Comment by vldszn
6 hours ago
Crazy day for cybersecurity: PHP RCE, eMudhra certificates, and now Railway.
And it’s all just getting started imo.
6 hours ago
Crazy day for cybersecurity: PHP RCE, eMudhra certificates, and now Railway.
And it’s all just getting started imo.
I think the pingcap hack might be the biggest of them all, somehow it has gone under the radar.
[0] https://news.ycombinator.com/item?id=50173716
Related ongoing thread:
PingCap TiDB Leaks - https://news.ycombinator.com/item?id=50173716 - Oct 2026 (32 comments)
(It had only spent 3 hours on the frontpage so I re-upped it.)
I guess I picked the wrong week to stop sniffing glue.
Surely you can't be serious
1 reply →
I find it wild how much they have downplayed this in their statement. https://www.pingcap.com/trust-hub/security/security-update-o...
”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”
hmm, I don't think that's true.
"Found no evidence" doesn't mean it didn't happen, it means the incident response firm didn't find it.
1 reply →
Plaid is listed as a customer. Good times.
That was a single company, the cert problem hit something like 70% of all websites and devices.
Honestly…I’ve never heard of pingcap
Jesus that one is bad
I can’t even
1 reply →
Also GitLab
https://docs.gitlab.com/releases/patches/patch-release-gitla...
Also Shopify, they have been delisting a lot of apps without giving a reason, most lickely a supply chain attacked that spoofed/stol checkout data
Madness..
And about 50+ sev 9+ CVEs for the linux kernel
And litellm too
true =(
"It's just marketing" HN mostly told us
[dead]