Lightning AI takes Studio platform offline after customer credentials compromised
Teaser from the source
On Oct 15 2026 at 23:00 UTC Lightning AI identified unauthorized access to credentials on its Lightning Studio platform and revoked all user access two hours later. Lightning believes certain customer credentials were used to reach customer environments and connected third-party services. Studio, Deployments, Pipelines and Drive are affected; GPU cluster rental and managed Kubernetes/SLURM are not. As of Oct 25 the platform is still inaccessible while an external firm investigates. Lightning tells all users to rotate secrets stored in Studios (such as GitHub credentials) and third-party credentials used by their VMs.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on credentials
Other advisories
- Not ratedosv:CVE-2026-88811Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
- Not ratedosv:CLEANSTART-2026-XR01746In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials
- MediumCVE-2026-116689follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
- MediumCVE-2026-116689follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
- Not ratedosv:CVE-2026-62979jack: upstream error responses expose backend and peer credentials
- Not ratedosv:CVE-2026-116244pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
- Not ratedosv:CVE-2026-119662Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
- Not ratedosv:CLEANSTART-2026-TZ01622In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials
Other news entries
- Vercel rolls out new protection against stolen session cookie attacksNewsBleepingComputer
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switchesNewsBleepingComputer
- NIKKE PC game launcher hacked to spread remote access, data-stealing malwareNewsBleepingComputer
- Malicious cPGuard Updates Served in OpsShield Supply Chain AttackNewsSecurityWeek
- Critical Langflow flaws enable authentication bypass and RCENewsCSO Online
- Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet CredentialsNewsThe Hacker News
- mSecure password manager hack: encrypted mSecure Cloud vault database reportedly stolen, users told to change passwordsBreachpwn.watch
- Cursor removes malicious Claude Code extension after SSH backdoor attemptNewsCSO Online
Source: https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026