ThreatsDay Security Roundup: Software Flaws, Data Breaches, and Phishing Campaigns Emerge

Recent cybersecurity reports highlight multiple security incidents, including software vulnerabilities, data breaches, phishing campaigns, and infrastructure compromises affecting various organizations and platforms. According to published reports and official statements, these events involve a wide range of security challenges spanning different sectors.

Platform and Software Vulnerabilities

Several prominent software projects and platforms have disclosed security updates or vulnerabilities:

• Laravel: Patched a critical security flaw (CVE-2026-114509, CVSS score: 9.2) in its built-in TokenGuard, which could allow unauthenticated users to bypass API authentication under certain database configurations.
• Roundcube: Released versions 1.6.20 and 1.7.5 to address 20 issues, including IMAP command injection, SSRF filter bypass, and unsafe attachment handling.
• GLPI: Disclosed an unauthenticated SQL injection vulnerability in version 11.0.8 (GHSA-753w-2942-4pxm) that could allow remote database access, which has been patched in version 11.0.9.
• Eptura Archibus: Rapid7 reported three vulnerabilities, including an insecure file upload leading to remote code execution (CVE-2026-107188, CVSS: 9.6).
• NVIDIA AIStore: AegisSec Research disclosed details of a flaw in the legacy ETL Kubernetes PodSpec initialization API (CVE-2026-65162, CVSS: 10.0) enabling host-level compromise.

Incidents and Data Breaches

Multiple technology and service providers have reported unauthorized access or infrastructure compromises:

• Zeabur: Announced plans to shut down services between December 1 and December 31, 2026, following a cybersecurity incident where internal credentials were exposed, affecting over 3.2 million environment variable records.
• PingCAP: Disclosed that attackers accessed internal systems using stolen service account credentials, copying source code and customer-related records between September 9 and October 7, 2026.
• Genesys: Disclosed an unauthorized third-party incident affecting internal business systems like CRM and LMS platforms on October 16, 2026, though core cloud platforms were reported unaffected.
• Andromeda: Identified a security incident involving unauthorized access to credentials on October 13, 2026, affecting a limited number of customer accounts.
• Bluesky: Acknowledged a phishing campaign affecting over 4,500 accounts through posts promoting fake government payment offers.

Fraud and Criminal Cases

Law enforcement and justice departments have reported actions against various fraud schemes:

• Singapore Police: Warned of Android malware scams utilizing fake social media ads, resulting in at least 62 cases and S$989,000 in losses since April 2026.
• Dutch Police: Arrested two suspects in connection with an AI-generated audio bank helpdesk fraud scheme resulting in 170 victims and €380,000 in illicit proceeds.
• US Department of Justice: Reported the sentencing of a Nigerian national to eight years in prison for a multi-year hacking, identity theft, and tax fraud scheme, alongside a guilty plea from an American fraudster in the Philippines regarding a military identity theft scheme.

Verify these security advisories and official updates directly through vendor documentation and law enforcement announcements.