原文: https://fulcrumsec.vg/pingcap/
摘要:
 |
1
DT37 22h 38m ago
今天这是怎么了，到处都是爆炸的东西
|
 |
2
putaozhenhaochi 22h 20m ago
这不得赔破产
|
 |
3
BrbiwsFtd9zDGZqB OP @putaozhenhaochi 难说
https://www.pingcap.com/trust-hub/security/security-update-october-2026/ > 一家外部事件响应公司审查了 PingCAP 的生产系统，未发现攻击者在被审查的系统中运行命令或保持持久访问权限的证据. > 在外部律师和第三方取证专家的支持下，没有证据表明存储在 TiDB 中的数据受到影响 |
 |
4
Hozzz 17h 48m ago  1
漏的主要是 tidb 内部经营数据，数据库本身及客户的数据库不受影响
|
 |
5
utodea 15h 34m ago
> "We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign... that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials... Eighty-eight consecutive exports, not one detection event."
这写得还挺嚣张的... 或许大家真的需要类似 https://keyrotate.sh 的产品主要去发现环境、系统、仓库里都有哪些 api key 、秘钥，然后周期性自动地去轮换、失效它们。 这应该不是个例，在 AI 时代，感觉会一直上演。 |
Select Language