💥 BREACHES & INCIDENTS
Bitget: Attacker Exploited Third-Party Security Product Zero-Day to Steal $388M
Bitget says an attacker exploited a zero-day in a third-party security product to steal about $388 million from its hot and warm wallets.- Bitget crypto exchange customers affected; ~$388M stolen from hot and warm wallets on September 24, 2026; cold wallets and customer balances unaffected
- Attacker exploited a zero-day flaw in an unnamed third-party security product to obtain high-level internal credentials and access an internal management system
- Fraudulent withdrawal commands were inserted into wallet backend services, spoofing transaction data to trigger approvals; two small test transfers evaded risk controls before larger transfers 30 minutes later
- Activity was disguised as routine administrative operations using legitimate credentials; no private keys were compromised
- Bitget suspects North Korean hackers (TRM Labs flagged TraderTraitor overlaps); stolen-fund addresses published include 0x770b10b273fc44fe9197d6bf20f145c2e98463ee (Ethereum/EVM) and TBWNguTTgezw9dVorX441C6nDrZpRxYwKD (TRON); Mandiant and SlowMist assisting investigation
Misconfigured Supabase apps expose data in over 16,000 databases
UpGuard researchers found more than 16,000 misconfigured Supabase databases exposing sensitive data including PII, passwords, and authentication tokens.- Supabase, an open-source PostgreSQL-based backend platform popular with AI-assisted developers, is affected — AI-assisted development accounts for over 60% of newly created databases
- Over 16,000 databases expose readable tables; more than half leak PII, with a smaller subset exposing passwords, authentication tokens, and possibly credit card data
- Notable exposures include a US valet service (100,000+ customer records), a Canadian immigration service (~5,000 records with 884 plaintext passwords), and an African consulate (25,000 people's records)
- The cause is poor configuration: missing or ineffective row-level security policies and misuse of public keys, often on sites built by AI coding agents whose owners don't understand the database setup
Authlib ≤1.7.2 JWS bug lets unsigned tokens pass as verified (CVE-2026-96760)
CERT/CC reports that Authlib's JWS deserialization treats JWS objects with an empty "signatures" array as fully verified.- Applies to apps and services using the Python Authlib library for OAuth, OIDC, JWT/JWS/JWE token validation — all versions through 1.7.2.
- JsonWebSignature.deserialize_json() assumes signatures are valid and skips all checks when the "signatures" list is empty, so unsigned payloads are treated as trusted.
- Both load paths are affected: jws.deserialize_json({"payload":"...","signatures":[]}) and jws.deserialize('{"payload":"...","signatures":[]}') with key=None.
- Attackers need no key material to forge payloads, enabling authentication bypass (e.g., sub=admin), forged role/scope claims, and signed-message injection between microservices.
- No vendor response or official patch yet; tracked as CVE-2026-96760.
📋 ADVISORIES
- 📄 Source for AI Agents Operate as Overprivileged Non-Human Identities Outside Traditional IAM Controls — orchid.security
🔓 CVEs & KEV
CVE-2026-101110 — ordasoft.com Book Library (Free) extension for Joomla — CVSS 9.3 — Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Libra...
CVE-2026-100752 — ordasoft.com Real Estate Manager (Free) extension for Joomla — CVSS 9.3 — Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estat...
CVE-2026-101108 — ordasoft.com Vehicle Manager (Free) extension for Joomla — CVSS 9.3 — Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Ma...
CVE-2026-97023 — Red Hat Enterprise Linux 10 — CVSS 7.1 — Flatpak: flatpak: arbitrary file deletion in root context via path traversal ...