Internal GCP and Azure credentials allowed unauthorized access to PingCAP’s production control plane for more than three weeks. Attackers exported 10.6 TB of data via 88 full exports over 22 days without triggering alerts, with 200 GB already circulating on torrent sites. The breach exposed 20.6M customer SQL queries and sensitive data for tenants including Airbnb, Atlassian, Baidu and Bank of China, while Pinterest and CardX had live AWS keys leaked through support tickets. Additionally, the hackers accessed personal emails and professional profiles for 24,900 engineers at Tencent, Huawei and ByteDance.
Two other vulnerabilities emerged within the same 72 hour window affecting core web infrastructure. eMudhra issued eight intermediate CA certificates with weak private keys, one of which was the single digit 4, leaving servers using curl, Go and Python vulnerable to compromise. Simultaneously, two pre-authentication remote code execution vulnerabilities with CVSS scores of 9.2 were discovered in PHP. Although patches are available for versions 8.2 through 8.5, 59% of PHP servers listed on Shodan run on outdated versions that will not be officially fixed.