two-factor authentication. The notice linked here is Myforex's summary; ThreeTrader's own email is the primary source.

Read the notice

Gaitame Finest found third parties logging in to some customers' accounts and trading, using IDs and passwords that may have leaked from other companies' services; it says nothing leaked from its own systems. It has restricted the affected accounts and will contact those customers. Change your My Page and MT4/MT5 passwords, set up one-time passwords and check your history.

Read the notice

FXTF (Goldenway Japan) found that some customers who trade from a VPS had their trading account ID and password taken in an attack on another company's VPS service, and that they may have been used to log in and trade. FXTF says its own systems were not breached. It asks VPS users to change their trading password now and recommends everyone else does too, and makes one-time passwords mandatory for MT4/MT5 from 23 October.

Read the notice

On 21 October 2026 Logius took DigiD.nl, MijnOverheid.nl and other government sites offline as a precaution against the critical PHP flaws (PHP2Shell), and brought them back once they were fixed. The DigiD app and DigiD logins elsewhere kept working. No DigiD account or data is reported to have been taken, and the NCSC saw no abuse. Scammers use outages like this: be wary of messages offering another way to log in or asking you to reactivate DigiD.

Read the notice

State Bank of India told the stock exchanges on 21 October 2026 that 3,897 customer records with personal details (name, gender, date of birth, mobile number, email, address, branch and CIF identifiers) were among about 375,000 records offered on the dark web. Passwords were not reported. SBI does not yet know where the data came from and has not said it has told the customers affected. Expect convincing phishing calls, texts and emails that quote these details.

Read the notice

Someone broke into servers of Onamae.com Desktop Cloud (お名前.com デスクトップクラウド), GMO's VPS for automated FX trading; up to 26,739 servers may be affected. Trading-account logins saved in MT4/MT5 and other tools on the servers were taken and used to trade from customers' accounts, and losses of millions of yen have been reported. GMO stopped every server from 04:00 JST on 21 October and has not said when they will restart or when the intrusion began. From a different device, change the password of every trading account and every other login used on the server, then end all sessions.

Read the notice

An intruder reached a legacy OpenCode Console system and may have read the OpenAI, Anthropic and Google keys that about 1.4% of Console users had linked in their workspaces; some saw large unauthorised charges within hours. OpenCode on your Mac (CLI and desktop app) keeps keys locally and was not affected. Revoke every provider key you linked in OpenCode Console at the provider, create a new one, and update the apps that used it.

Keys most likely to be affected: OpenAI, Anthropic, Google (Gemini)

Read the notice

Eight eMudhra intermediate certificate authorities (EM DV, OV and EV TLS CA - G3B and G3C, and EM OV CS CA - G3B and G3C) were made in April 2025 with private keys anyone could work out. Until they were blocked, anyone could have issued a trusted website or code-signing certificate in any name. Browsers, Apple and Microsoft blocked them from 17 to 20 October 2026 and eMudhra revoked them. Replace every certificate they issued, and update anything that keeps its own list of trusted authorities.

Read the notice

Third-party API keys and tokens saved in STUDIO's API integrations (Data Connect, API Connect), custom proxy keys, Google Sheets integration credentials and page passwords may have been read, along with the key that decrypts them. Rotate every key you saved in STUDIO, paste the new one into STUDIO, then revoke the old key at its vendor.

Keys most likely to be affected: OpenAI, Google (Gemini), Anthropic, Stripe (secret key)

Read the notice

SBI SECURITIES warned that criminals are phishing Google and Apple account logins, then using the passkeys and password notes synced to those accounts to sign in to brokerage accounts and trade. The cases were reported at other securities firms; SBI SECURITIES says none of its own accounts have been hit. If your passkeys live in a Google or Apple account, protect that account as carefully as the brokerage login itself.

Read the notice