Nine stories stood out this week, from actively exploited flaws to security incidents involving the tools and providers businesses rely on every day. A quick caveat before the numbers: exposure estimates and reported record counts are not the same as confirmed cases of misuse.
2,585,481 records reported exposed at Sony Network Communications. 54,401 additional email addresses were linked to account passwords. Up to 5,000 developers may have encountered a malicious editor extension. Drupal Commerce Core is used by 42,000+ websites. A newly exploited GitLab flaw carries CVSS 10.0.
Cybersecurity news this week: nine stories to check
Northflank customers urged to rotate stored secrets
Cloud hosting platform Northflank told customers to assume that secrets stored in environment variables may have been exposed and to rotate them. Customers also reported unauthorized use of AI API keys stored on the platform. Northflank had not disclosed how many customers were affected or how the attackers got in. Read the incident report.
If your team uses a hosting platform, check what its stored credentials can access. Rotate exposed keys, then review the logs for the cloud accounts, databases, and AI services connected to them. A key stored for convenience can quietly open a much bigger door.
Attackers exploit a critical Drupal Commerce Core flaw
Drupal warned that attackers were exploiting CVE-2026-118539, an unauthenticated access-bypass vulnerability in Commerce Core. The module is used by more than 42,000 websites. Drupal advised site operators to upgrade and check orders for inconsistencies, according to the incident report.
For a small online shop, unauthorized access to checkout or order workflows can mean fraudulent activity and a messy customer-service week. If you run Drupal Commerce, check your version, apply the vendor’s fix, and review recent orders for changes you can’t explain.
A malicious editor extension tried to leave SSH backdoors
A malicious version of Anthropic’s Claude Code extension appeared in Cursor’s marketplace for about 11 hours on October 29. It attempted to install persistent SSH access and collect system details. Cursor removed the extension and temporarily took its marketplace offline. The company said up to 5,000 developers may have encountered it, though exposure does not prove a machine was compromised. BleepingComputer has the details.
Developer tools don’t just touch code. They often sit beside the keys that ship it.
If someone on your team installed the affected extension, follow Cursor’s guidance and check the device for unusual SSH keys, processes, and outbound connections. Then review whether that workstation had access to source code, cloud credentials, or production systems.
Another GitLab flaw is under active exploitation
GitLab is back on the patch list, but this is a different vulnerability from the one in last week’s roundup. The earlier story covered CVE-2026-110264. This week, CISA added a separate flaw, CVE-2026-97229, to its Known Exploited Vulnerabilities catalog after confirming exploitation. It carries CVSS 10.0 and can allow unauthenticated code execution on affected self-managed instances under certain conditions. Read the report on this week’s flaw.
Nearly 2,800 internet-exposed GitLab CE instances were being tracked by Shadowserver. That is a point-in-time exposure count, not a confirmed victim tally. If your business or MSP runs GitLab, patch it promptly and check for signs of prior access. A code-hosting server can hold proprietary work and the credentials used to deploy it, so “we patched the other GitLab flaw” isn’t enough.
Cisco patches an exploited remote-access firewall flaw
Cisco confirmed active exploitation of CVE-2026-76418 in specific ASA and FTD Secure Firewall remote-access SSL VPN configurations. An unauthenticated attacker can send a crafted request that causes an affected device to reload, interrupting service. Cisco rated the issue CVSS 8.6 and said no workaround fully addresses it. Check the Cisco advisory for affected configurations and fixes.
If your business uses an affected configuration, apply a fixed release. Remote access is one of those services you notice most when it stops working, so make this a priority rather than a “next maintenance window” task.
Sony subsidiary reports millions of exposed records
Sony Network Communications said an unauthorized party accessed its So-net member database. The company reported that 2,585,481 records were exposed, along with an additional 54,401 email addresses linked to account passwords. It advised affected users to change their passwords. At the time of reporting, misuse had not been confirmed. See the incident report.
After a breach like this, watch for convincing password-reset messages and account alerts. If a password was reused elsewhere, change it there too. For businesses, it’s also a reminder to ask what customer information your service providers hold, and how they’ll tell you if it’s exposed.
Japan Airlines passenger data exposed through a supplier
Japan Airlines said unauthorized access to Amadeus’s passenger service system exposed reservation information. About 90,000 customers had names and travel details exposed; another 2,000 had additional data, including email addresses, phone numbers, and passport numbers. The airline said credit-card numbers and passwords were not affected and reported no evidence of misuse at the time. The report has more on the supplier incident.
Your own network can be fine while a supplier holding your customer data has a bad day. Keep a clear list of vendors that process sensitive information, what they can access, and who at your company handles their incident notifications. For a practical starting point, see our guide to third-party risk and the data your suppliers hold.
Polymarket halts trading after a third-party script incident
Polymarket temporarily halted trading after reporting a security incident involving a third-party provider. Researchers found malicious JavaScript designed to exploit logged-in sessions and move users’ assets. About $2.57 million in tokens was traced to a suspected attacker wallet, though that figure has not been confirmed as the total loss. Polymarket said it would reimburse affected users. Read the incident coverage.
The lesson applies well beyond crypto: third-party scripts can run inside the experience your customers trust. Inventory the scripts on your website, understand what they can access, and know how to disable one quickly if a provider reports a compromise.
Chainalysis reports access to customer account information
Blockchain analytics firm Chainalysis said an external actor accessed internal systems and tools. The information involved included some platform users’ names, email addresses, user IDs, and organizational roles. The company said it had found no evidence that passwords, session tokens, or investigation content were accessed, but had not yet established which records were affected for each customer. See the disclosure report.
Account details can still be useful to scammers. If your company uses the platform, brief the people who may be contacted and be skeptical of unexpected support requests, login links, and password-reset messages.
Make the next incident less surprising
This week’s stories point to a practical place to start: know which vendors, extensions, and remote-access systems hold the keys to your business. Make sure someone owns urgent patching and credential rotation, and that you can reach the right people when a provider reports an incident.
If you’re unsure which systems or vendor relationships deserve attention first, start with the ones that handle customer data or connect directly to production.
Book a 15-minute security check
We’ll help you identify the first systems and credentials to review, with no obligation.