Credential theft is winning over clever hacking. Most of this month’s incidents started with a secret that was already in the wrong place.

We pulled the stories from The Hacker News, Cyber Security News, vendor advisories and Salt’s new research. Each one was published or updated in the last few weeks. Where a number comes from a vendor survey, we say so. Surveys are self-reported, so treat them as a signal rather than a census.

Which API breaches and vulnerabilities made the news this month?

Here’s the short list, then the detail.

Date	Who	What happened	API angle
Oct 14–15	Zeabur	Attacker used leaked internal credentials; 3.2M+ environment variable records and 321,810 accounts affected	Stored API keys and secrets
Oct 17	OpenCode	1.4% of Console users affected; third-party provider keys may be exposed	Exposed provider API keys
Sep 9–Oct 7	PingCAP	Stolen service account credentials; exported data included encrypted API-key values	Service account abuse
Oct 13–15	ConnectWise Cloud Backup	Compromised credentials used to authenticate to Microsoft Graph across 173 Microsoft 365 tenants	Over-trusted OAuth app
Oct 2026	Laravel	CVE-2026-114509 (CVSS 9.2), TokenGuard bypass	Broken API authentication
Oct 2026	Eptura Archibus	CVE-2026-107186, -107187, -107188 (CVSS 8.6, 8.5, 9.6)	Legacy API endpoint, no auth
Oct 13	SAP	CVE-2026-89111 (CVSS 10.0), Cloud SDK for Python SSRF	Server-side request forgery

Sources: The Hacker News (ThreatsDay, Oct 22), Cyber Security News (Oct 18), TechJack Solutions weekly briefing (week of Oct 19).

Zeabur: when the platform holds your keys

Zeabur said an attacker used leaked internal credentials on October 14–15 to reach its shared cluster and read the platform database. The attacker took over 3.2 million environment variable records and data for 321,810 accounts, according to The Hacker News. It was Zeabur’s second breach this year, after an August incident that also exposed API keys. The company says it will shut down between December 1 and December 31, 2026.

The lesson isn’t “avoid Zeabur.” Any hosting platform that stores your env vars is a bigger target than your own app. If your Stripe, OpenAI or Supabase service keys live there, assume they’re only as safe as the platform.

OpenCode: keys you saved in someone else’s dashboard

OpenCode disclosed on October 17 that a legacy system it was preparing to shut down was accessed without authorization. About 1.4% of Console users who had linked outside providers may have had third-party API keys exposed, including keys for OpenAI and Anthropic. The company tied the incident to a large-scale distillation attack. Cyber Security News points out that this is a reported connection, not a full account of what happened.

A separate OpenCode bug is worth a line. Pillar Security found a critical remote code execution flaw in how OpenCode handled MCP OAuth on Windows, fixed in version 1.18.33.

PingCAP and Andromeda: service accounts and shared credentials

PingCAP said stolen service account credentials let an attacker copy source code and customer records between September 9 and October 7. The exported data included encrypted API-key values. Andromeda reported unauthorized access to credentials on October 13 and said it believed the activity began in an industry-wide attack around October 9.

ConnectWise: the “trusted app” problem

Between October 13 and 15, attackers used compromised ConnectWise Cloud Backup credentials to sign in to Microsoft Graph as a pre-consented enterprise application, hitting 173 Microsoft 365 tenants, per the TechJack briefing. Nobody guessed a user’s password. The attacker walked in through an app that customers had already approved.

Laravel, Eptura and SAP: three classic mistakes

Laravel (CVE-2026-114509). Under certain MySQL or MariaDB setups, a crafted non-string value in the credential lookup could match the wrong user, letting an unauthenticated attacker act as someone else. Laravel fixed it in versions 13.29.0 and 12.68.0. If you build on Laravel and use TokenGuard, update today.

Eptura Archibus. Rapid7 found that a legacy API endpoint could be used to bypass authentication. Related flaws allowed a full database read and an insecure file upload that leads to code execution. Old endpoints that nobody remembers are how shadow APIs hurt you.

SAP. SAP’s October patch day included a CVSS 10.0 server-side request forgery flaw in its Cloud SDK for Python. The Hacker News reports it can allow OAuth2 credential theft.

Why are AI agents the next big API security problem?

Because an AI agent is basically a very fast API client with a user’s permissions. Salt Labs published its State of Agentic AI and API Security 2H 2026 report on October 13. These are the numbers worth knowing (survey of 380+ organizations, self-reported):

• 49.8% confirmed or suspected an AI agent took an unintended or unauthorized action in the past year.
• 86.4% run at least one AI agent, and 59.5% run more than 10.
• 76.8% have agents that call other agents or tools, which then call APIs.
• Only 17.5% could automatically stop a misbehaving agent in production.
• MCP-related infrastructure showed up in 21.6% of Salt customer environments in August, up from 16.7% in January.

Two more stories show what that looks like in practice. Salt Labs showed on October 1 that a single email could hijack the Manus agent platform and reach a user’s connected accounts. And V12 reported on October 22 that the x402 payment SDKs could sign a payment for an agent’s full token balance if a malicious API asked for it. The default client had no spending limit until releases on August 18 added one.

Researcher Sunil Tripathy also described an indirect prompt injection chain in ChatGPT’s GitHub connector. A hidden instruction in a public repo could push the agent to write a workflow into a private repo and leak secrets. OpenAI reportedly called it out of scope. That is one researcher’s write-up, so read it as a warning about over-broad connector permissions, not a settled verdict.

Our take: agents don’t create new kinds of API bugs. They make old ones (too much access, no logging, no kill switch) cost more, faster.

How do this month’s incidents map to the OWASP API Security Top 10?

Most of them fit categories OWASP already lists. The OWASP API Security Top 10 (2023 edition) is still the current API-specific list. The 2025 update went to the general OWASP Top 10, not the API one. Matching the stories to the list is our own reading, so treat it as analysis.

OWASP category (2023)	This month’s example
API1:2023 Broken Object Level Authorization (BOLA)	Not named in this month’s headline CVEs, but still the top risk
API2:2023 Broken Authentication	Laravel TokenGuard bypass
API7:2023 Server Side Request Forgery	SAP Cloud SDK flaw
API8:2023 Security Misconfiguration	Plaintext internal credentials at Zeabur
API9:2023 Improper Inventory Management	Eptura’s legacy endpoint (a shadow API)
API10:2023 Unsafe Consumption of APIs	Agents trusting malicious API responses (x402)

What do the key terms mean?

• BOLA: an API returns an object (an order, a profile) without checking that the caller owns it. OWASP ranks it API1:2023.
• REST and GraphQL: two common API styles. REST uses many URLs. GraphQL uses one endpoint with flexible queries, which makes per-field authorization easy to forget.
• JWT: a signed token that carries identity claims. A weak signing setup or missing expiry makes it forgeable or reusable.
• OAuth 2.0: the standard for delegated access (“sign in with Google”, app-to-app permissions). ConnectWise’s story is an OAuth trust problem.
• mTLS: both sides of a connection prove their identity with certificates, which suits service-to-service calls.
• Zero Trust: don’t trust a request because of where it came from. Verify identity and permission every time. NIST SP 800-204 gives guidance for securing microservices-based systems.

Why do vibe-coded apps leak API keys so easily?

AI assistants write working code fast, and they often skip the boring controls. Salt’s survey found 83.5% of respondents believe AI-generated or AI-assisted code contributed to some application security findings, yet only 6.8% resolve those issues inside the coding assistant when the code is generated.

The patterns we’d expect in a typical Replit, Cursor, Copilot, Vercel or Supabase project:

• A secret key pasted into front-end code, so every visitor can read it.
• A Supabase table with row-level security off, which is a BOLA waiting to happen.
• A .env file committed to a public repo “just for now.”
• An API route that returns the whole database row, not only the fields the page needs.

[ADD REAL EXPERIENCE HERE: one concrete finding from a real scan or app audit you ran, with permission, and what the fix looked like.]

If you want a quick look at your own app, the App Security Scanner checks for these issues in plain English, and the Privacy Leak Detector flags data your app exposes by accident. Our guides on exposed API keys, secret scanners and vibe coding risks go deeper.

Which laws and standards apply to API security?

If your API touches personal or payment data, several rules apply whether or not you’ve read them.

Rule	What it says	Who it affects	Practical step
GDPR Article 32	Requires “appropriate” technical measures to secure personal data	Anyone handling EU residents’ data	Access controls, encryption, logging
CCPA/CPRA	Requires reasonable security; breaches caused by lack of it can bring legal claims	Businesses serving California residents	Document and test your controls
PCI DSS v4.0	Sets secure development and authentication requirements for payment data	Anyone storing or processing card data	Review Requirements 6 and 8
NIST SP 800-204	Guidance on securing microservices and API gateways	Voluntary, widely referenced	Use as a design checklist

Regulators don’t care whether a leak came from a clever exploit or a forgotten key. Under GDPR, a breach of personal data generally has to be reported to the supervisory authority within 72 hours.

What should you do about API security this week?

Here’s a checklist you can finish in an afternoon.

1. Rotate secrets. Replace any API key that has been in a repo, a chat, a screenshot or a third-party dashboard (Zeabur and OpenCode users, start here).
2. Search your code for secrets. Check your history and your front-end bundle, not just the current files.
3. Test object ownership. Log in as user A and request user B’s IDs. If anything comes back, you have a BOLA bug.
4. List every endpoint. Retire old ones. Archibus-style legacy routes are how shadow APIs bite.
5. Update frameworks. Laravel 13.29.0 / 12.68.0 if you use TokenGuard, and the latest Node.js if you decode untrusted Brotli data.
6. Shrink agent permissions. Give each AI connector the minimum repo, mailbox or wallet access, and set spending limits.
7. Log agent actions. Over 60% of Salt’s respondents would need hours or days to reconstruct what an agent did the day before.
8. Review OAuth apps. Remove integrations you don’t use, and check which ones hold broad scopes.

Want a head start? You can scan your app free with PrivacyReport and get a plain-English list of what to fix first.

Which API security tools do you actually need?

Start with the cheap, boring ones: a secret scanner, dependency updates, and an endpoint inventory. Add runtime monitoring once you have real traffic. Enterprise platforms like those from Salt or Cequence suit large estates. Solo builders and small teams get more from a scanner they’ll actually run, plus Continuous Monitoring so new leaks don’t sit unnoticed. If you use AI to build, AI App Security covers the agent-specific gaps.

Frequently asked questions

What is API security?
API security is the set of practices that stop attackers from misusing the interfaces apps use to talk to each other. It covers authentication (who are you), authorization (what can you touch), input validation, rate limiting, key management and monitoring. Most API breaches come from broken access control or leaked credentials rather than novel exploits.

What are the biggest API security threats right now?
The biggest threats are leaked API keys and credentials, broken authentication, broken object-level authorization (BOLA), forgotten legacy endpoints and over-permissioned AI agents. This month’s incidents at Zeabur, OpenCode and PingCAP involved stolen credentials, while Laravel’s CVE-2026-114509 was an authentication bypass.

What is BOLA and why does it top the OWASP list?
BOLA stands for Broken Object Level Authorization. An API accepts an object ID, such as an order number, and returns the object without checking the caller owns it. OWASP ranks it API1:2023 because it’s common, easy to exploit by changing an ID and hard for scanners to catch automatically.

How do API keys get leaked?
Common routes include committing a .env file to a repo, embedding secrets in front-end code, pasting keys into chats or tickets, and storing them in a third-party platform that later gets breached. Zeabur’s October breach exposed over 3.2 million environment variable records, which shows how one platform incident can leak many apps’ keys.

Are AI agents an API security risk?
Yes, because agents call APIs with real permissions and act quickly. Salt’s 2H 2026 survey found 49.8% of respondents confirmed or suspected unauthorized agent actions, and only 17.5% could automatically stop one. Limit what each agent can access, set spending caps and log every action.

What should I do if my API key is exposed?
Revoke and replace the key immediately, then check the provider’s usage logs for activity you don’t recognize. Remove the key from your repo history and any cached builds, and set up alerts or spending limits. If personal data may be involved, check your breach notification duties, such as GDPR’s 72-hour rule.

Does GDPR apply to a small app’s API?
It does if your app processes personal data of people in the EU, regardless of your size. Article 32 expects appropriate security measures. For a small team that means access controls, encrypted connections, key hygiene and logging, plus the ability to report a breach promptly.

The short version: what this month’s API security news tells us

The pattern in this month’s API security news is plain. Leaked secrets, forgotten endpoints and over-trusted apps did more damage than any zero-day. Fix the basics first, then give your AI agents tighter limits than you think they need. When you’re ready, scan your app free with PrivacyReport and see what’s exposed before someone else does.

Sources

• The Hacker News, “ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More” (Oct 22, 2026): https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html
• Cyber Security News, “OpenCode Security Breach Exposes Third-Party API Keys of its Console Users” (Oct 18, 2026): https://cybersecuritynews.com/opencode-security-breach/
• Campus Technology, summary of Salt Security’s 2H 2026 survey (Oct 21, 2026): https://campustechnology.com/articles/2026/10/21/unexpected-ai-agent-activity-reported-by-nearly-half-of-organizations-in-recent-survey.aspx
• Let’s Data Science, “Salt Survey Documents Unauthorized AI Agent Actions”: https://letsdatascience.com/news/salt-survey-documents-unauthorized-ai-agent-actions-429bb486
• Salt Security blog, Manus hijack research (Oct 1, 2026): https://salt.security/blog
• The Hacker News homepage, x402 SDK report (Oct 22, 2026): https://thehackernews.com/
• TechJack Solutions, Weekly Security Intelligence Briefing, week of Oct 19, 2026: https://techjacksolutions.com/security/briefing/weekly-security-intelligence-briefing-week-of-2026-10-19/
• Laravel security advisory GHSA-f9x3-7vq9-cph6: https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6
• OWASP API Security Top 10 (2023): https://owasp.org/API-Security/editions/2023/en/0x11-t10/
• NIST SP 800-204: https://csrc.nist.gov/pubs/sp/800/204/final
• NVD (CVE lookup): https://nvd.nist.gov/

---

4. Image ideas and alt text

1. Timeline infographic of October 2026 incidents (Zeabur, OpenCode, PingCAP, ConnectWise, Laravel).
   Alt: “Timeline of API security incidents in October 2026, from PingCAP’s credential theft to the Zeabur breach.”
2. Table graphic: OWASP API Top 10 (2023) mapped to this month’s stories.
   Alt: “Table matching OWASP API Security Top 10 categories to October 2026 API security news examples.”

---