Chainalysis has suffered a major cybersecurity breach exposing user information, password hashes, and live tokens. The incident, involving advanced agentic cyberattack techniques, forced the blockchain intelligence company to take critical services offline. Discover what happened, the potential risks for customers, the role of AI-powered cyberattacks, and the lessons this incident reveals about cybersecurity in the cryptocurrency industry.

🔍 Contexte général Northflank, une plateforme cloud permettant aux développeurs de déployer et gérer des applications, conteneurs, bases de données et applications IA, a divulgué le 30 octobre 2026 un incident de sécurité après avoir reçu une alerte de la société de sécurité cloud Wiz à 11h43 UTC.

🔍 Contexte général Northflank, une plateforme cloud permettant aux développeurs de déployer et gérer des applications, conteneurs, bases de données et applications IA, a divulgué le 30 octobre 2026 un incident de sécurité après avoir reçu une alerte de la société de sécurité cloud Wiz à 11h43 UTC.

Independent security researcher Ben Zimmermann recently completed a massive audit of Gitee, China's largest Git repository hosting platform. Specifically, the investigation examined public code repositories for lingering authentication secrets. The exhaustive scan scrutinized 7.25 million repositories and uncovered 26,000 valid, live private credentials. Furthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI. Staggering Volume of Cloud and AI Authentication Keys…

Independent security researcher Ben Zimmermann recently completed a massive audit of Gitee, China's largest Git repository hosting platform. Specifically, the investigation examined public code repositories for lingering authentication secrets. The exhaustive scan scrutinized 7.25 million repositories and uncovered 26,000 valid, live private credentials. Furthermore, these leaked secrets expose critical accounts across Alibaba Cloud, DeepSeek, OpenAI, and Zhipu AI. Staggering Volume of Cloud and AI Authentication Keys…

TL;DR BerriAI has fixed a critical LiteLLM vulnerability that scores the maximum 10.0 on CVSS v3.1. Tracked as GHSA-w4c7-34wj-hqm8, the flaw lets an unauthenticated attacker steal the proxy's master key. It affects LiteLLM proxies running with an Enterprise license. One unauthenticated request can make the proxy read a local file and send it to an attacker. That file can expose the master key and provider API keys.

TL;DR BerriAI has fixed a critical LiteLLM vulnerability that scores the maximum 10.0 on CVSS v3.1. Tracked as GHSA-w4c7-34wj-hqm8, the flaw lets an unauthenticated attacker steal the proxy's master key. It affects LiteLLM proxies running with an Enterprise license. One unauthenticated request can make the proxy read a local file and send it to an attacker. That file can expose the master key and provider API keys.

Keys to the Cloud, Possibly in Stranger Hands Access keys to cloud services may have fallen into the wrong hands. The cause is a compromise of a platform where developers trusted their secrets to rest. After spotting suspicious activity in its own infrastructure, the company warned all users to replace passwords, API keys, and other credentials at once. What Railway Found…

A hacker read 321,810 accounts and more than 3.2 million stored settings at Zeabur, an app hosting company, it said on the 19th of October 2026. Zeabur will stop all servers by the 31st of December.

Railway, the cloud platform used by developers to deploy and run applications, APIs, and databases, has issued an urgent warning to its roughly 4.8 million users: rotate every secret stored on the platform right now. The company detected suspicious activity involving the systems that hold customer environment variables and says an unauthorized party may have accessed the encrypted files, and in some cases, obtained their decrypted contents. The company published a security disclosure on Wednesday, October 21, describing the intrusion as affecting systems that store customer environment variables. Those files are where developers keep the sensitive strings that power their deployments: API keys for third-party services, database connection strings, private registry credentials, and authentication tokens. Railway paused all deployments on the platform immediately after the detection, bringing down builds for its entire user base while the investigation got underway. "We strongly recommend that you immediately roll all environment variables, including any API keys."[Railway, Security Disclosure — October 21, 2026] By October 22, builds had been restored for Pro and Enterprise workspace customers, though Hobby, Free, and Trial tiers remained offline, with Railway saying it planned to restore them in that order. A follow-up post published October 23 clarified that any code commits pushed during the deployment freeze had not been deployed, meaning developers would need to manually redeploy their most recent commits once access was restored, and also reconnect GitHub integrations and recreate CLI and CI credentials that were issued during that window. Railway says it believes the incident is part of a coordinated series of attacks specifically targeting cloud platforms that run AI inference workloads. The company stated it had directly notified upstream AI inference providers and asked them to revoke all keys as a precaution - a step that suggests the attackers were harvesting credentials to gain free access to AI model APIs, rather than pursuing user data for conventional financial fraud. That theory fits a pattern that emerged just the week before on a competing platform. Zeabur, another cloud deployment service, disclosed on October 15 that an attacker had used leaked internal credentials to access its shared cluster infrastructure between October 14 and 15. The Zeabur post-mortem detailed how the intruder moved through the environment with unusual speed, running commands inside 865 user database containers and reading the environment variables and secrets of services across nine regions. Investigators noted the attacker specifically searched the platform database for AI service API keys, attempting to call Amazon Bedrock using Zeabur's own AWS credentials. A separate OpenAI key belonging to a Zeabur user appeared to have been used for over a thousand image generation requests in the hours after the breach. Zeabur attributed the root cause to long-lived admin credentials stored in plaintext and reachable over the public internet. What Railway Users Should Do Now * Rotate all environment variables stored on Railway, including API keys for every third-party service. * Rotate private container registry credentials. * Review service logs for any unusual or unauthorized activity since October 21. * After builds resume, redeploy the latest commit manually and recreate CLI and CI credentials issued during the outage window. * Reconnect GitHub integrations if they were created after the freeze began. Railway has not disclosed how many accounts are confirmed affected, saying only that initial analysis suggests the exposure is limited to a subset of its user base. The company says it will contact confirmed affected customers directly by email once the investigation identifies them. The platform hosts more than 16 million services, which means even a small percentage of users represents a substantial number of potentially compromised deployments. For developers whose work depends on Railway, the incident is a reminder that secrets stored with a third-party platform inherit that platform's threat surface. Security practitioners have long recommended treating any externally stored credential as potentially compromised following an incident involving its host, regardless of whether that specific account appears in confirmed breach data. Railway's recommendation to rotate everything, not just keys flagged as compromised - follows that same logic. The cost of rotating a key is low; the cost of leaving a live key in an attacker's hands is not. Railway said it will publish further details about the incident as the investigation continues and updates are being posted to its status page under incident reference QH8L8B3E.

Bug Bounty Tips Telegram channel gives you tips about bug bounty. Happy Hacking! linktr.ee/abhinavsingwal