ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

This week's roundup from The Hacker News covers over two dozen smaller but noteworthy security stories. PingCAP confirmed attackers used stolen service-account credentials to steal source code and customer data, while AI infrastructure firm Zeabur is shutting down after a second breach this year exposed 3.2 million environment variables and over 320,000 accounts. Genesys and Andromeda also disclosed incidents involving unauthorized access to internal systems and credentials, and Bluesky suspended 4,500+ accounts hit by a phishing wave.

On the vulnerability side, Laravel patched a critical authentication bypass in its TokenGuard (CVE-2026-114509, CVSS 9.2) letting attackers impersonate any user, Roundcube fixed 20 bugs including IMAP command injection, and GLPI 11.0.9 closed an unauthenticated SQL injection flaw that could expose entire databases. NVIDIA AIStore for Linux carries a maximum-severity flaw (CVE-2026-65162, CVSS 10.0) enabling Kubernetes host takeover, Eptura Archibus has three chained bugs leading to remote code execution, and Signal's RingRTC library has a critical flaw (CVE-2026-113380, CVSS 9.3) letting a malicious caller keep audio/video active after a victim hangs up.

Elsewhere, OpenCode fixed a critical RCE triggered via a rogue MCP OAuth server, researchers flagged a prompt-injection weakness in ChatGPT's GitHub Connector, and US agencies issued SI/AI containment guidance alongside a federal ban on DeepSeek technology. Other items include arrests over NFC bank-card fraud in the Netherlands, a $2.5 million tax fraud sentencing, a $6 million 23andMe settlement, a 600+ victim SafePay ransomware advisory, and Chrome's new default warnings before insecure HTTP connections.