IAM & Security Weekly Briefing

Week of: 2026-10-25 to 2026-10-31 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

---

1. Executive Summary (TL;DR)

• Chainalysis disclosed a breach carried out with "offensive agentic techniques," exposing customer identity metadata but reportedly not credentials or session tokens.
• Northflank told customers to rotate every credential and secret stored on its platform after attackers abused customers' AI API keys.
• A researcher found 26,400 still-valid cloud and AI credentials left in 7.25 million public Gitee repositories — a mass non-human identity exposure.
• A trojanized, legitimately signed Claude Code extension shipped through Cursor's marketplace and attempted to plant persistent SSH backdoors on developer machines.
• Two Ivanti Connect Secure flaws were chained for unauthenticated root access and added to CISA KEV, alongside a CVSS 10.0 GitLab RCE.
• Attackers actively exploited a missing-authorization flaw in Drupal Commerce Core, underscoring authorization gaps in business-critical web components.
• A device-code phishing campaign (Skyw4lker) is targeting U.S. organizations by abusing legitimate cloud authentication flows rather than stealing passwords.
• Developer and AI tooling remains the softest identity perimeter: GitHub token abuse, AI-session stealers, and prompt injection against coding agents all featured this week.

---

2. Top IAM & Security News

Chainalysis discloses breach after attackers used "offensive agentic techniques"

• Source: The Hacker News
• Link: The Hacker News
• Date: October 31, 2026
• What happened: Chainalysis said an external actor accessed internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles, while stating investigation content, authentication credentials, and session tokens were not accessed.
• Why it matters: Agentic tooling is now part of the intrusion path, and leaked role/organizational metadata is prime reconnaissance for follow-on phishing and impersonation.

Northflank breach leads to abuse of customers' AI API keys

• Source: BleepingComputer
• Link: BleepingComputer
• Date: October 31, 2026
• What happened: Cloud application hosting platform Northflank warned customers to rotate all credentials and secrets stored on its platform after a breach led to unauthorized use of customers' AI API keys.
• Why it matters: Platform-aggregated secrets are a single point of compromise; third-party-stored keys need rotation plans, scoping, and usage monitoring.

26,400 valid cloud and AI credentials found exposed in public Gitee repositories

• Source: The Hacker News
• Link: The Hacker News
• Date: October 29, 2026
• What happened: An independent researcher scanned 7.25 million public repositories on Chinese code-hosting service Gitee and found 26,400 credentials that still worked, most of them keys for cloud and AI services.
• Why it matters: Secret sprawl in public code is a standing, exploitable inventory of non-human identities — detection alone is insufficient without revocation and short-lived credentials.

CISA adds two Ivanti Connect Secure flaws to KEV after chaining to unauthenticated root access

• Source: The Hacker News
• Link: The Hacker News
• Date: October 31, 2026
• What happened: CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog, including CVE-2026-111357 (CVSS 8.8), a missing authentication for a critical function, following active exploitation in which three flaws were chained for unauthenticated root access.
• Why it matters: VPN concentrators are the front door to the identity perimeter; an auth-bypass chain there defeats MFA and session controls downstream.

Attackers actively exploit Drupal Commerce Core authorization bypass

• Source: The Hacker News
• Link: The Hacker News
• Date: October 30, 2026
• What happened: Drupal warned that a "highly critical" missing authorization flaw in Commerce Core, tracked as CVE-2026-118539 and affecting versions 0.0.0–2.41 and 3.0.0–3.3.13, is being exploited in the wild.
• Why it matters: Broken authorization in commerce components can expose order, customer, and payment data without any credential theft.

Binance reports security incident affecting $6.3 billion in assets

• Source: The Hacker News
• Link: The Hacker News
• Date: October 30, 2026
• What happened: Binance said a "security incident" impacted about $6.3 billion worth of assets, with nearly $3 billion frozen on-chain so far and Tether and Circle freezing stablecoins tied to the incident.
• Why it matters: At this scale, the root cause is almost always privileged access or key custody — a reminder that high-value accounts need hardware-backed, quorum-controlled authorization (see source for details).

CISA adds GitLab RCE (CVSS 10.0) and Cisco firewall DoS flaws to KEV

• Source: The Hacker News
• Link: The Hacker News
• Date: October 30, 2026
• What happened: CISA added CVE-2026-97229, an integer overflow in GitLab Community and Enterprise Edition rated CVSS 10.0, and a Cisco firewall denial-of-service flaw to its KEV catalog citing active exploitation.
• Why it matters: Source control is an identity provider for CI/CD and machine credentials; a rooted GitLab server means tokens, runners, and pipeline secrets are in scope.

Skyw4lker device code phishing campaign targets U.S. organizations

• Source: The Hacker News
• Link: The Hacker News
• Date: October 28, 2026
• What happened: ANY.RUN analyzed Skyw4lker, a device code phishing campaign primarily aimed at U.S. organizations that abuses legitimate cloud services and authentication mechanisms instead of stealing passwords.
• Why it matters: Device code flow bypasses password and often MFA expectations — teams should restrict or monitor device code grants in conditional access policy.

---

3. AI, Identity & Emerging Tech

Trojanized Claude Code extension on Cursor marketplace planted SSH backdoors

• Source: The Hacker News
• Link: The Hacker News
• Date: October 30, 2026
• What happened: A malicious version 2.1.313 of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher identity, attempting to install a persistent SSH backdoor; distribution lasted roughly 11 hours on October 29 and exposed up to 5,000 developers.
• Why it matters: Extension publisher identity and update channels are now identity attack surface — an update signed by a trusted publisher can turn developer endpoints into persistent remote access.

A shared ChatGPT link could run attacker code in a logged-in session

• Source: The Hacker News
• Link: The Hacker News
• Date: October 31, 2026
• What happened: Researchers at Parameter showed a malicious ChatGPT share link could execute an attacker's code in the logged-in session of anyone who opened it and read their private conversations; OpenAI fixed the issue eight days after the October 18 report and rated it P1.
• Why it matters: Shared-link content rendered inside an authenticated SaaS session is a session-integrity risk; treat AI chat shares like any untrusted, logged-in payload.

In-the-wild attack abuses AI agents' trust in Markdown

• Source: Dark Reading
• Link: Dark Reading
• Date: October 26, 2026
• What happened: A prompt injection technique observed in the wild exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
• Why it matters: AI agents that read repository files are non-human identities with tool access — their instruction inputs must be treated as untrusted code paths.

Attacker impersonates AI bots to scan relentlessly for credentials

• Source: Dark Reading
• Link: Dark Reading
• Date: October 28, 2026
• What happened: A threat actor posed as agents from OpenAI, Anthropic, Meta, and others to scan for exposed data and credentials.
• Why it matters: Bot user-agent strings are not authentication; exposure hunting should be met with rate limiting, authenticated-only surfaces, and rapid secret rotation.

'Aokigahara' stealer targets developer keyrings and AI assistants

• Source: Dark Reading
• Link: Dark Reading
• Date: October 27, 2026
• What happened: A new infostealer focuses on developer keyrings and AI assistant sessions, exposing AI sessions, business data, and developer infrastructure from a single compromised endpoint.
• Why it matters: Endpoint compromise now yields AI session tokens and developer credentials; short token lifetimes and per-device credential isolation are essential.

Anthropic says unreleased model chained flaws into working exploits across browsers and OSes

• Source: The Hacker News
• Link: The Hacker News
• Date: October 28, 2026
• What happened: Anthropic said in a report that an unreleased AI model found flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits in the lab; all flaws were reported to vendors and patched.
• Why it matters: AI-accelerated vulnerability discovery compresses patch windows, raising the premium on hardening exposed authentication and management interfaces.

---

4. Cyber Threats & Attack Trends

'Gheist' weaponizes GitHub tokens to steal cloud secrets

• Source: Dark Reading
• Link: Dark Reading
• Date: October 26, 2026
• What happened: An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories using stolen GitHub tokens.
• Why it matters: SCM tokens are cloud identity keys in practice — scope them narrowly, bind them to repositories, and monitor for anomalous clone/read activity.

PHP2Shell attacks root Palo Alto firewalls; 22.6 million instances potentially exposed

• Source: SecurityWeek
• Link: SecurityWeek
• Date: October 30, 2026
• What happened: Critical PHP flaws tracked as PHP2Shell have been exploited for over a week, rooting Palo Alto Networks firewalls while failing against WordPress, with more than 22.6 million exposed instances potentially affected.
• Why it matters: Internet-exposed management planes remain the fastest path past authentication controls; patch and restrict access to administrative interfaces immediately.

Oracle E-Business Suite RCE flaw probed days after patch

• Source: The Hacker News
• Link: The Hacker News
• Date: October 28, 2026
• What happened: Threat actors began probing for CVE-2026-101767 (CVSS 9.8), an improper authentication flaw in the Oracle Application Object Library of Oracle E-Business Suite, days after Oracle patched it.
• Why it matters: Broken authentication in ERP platforms gives direct access to financial and HR data — the highest-value business identity store in most enterprises.

Cisco SD-WAN malware KeyDrift built to steal encryption keys

• Source: The Hacker News
• Link: The Hacker News
• Date: October 29, 2026
• What happened: Cisco Talos reported that attackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware named KeyDrift designed to copy the keys encrypting traffic between sites; Talos described the attacks as historical without specifying timing.
• Why it matters: Stolen network encryption keys enable long-term interception and impersonation well after the initial vulnerability is remediated.

Email bombing plus external Teams chats drives 15-minute malware delivery

• Source: Dark Reading
• Link: Dark Reading
• Date: October 27, 2026
• What happened: A wide-scale, ongoing social engineering campaign pairing mail bombing with external Microsoft Teams chats — possibly tied to Black Basta — is delivering malware in about 15 minutes.
• Why it matters: External collaboration identity is a low-friction entry point; tenant-wide external chat policies and help-desk verification are required controls.

Anthropic-themed phishing emails bypass leading secure email gateways

• Source: Dark Reading
• Link: Dark Reading
• Date: October 29, 2026
• What happened: Obvious phishing emails carrying numerous red flags are reportedly getting past some industry-leading secure email gateway products, using Anthropic branding as the lure.
• Why it matters: When email filtering fails, authenticated identity and phishing-resistant credentials are the remaining control — do not treat SEG coverage as credential protection.

---

5. Product Updates & Vendor News

GitHub launches npm firewall to block malicious packages before installation

• Source: The Hacker News
• Link: The Hacker News
• Date: October 29, 2026
• What happened: GitHub introduced a package firewall in public preview that inspects metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate for npm packages.
• Why it matters: Install-time gating constrains the supply chain paths that end in stolen developer credentials and CI tokens.

Google to allow one-tap installs from approved third-party Android stores outside the U.S.

• Source: The Hacker News
• Link: The Hacker News
• Date: October 28, 2026
• What happened: Third-party Android app stores can apply for permission to install apps with one tap and update them in the background, provided they pass identity checks and submit their full catalog plus every update for ongoing malware scanning; approved stores get the features from December 1 outside the U.S.
• Why it matters: Store identity verification becomes part of the mobile trust chain — MDM and app-allowlist policies may need to reflect the new distribution reality.

Reddit to lock content behind logins to fight scrapers

• Source: BleepingComputer
• Link: BleepingComputer
• Date: October 31, 2026
• What happened: Reddit announced it will gradually become a "logged-in service," offering limited access to visitors without accounts.
• Why it matters: Login walls turn unauthenticated scraping into authenticated data access — a growing pattern that shifts data-governance risk onto identity systems.

Tailscale patches SSH flaws that could allow pivoting to root on other servers

• Source: The Hacker News
• Link: The Hacker News
• Date: October 28, 2026
• What happened: Tailscale released version 1.104.4 to fix flaws in its built-in SSH server's connection forwarding, which runs with root privileges and could let an attacker reach services and files reserved for root on other servers.
• Why it matters: Overlay networks that broker SSH are privileged infrastructure; a compromised device can become a privilege-escalation bridge across the fleet.

TeamViewer fixes flaw allowing a controlled host to attack the connecting viewer

• Source: The Hacker News
• Link: The Hacker News
• Date: October 30, 2026
• What happened: TeamViewer fixed a flaw in which a malicious or compromised host machine could crash the viewer's TeamViewer and, depending on platform, potentially run code.
• Why it matters: Third-party and remote-support sessions are bidirectional trust relationships; treat remote hosts as untrusted peers in access design.

---

6. Practical Security Takeaways

• Run an emergency rotation of any secrets stored in third-party SaaS/platforms after vendor breach disclosures; assume exposed AI service keys were used.
• Continuously scan public repositories for live cloud and AI keys, then revoke and reissue rather than merely alerting; migrate to short-lived, workload-scoped credentials.
• Block or tightly govern OAuth device code flow in conditional access, and alert on device code sign-ins from new or unusual locations.
• Prioritize patching internet-facing edge and management planes — Ivanti Connect Secure, Palo Alto management interfaces, Cisco ASA/FTD, and SD-WAN controllers.
• Inventory non-human identities (service accounts, CI/CD tokens, AI API keys, agent credentials), scope each to least privilege, and monitor usage anomalies.
• Treat IDE and extension marketplaces as code-execution supply chain: pin extension versions, verify publisher and signature integrity, and hunt for unexpected authorized_keys changes and SSH agent abuse.
• Patch authorization-bypass classes (Drupal Commerce Core, Oracle EBS) with the same urgency as pre-auth RCE, and monitor for post-patch probing.
• After any breach exposing names, roles, and organizational data, brief the SOC and help desk on targeted phishing and impersonation risk.
• Constrain what AI coding agents can read and execute — treat local instruction files and Markdown as untrusted input, and run agents with sandboxed, least-privilege tooling.
• Review external collaboration settings (Teams federation, guest chat) and raise help-desk verification for urgent "account" requests.

---

7. Trends to Watch

• Attackers are shifting from credential theft to abuse of legitimate authentication flows — device code phishing, session-bound links, and trusted publisher identities.
• Agentic AI is appearing on both sides of the fight: in intrusion paths and in vulnerability discovery that shortens patch windows.
• Developer and AI toolchains (repos, tokens, extensions, agent sessions) are consolidating into the most valuable identity target class.
• Mass secret exposure in public code keeps producing a durable inventory of valid, exploitable non-human credentials rather than a one-off leak.
• Login-gated access to previously public content will push more data access through authenticated — and therefore identity-attackable — channels.

---

Sources

• Northflank security breach leads to abuse of customers' AI API keys — https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
• Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data — https://thehackernews.com/2026/10/chainalysis-confirms-intrusion-into.html
• 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories — https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html
• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access — https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
• Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw — https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html
• Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — https://thehackernews.com/2026/10/binance-suffers-security-breach.html
• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV — https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
• American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed — https://thehackernews.com/2026/10/american-organizations-under-attack.html
• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor — https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
• A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats — https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html
• In-the-Wild Attack Abuses AI Agents' Trust in Markdown — https://www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdown
• Attacker Relentlessly Scans for Credentials by Impersonating AI Bots — https://www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials
• 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants — https://www.darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants
• Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits — https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html
• 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets — https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress — https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/
• Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch — https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html
• Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys — https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html
• External Teams Chats Anchor 15-Minute Malware Delivery — https://www.darkreading.com/cloud-security/email-bombing-external-teams-chats-repeatable-access-path
• Anthropic-Themed Phishing Emails Bypass Top Security Tools — https://www.darkreading.com/cyberattacks-data-breaches/anthropic-phishing-emails-bypass-security-tools
• GitHub Launches npm Firewall to Block Malicious Packages Before Installation — https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html
• Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S. — https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html
• Reddit to lock content behind logins to fight scrapers — https://www.bleepingcomputer.com/news/security/reddit-to-lock-content-behind-logins-to-fight-scrapers/
• Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers — https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html
• TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them — https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html