Top Security Breaches 2026-10-20

Auto-generated 2026-10-20T09:00:37.708711+00:00 (UTC)

1. OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

   Source: The Hacker News | Published: 2026-10-19T06:07:08+00:00 | Score: 17.964
   

   An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said.

   Console is OpenCode’s optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without

   Original: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

2. Nikkei discloses third data breach in a month, 1.8M records exposed

   Source: BleepingComputer | Published: 2026-10-19T21:49:48+00:00 | Score: 17.476
   

   Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. […]

   Original: https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/

3. California to receive $6m settlement after 23andMe data breach

   Source: World news | The Guardian | Published: 2026-10-19T21:34:30+00:00 | Score: 16.681
   

   Millions of customers’ genetic and personal information exposed in 2023, including more than 855,000 Californians California’s attorney general, Rob Bonta, on Monday announced the state will receive a $6m settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach that exposed 6.9 million customers’ ⁠genetic and other ⁠personal information. California had ​unsuccessfully tried to block the $305m sale of 23andMe assets to TTAM Research Institute, a non-profit controlled by the 23andMe ⁠co-founder Anne Wojcicki. The state had argued that the bankruptcy sale violated California’s Genetic Information Privacy Act, and it had said ⁠consumers did not give express consent to the sale. Continue reading…

   Original: https://www.theguardian.com/us-news/2026/oct/19/california-settlement-23andme-data-breach

4. OpenCode hack exposes API keys amid AI distillation attacks

   Source: BleepingComputer | Published: 2026-10-19T17:27:15+00:00 | Score: 15.827
   

   The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. […]

   Original: https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/

5. Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

   Source: BleepingComputer | Published: 2026-10-17T15:18:51+00:00 | Score: 14.95
   

   ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. […]

   Original: https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/

6. Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

   Source: The Hacker News | Published: 2026-10-19T16:28:47+00:00 | Score: 12.333
   

   Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16.

   Any site that installed and activated one of those copies should be treated as compromised, and the

   Original: https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html

7. GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

   Source: The Hacker News | Published: 2026-10-19T13:05:45+00:00 | Score: 12.291
   

   The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.

   The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps

   Original: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html

8. ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

   Source: The Hacker News | Published: 2026-10-18T08:23:02+00:00 | Score: 11.932
   

   ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.

   The disabled identities are listed below –

   ConnectWise Cloud Backup – 506e08f9-6e9a-4da4-942b-a099a03644ae
   ConnectWise

   Original: https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html

End of report.