OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach
OpenCode has disclosed a security incident in which an attacker gained access to a legacy system on the night of October 16, potentially exposing API keys from third-party providers that users had saved in the Console.
The company stated that the breach affected only 1.4 percent of Console users. The legacy system was already in the process of being decommissioned at the time of the incident. OpenCode did not provide details on how the access occurred, how long it lasted, or how many keys were stored in the system.
The exposure was described as possible rather than confirmed. The company has not stated that any keys were copied or used. Some users have reported unrecognized charges on their provider accounts following the incident.
According to cofounder Dax Raad, the incident was limited to the Console and did not affect the core OpenCode platform. Keys added through the command-line interface or desktop applications remain stored locally on users' machines.
On October 17, OpenCode sent emails to affected users and confirmed that anyone who did not receive a notification was not impacted. In the same statement posted on X, the company said it was working with Anthropic, OpenAI, and Google while the incident was ongoing.
The company linked the event to a large-scale distillation attack but did not explain the connection or name any responsible party. The article notes the lack of technical evidence linking the two events.
Users are advised to revoke and rotate keys directly in each provider's dashboard, as deleting a key from the Console does not revoke it. They should also update any applications that used the old keys and review provider usage and billing starting from October 16.
Related articles
Beget Loses Accreditation as .RU and .РФ Domain Registrar After Cyberattack
Following a cyberattack on November 2, Russian domain registrar and hosting provider Beget has had its accreditation temporarily suspended by the Coordination Center for .RU and .РФ domains. The company can no longer register new domains in the .RU, .РФ, and .SU zones or accept transfers from other registrars. Beget must continue supporting all domains registered before the suspension, and expiration dates have been postponed by agreement with the Coordination Center and RosNIIROS to prevent any loss of domains. The incident stems from attackers gaining access to the management infrastructure and deploying wiping scripts. Partial functionality has been restored in the control panel, but full domain management features for the affected zones will return only after accreditation is reinstated. No specific recovery timeline has been announced.
Beget Rebuilds Cloud Infrastructure After Destructive Cyberattack Wipes VPS Backups
Beget suffered a severe cyberattack that allowed threat actors to access the management layer of its entire cloud architecture and execute wiping scripts. The incident destroyed cloud infrastructure and left backup copies of VPS files available to only half of the affected users. Internal systems were also hit, breaking links between customer accounts and services, forcing the provider to reconstruct ownership records. Hosting services have recovered more than 60 percent, while full cloud restoration timelines remain unknown. The attack disrupted BelkaCar’s car-sharing application, which relied on Beget for backend connectivity and has since migrated to another provider.
Fukuoka Prefecture Exposes Personal Data of 183 Corporate Officers Due to Website File Misconfiguration
Fukuoka Prefecture has confirmed that personal information belonging to 183 corporate officers from 24 organizations was left publicly accessible on its official website. The exposure occurred within files related to the Fukuoka Prefecture Easy-to-Work Care Workplace Certification System. The files were uploaded by a contracted vendor between August 21 and September 17, 2026, with incorrect permissions that allowed online editing and saving instead of read-only access. The issue remained undetected until an applicant inquired about download procedures. Upon discovery, the prefecture instructed the vendor to remove the files and contacted all 24 affected corporations by telephone to provide explanations and apologies. The incident highlights risks associated with improper configuration of application files containing sensitive personal data on government websites.
New Container, Old Code: Web Shell Persists Three Months in 1C-Bitrix Environment
Two 1C-Bitrix sites shared a web shell named WebShellOrb after an attacker exploited multiple vulnerabilities in a custom appeal application. The initial compromise went undetected because Nginx logs were retained for only one month, leading responders to conclude that no scanning activity remained visible. After agents showed no malicious code, administrators restarted the container without addressing the underlying issues in the shared filesystem and source code. The attacker regained access weeks later by reusing JWT tokens generated with a hardcoded secret and by exploiting SQL injection flaws that allowed password hash extraction. Shared system user accounts and a common filesystem volume enabled the shell to propagate between sites and survive container recreation. The incident highlighted that redeploying containers and rotating passwords failed to eliminate persistence rooted in unpatched code and misconfigured authentication logic.