ThreatsDay: Bluesky phishing, Laravel bypass, NVIDIA AIStore flaw
Original title: ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
Bluesky suspended over 4,500 phished accounts; Laravel 12.68.0 and 13.29.0 fix CVE-2026-114509, and Roundcube shipped 20 fixes.
ThreatsDay collects lower-profile incidents. Bluesky suspended more than 4,500 accounts after phishing posts offered a fake government payment. Genesys says an intruder reached its LMS and CRM on October 16, not Genesys Cloud or Engage, and Andromeda reports limited credential exposure from about October 9. The bulletin also covers a CVSS 10.0 NVIDIA AIStore flaw, a Laravel TokenGuard bypass, 20 Roundcube fixes, and SQL injection in GLPI 11.0.8.
Unconfirmed: The excerpt cuts off during the GLPI item, and exploitation is not confirmed for the CVEs; Roundcube is the exception, with no evidence of exploitation stated.
- Singapore police report 62 Android APK scam cases and S$989,000 lost since April 2026.
- Dutch police arrested two men after NFC bank-card fraud hit 170 victims for €380,000.
- Laravel patched CVE-2026-114509, CVSS 9.2, in 13.29.0 and 12.68.0.
- Roundcube 1.6.20 and 1.7.5 fix 20 issues, with no evidence of exploitation.
- NVIDIA AIStore flaw CVE-2026-65162, called ShadowForge, is scored CVSS 10.0.
Impact: Auth bypass, host takeover, database reads, and exposed credentials
| Product | Affected | Fixed in |
|---|---|---|
| NVIDIA AIStore for Linux | legacy ETL Kubernetes PodSpec initialization API | — |
| Laravel | — | 13.29.0 and 12.68.0 |
| Roundcube | — | 1.6.20 and 1.7.5 |
| GLPI | 11.0.8 | — |
- 1.Upgrade Laravel to 13.29.0 or 12.68.0.
- 2.Upgrade Roundcube to 1.6.20 or 1.7.5.
- 3.Suspended Bluesky users should email moderation@blueskyweb.xyz.
- Products
- NVIDIA AIStoreGLPI
- Organizations
- BlueskySingapore Police ForceAegisSec Research
- Countries
- SingaporeNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114509 | Unauthenticated auth bypass in Laravel TokenGuard before 12.68.0/13.29.0 | 9.2 | <1% | PoC ×5 | |
| CVE-2026-65162 | Critical RCE in NVIDIA AIStore legacy ETL PodSpec API | 10.0 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | riskified-okta.com | shing campaign is using Okta and ServiceNow-themed domains (riskified-okta[.]com and shipmonk-servicenow[.]com) hosting spoofed SSO portal |
| domain | shipmonk-servicenow.com | kta and ServiceNow-themed domains (riskified-okta[.]com and shipmonk-servicenow[.]com) hosting spoofed SSO portals and MFA downgrade lures targ |
| ipv4 | 119.13.79.145 | -CGI (CVE-2024-4577), and ThinkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.] |
| ipv4 | 210.242.76.32 | 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan). "The attacks originated from both Hong Kong and |
| ipv4 | 211.20.144.116 | nkPHP (CVE-2022-47945) -- from 119.13.79[.]145 (Hong Kong), 211.20.144[.]116 (Taiwan), and 210.242.76[.]32 (Taiwan). "The attacks orig |
From the original article
13 min read at thehackernews.com
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node. js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.