PINGCAP has disclosed that attackers used stolen service account credentials to access internal systems between 9 September and 7 October 2026, enabling them to copy data and obtain source code. The breach also exposed customer-related records, including user names, email addresses, organisation and project associations, SQL editor content and errors, customer contacts, contract terms, orders, pricing, payment terms and billing configuration.
PingCAP began disabling the compromised credentials on 7 October 2026 and says there is no indication of access to customer models, datasets, or training data. The incident underscores the risks posed by credential theft and the value of prompt credential revocation, with the company stating it is investigating and will continue to engage affected customers. The report attributes the compromise to an authorised party using stolen credentials to access internal systems and copy data.
Other notable items referenced in ThreatsDay include a critical Laravel TokenGuard authentication bypass (CVE-2026-114509, patched in versions 13.29.0 and 12.68.0), and a Signal vulnerability (CVE-2026-113380, CVSS 9.3) that allows a malicious caller to keep audio/video tracks enabled after hang-up via RingRTC. The summary also notes broader concerns such as unauthenticated database exposure in GLPI (GHSA-753w-2942-4pxm) and a pre-auth root vulnerability in OpenCode’s MCP OAuth flow reported by Pillar Security.
While these details illustrate a busy threat landscape, the article distinguishes confirmed exploits from reported risk, and highlights urgent responses such as credential revocation, patching to fixed versions, and monitoring for signs of data exfiltration.