A breach of PingCAP’s managed TiDB Cloud resulted in the exfiltration of 10.6 TB across 4.9 million files, with a public stage-one dump of about 200 GB. Attackers replicated the entire TiDB Cloud control plane and associated cloud estates using credentials found in committed repos, pulling 88 consecutive six-hourly exports over weeks without detection. The haul includes production control-plane databases, billing and finance systems, GCP and AWS storage, a 533.8-million-row BigQuery warehouse, hundreds of GCP buckets, Jira and CRM data, and 413 private source repositories - demonstrating operational blind spots in a company that runs multi-tenant production databases for other businesses.
Exfiltrated specifics show 180,046 tenant organizations, ~292k user records, 403,262 unique emails, 115,308 plaintext customer API keypairs (42,612 active), 20.6 million SQL statements from customers (including sensitive medical and business data), 5+ million customer server IPs, 377,446 Jira issues and 433,928 CRM contacts. Financial and billing records reveal per-customer AWS spend (~$107M over 57 months), ARR and contract details. Source code contains glaring flaws - unverified auth headers, impersonation bypasses, and a crypto library using a static IV and single SaltSecret. Internal security notes from 2022 warned that any org member could reset cluster root passwords, yet the platform remained exploitable; support tickets also leaked live customer credentials (AWS keys, GitHub tokens, DB connection strings), exposing many named customers (e.g., Booking.com, Shopee, Capcom, Airbnb, Atlassian, Databricks, Pinterest) to further compromise.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.