Sunday, November 1, 2026
Assume your keys are stolen
Good morning. On this day in 1800, John Adams became the first president to live in the White House. This week's guests were less invited.
- A cloud host tells customers to assume every secret is stolen
- A maximum-severity GitLab bug is under attack
- OpenAI cuts its funding ask by $10 billion
Presented by Cyhornet - Need a key rotation and access policy before the next breach? Get ready-to-use GRC templates at cyhornet.ai
TOP STORY
KEYS TO THE KINGDOM
Northflank says: assume it's all stolen
Northflank, a cloud platform developers use to run apps and AI tools, told customers on October 30 to assume every environment variable stored there had been decrypted. Those variables often hold database passwords and API keys. Northflank said multiple customers reported unauthorized use of AI API keys stored on the platform. It has not said how attackers got in or how many customers were hit, BleepingComputer reported. Security firm Wiz counted at least nine incidents at AI developer platforms this month, including Railway, OpenCode and Warp. In two cases Wiz investigated, stolen credentials ran up about $100,000 in Amazon Bedrock usage.
Why it matters: Stolen AI keys turn into your bill. Rotate any keys stored on hosting platforms today and check your AI provider's usage logs.
Sources: bleepingcomputer.com
QUICK HITS
PATCH NOW
GitLab's worst-case bug is live. CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29. CISA says the flaw can let an unauthenticated attacker run code on GitLab servers through a crafted regular expression in a CI/CD file.
What to do: Self-host GitLab? Confirm you're on a patched release today. cisa.gov
BREACH WATCH
Chainalysis meets AI-driven intruders. The blockchain analytics firm said attackers used "offensive agentic techniques" to get into its internal systems, exposing customer names, emails, user IDs and role labels. It says it found no evidence that investigation data or credentials were accessed.
What to do: Customers should turn on two-factor authentication and ignore "fund recovery" offers. bleepingcomputer.com
MONEY MOVES
OpenAI trims its ask. OpenAI is now seeking up to $20 billion in its latest round, down from about $30 billion, CNBC confirmed after the Financial Times first reported the cut. The FT said the round values the company at $1.25 trillion.
What to do: Building on one AI vendor? Write down your backup option. cnbc.com
WORTH YOUR MONEY
Returned something to Amazon? Check your inbox and spam for a notice about the Amazon Return Policy Litigation settlement. Subclass A members are paid automatically; Subclass B members must file a claim by December 1, 2026. Amazon denies wrongdoing; final approval is pending. Use only the official site: returnsettlement.com
TODAY'S LEARNING
FedInsider hosts a free webinar, "Maintaining Uninterrupted Operations," Monday, November 2, at 2:00 PM ET. It covers recovering from outages and AI agent mistakes, with 1 CPE credit. Registering opts you into partner emails. fedinsider.com