Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces.
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole. Qubole is an enterprise cloud data processing and analytics platform that helps companies manage large datasets and run machine learning workloads. It also offers AWS integration to allow computing resource management. Companies can grant third-party providers such as Qubole access to their AWS resources by creating cross-account IAM roles. Trust policies determine which external AWS accounts can take these roles, and permissions are set to define the resources and actions allowed.
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory. As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object. Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code. While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents.
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. FireWorks provides a high-performance inference platform for developers who want to deploy and run open-source artificial intelligence models (such as Mistral, Meta's Llama, or Google's Gemma) without worrying about hardware bottlenecks and complex infrastructure tasks. The company notified law enforcement and customers of another security incident in early October after attackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. "The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as 'LLMJacking'," Fireworks said at the time.
Iris Ohyama warns that a cloud data breach may have exposed personal information of 7.7 million customers, including names and passwords. Japanese household goods manufacturer Iris Ohyama has disclosed that attackers may have accessed personal information belonging to approximately 7.7 million people through an external cloud service used by its online shopping subsidiary, Iris Plaza. The incident highlights a security risk that often receives less attention than attacks against corporate networks: sensitive customer information can be exposed through services operated outside an organization’s own infrastructure. Iris Plaza discovered a suspicious file in an external cloud service on October 28, 2026. The company immediately shut down its online shopping platform and related systems, launched an investigation and confirmed unauthorized access by a third party. It published an initial notification on October 29, followed by an update on November 5 detailing the potential impact. In its official incident notice, the company confirmed that information stored in the external cloud environment may have been accessed or obtained by unauthorized parties. “Iris Plaza Co., Ltd. (Headquarters: Sendai City, Miyagi Prefecture, President: Ryota Iwasaki, hereinafter referred to as “the Company”), a member of the Iris Group, has investigated the unauthorized access incident that occurred on its official online shopping site for Iris Ohyama, “Iris Plaza” (hereinafter referred to as “Iris Plaza”). As a result of the investigation, it has been determined that some personal information may have been leaked.” reads the company’s notice. “Subsequent investigations have confirmed the possibility that data stored on an external cloud service may have been leaked. The total amount of personal information stored was approximately 7.7 million records, and at this time, we have confirmed the possibility that this data may have been viewed or obtained. “ The 7.7 million figure refers to records stored in the affected cloud service, not confirmed stolen data. Potentially affected individuals include 5.8 million current and former members and 1.9 million non-members. Exposed information may include names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, some of which are encrypted. “The following personal information may have been leaked at this time: classificationTarget itemsNumber of peopleMember data (including information on members who have withdrawn)Name, address, phone number, email address, gender, password * , date of birth, etc.Approximately 5.8 million peopleNon-member data (including information on individuals who have purchased products without registering as a member or who have participated in campaigns)Name, address, phone number, email addressApproximately 1.9 million people Not all of the above information about our customers has been leaked. The items affected vary depending on your registration status.” continues the notice. “Some items, including passwords, are encrypted.” There is one important distinction: credit card information wasn’t stored in the affected cloud service and, according to the company, wasn’t exposed. Iris Plaza also says it hasn’t identified unauthorized access or data leaks involving its stores on other external e-commerce marketplaces. As of November 5, it had received no reports of fraudulent use of the information or financial losses linked to the incident. アイリスオーヤマ株式会社+1 The company reported the incident to Japanese police and the country’s Personal Information Protection Commission on October 29. It also blocked the unauthorized access route, suspended the affected systems and brought in external experts to support the investigation. The response extended beyond the main shopping platform. Iris Plaza suspended its SIMPLE STYLE website, while another group company, Iris Tech Service, stopped its websites and new applications for home appliance subscriptions and furniture and appliance delivery and installation services. The company says it hasn’t found evidence that these additional services were compromised. Iris Plaza has also warned customers about possible follow-up scams. Attackers could use the exposed personal information to create convincing phishing emails, SMS messages or phone calls, impersonating the company or other organizations. Fake websites and social media accounts could also appear, attempting to collect login credentials, payment details or other personal information. The company is asking customers who reused their Iris Plaza passwords on other services to change them. It also says it will contact potentially affected individuals individually as the investigation progresses. Customers should be particularly careful with messages claiming to provide information about the incident, account recovery or compensation. “We will never ask for your password, PIN, authentication code, or any other important information when we contact you.” アイリスオーヤマ株式会社 The incident is another reminder that organizations must extend security controls and monitoring beyond their own infrastructure. Third-party cloud services can hold millions of customer records, and unauthorized access to those environments can create consequences far beyond the service initially compromised. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iris Ohyama)
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. On the night of November 1st, the attacker gained access to the management systems of the company's entire architecture and deployed malware that erased server data. The Russian cloud provider detected the attack shortly after the malware activated and disconnected all servers from the network to stop the malicious activity from spreading across its infrastructure. Beget is a major Russian web-hosting, cloud, and domain-registration provider that serves more than 200,000 customers, including online stores, media, and educational services. More than a week after the destructive attack, Beget says that 60% of shared hosting and 40% of the dedicated servers it manages have been restored, and recovery is still in progress.
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Share: Opens in a new window Opens in a new window Opens in a new window Press Release CISA Announces Enhanced Reporting Form for Cyber Incidents New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions Released November 09, 2026 Related topics: Cyber Threats and Response , Incident Response WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) unveiled the updated cyber incident reporting form, an enhanced web-enabled questionnaire available on CISA’s Incident Reporting Portal for reporting cyber incidents. By improving data quality, the more robust form strengthens the effectiveness and efficiency of national cyber defense. For instance, the new form will help CISA correlate related cyber threat activity to identify a larger trend from what otherwise would appear as independent incidents.
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed. Qubole, a data lake platform owned by Idera,
Confirm this action.
Leaving now will discard your changes.