We are watching a fast shift from “steal files” to “steal the keys that let me become you.” The ugly part is how often those keys are sitting in plain sight, cached, logged, or shoved into environment variables like it is 2014.

Today's Top 5

1. 3.2M secrets, then shutdown: Zeabur says attackers accessed its platform database and pulled roughly 3.2 million environment-variable records tied to 321,810 accounts. The postmortem reads like a checklist of what not to do, and then comes the final twist. Source
2. Northflank: assume vars decrypted: Northflank told customers to rotate everything after a breach, and explicitly warned to assume environment variables were decrypted and secrets stolen. If your AI bills spike this weekend, you already know why. Source
3. Chainalysis confirms customer data access: Chainalysis disclosed an intrusion it attributes to “offensive agentic techniques,” and says some customer information was accessed (names, emails, user IDs, role labels). The part worth sweating is what an attacker can do with “just” identity and role context inside high-trust investigations. Source
4. Bunny reissues platform TLS certs: CDN provider bunny.net says it revoked and reissued TLS certificates for its platform domains (b-cdn.net and bunny.run) as a precaution after a provider-side incident, and it is batch-reissuing managed certs for custom domains. This is what dependency risk looks like when it hits crypto material. Source
5. Linux kernel MPTCP remote root: A critical Linux kernel bug (CVE-2026-98432) can allow remote root attacks against MPTCP servers. If your kernel patching program still runs on “quarterly rhythm,” your threat model is already out of date. Source

Why today matters: Attackers are optimizing for downstream access, not press-worthy file theft. Environment variables, API keys, TLS private keys, and “boring” role metadata are becoming the highest-leverage targets because they unlock billing fraud, lateral movement, and impersonation without noisy malware. The teams that should be nervous are the ones who treated secrets management as a developer convenience feature, not a security boundary.

XERJ Corpus Hub: Working the Zeabur postmortem? An AI agent loading trivy-checks can draft a tight audit list for common secret-exposure patterns in container images and build pipelines, then turn that into a “block on merge” policy for your CI in minutes. Grab another corpus at hub.xerj.org.

Now the rest of the damage, and what to do about it.

Data Breaches

1. Zeabur shutting down after second security breach in two months: Zeabur says an attacker used leaked internal credentials to compromise shared clusters and internal systems, read its platform database, and expose roughly 3.2 million environment-variable records tied to 321,810 accounts. It also reports root sign-ins across GCP servers, SSH keys added to servers, and customer disk copies attached to attacker-controlled VMs. Zeabur says it will wind down service starting Dec 1, 2026, with shutdown by Dec 31, 2026. Source: BleepingComputer
2. Northflank breach leads to abuse of customers’ AI API keys: Northflank warned customers to rotate all credentials and secrets after a breach, telling them to assume environment variables were decrypted and stolen. The impact includes reports of unauthorized use of AI API keys stored on the platform, with guidance to check provider billing and usage logs for anomalies. Source: BleepingComputer
3. Chainalysis discloses data breach from “offensive agentic techniques”: Chainalysis disclosed an intrusion into internal systems and tools and says some customer information was accessed, including names, email addresses, user IDs, and organizational role labels. The company says it has not found evidence of unauthorized access to investigation content, authentication credentials, or session tokens (as of its disclosure). Source: BleepingComputer
4. bunny.net revokes and reissues TLS certificates after provider incident: bunny.net says it revoked and reissued TLS certificates for its platform domains as a precaution and is reissuing managed certificates for custom domains in controlled batches, with existing certificates continuing to be served until replaced. The company says investigations have not found new evidence of unauthorized access to its server, but it recommends customers managing their own certs revoke and reissue with new private keys as a precaution. Source: bunny.net Status

Security Research

1. GitLab CVE-2026-97229 attempted exploitation against Alpine Linux: Reporting details how Alpine Linux saw an attempted exploit chain against CVE-2026-97229 on Oct 20 and 21, 2026, roughly a week after disclosure, highlighting how quickly public-facing dev platforms get pressure-tested. If your GitLab is Internet-reachable, assume attackers are already fuzzing your CI path. Source: SecurityWeek
2. TeamViewer “host attacks viewer” class bug gets patched: The Hacker News covers a TeamViewer flaw where the remote machine being controlled can attack the controller during a session, a nasty inversion of trust for IT support workflows. This is the kind of bug that turns a single helpdesk session into a foothold. Source: The Hacker News
3. Linux kernel CVE-2026-98432 remote root risk for MPTCP: BleepingComputer summarizes CVE-2026-98432 as a critical use-after-free in Linux networking code with a 9.8 score, warning about remote root attacks on MPTCP servers and noting vendor fixes rolling out across distributions. If you enable MPTCP in production, your patch window just got shorter. Source: BleepingComputer
4. “Black October” for AI developer platforms, key theft pattern: Wiz research describes a wave of incidents across AI developer platforms where attackers go hunting for stored environment variables and AI service credentials, including patterns tied to LLMjacking and expensive downstream API abuse. The important takeaway is defensive, not hype: secrets storage and audit logs are now a frontline control for AI tooling. Source: Wiz
5. Hacked CCTV camera software used as a network entry point: TechRadar reports on Huntress observations of incidents originating from compromised camera management software, reinforcing a theme CISOs keep relearning: “adjacent” IT systems become identity and lateral movement launchpads. If it has a web console and talks to AD, treat it like a server. Source: TechRadar

Top CVEs

1. CVE-2026-98432: Critical Linux kernel use-after-free in IPv4 TCP networking code, reported as enabling remote root attacks against MPTCP servers under certain conditions. Patch guidance varies by distro, but this is a “find exposed surface area first, then patch fast” situation. Source
2. CVE-2026-97229: Max-severity GitLab vulnerability discussed in the context of attempted exploitation against Alpine Linux’s instance, underscoring how quickly attackers operationalize Git hosting and CI/CD bugs. Prioritize any Internet-exposed self-managed GitLab, then hunt for worker crashes and suspicious CI config activity. Source
3. CVE-2026-92372: One of multiple TeamViewer client vulnerabilities addressed in TeamViewer’s October 2026 security bulletins, relevant because remote access tooling sits at the center of IT privilege and lateral movement. Even without known exploitation, these are patch-now candidates in most enterprises. Source
4. CVE-2026-109618: One of the PHP2Shell issues, relevant because downstream products embed PHP and expose management planes that were never meant to be Internet-facing. Treat any exposed PHP management UI as “actively hunted,” even if you are not seeing confirmed exploitation in your logs yet. Source
5. CVE-2026-109619: The companion PHP2Shell issue often discussed alongside CVE-2026-109618, part of the same patch-and-hunt story for environments where PHP is embedded in appliances or management interfaces. Patch upstream and verify vendor backports actually landed in your specific firmware build. Source

Podcasts & Talks

1. SANS Stormcast (Oct 30, 2026): Linux kernel MPTCP RCE and more: A fast listen that tees up CVE-2026-98432 and the broader theme of AI-assisted bug discovery compressing the patch timeline. Useful for turning today’s kernel panic into a crisp, non-dramatic internal brief. Listen: SANS ISC

Final Words

Today’s underlying pattern is “secrets as the product.” Attackers are treating environment variables, API keys, and cert private keys as the cleanest path to identity, persistence, and billing abuse, and they are doing it through your vendors, your build chain, and your hosting layer. The uncomfortable implication is that your perimeter controls can be perfect and you still lose if secrets sprawl is normal behavior.

This week, do three things:

• Run an emergency rotation play for any AI provider keys that ever lived in hosted platform environment variables, starting with Northflank and Zeabur projects, and compare usage and billing for anomalies.
• Patch and verify Linux kernels for CVE-2026-98432 wherever MPTCP is enabled, and add an explicit inventory check so you are not guessing where MPTCP is turned on.
• Audit managed TLS certificate dependencies after the bunny.net reissuance and confirm you can detect and respond to unexpected certificate rotation events in your monitoring.

Your turn: If an attacker stole your top 20 environment variables today, which three would let them move from “noise” to “material incident” in under an hour? Hit reply with your answer, or drop a comment on the web version. I read every reply.

Know a team shipping apps on a managed platform that still stores production keys in environment variables? Forward them this issue, because Zeabur’s shutdown timeline is what “it will be fine” looks like at the end. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!