For about twenty-six hours in October, a cloud hosting company says its engineers and an attacker's AI agents raced each other through its infrastructure, one opening routes and the other closing them. The attackers won enough of those races to rack up roughly seven hundred forty thousand dollars in AI bills on other people's keys. It's Wednesday, November eleventh, and you're listening to Lantern Cybersecurity Daily. Railway's full incident report leads. Then an authentication bypass in the Xen Orchestra virtualization manager that attackers are already using, the one exploited bug in Microsoft's enormous Patch Tuesday, and an inference-engine flaw that reached inside NEAR AI's private computing setup. Tap follow so the next episode finds you.
Railway's engineering team, in its incident report published Tuesday:
This was not a single breach followed by a single fix. The attacker probed many potential routes, in parallel, with Railway similarly hardening the routes in parallel.
Railway builds and runs apps for developers and stores their secrets, API keys and database credentials, as environment variables. It first disclosed this on October twenty-second and told customers to rotate secrets. Tuesday's report fills in how it happened. According to Railway, it started at seven twenty-eight UTC on Tuesday, October twentieth, with a previously unknown flaw in its build infrastructure that let the attacker escape filesystem isolation and grab an internal credential. That opened build histories and a copy of Railway's source code, which the attacker studied for more ways in. A misconfigured trust relationship then led to the credentials that decrypt customer variables. Railway says the attacker decrypted variables for at most one point eight five percent of workspaces, about a hundred thousand. That's a ceiling, not a confirmed count of stolen secrets. Its database queries hunted for AI provider keys first, with some matching cloud, database and payment credentials. Railway says it was defending against abliterated models, meaning models with their safety refusals stripped out, and a harness similar to ARTEX, the agent framework we've tracked for weeks. That comparison is attributed to Wiz. Wiz has also grouped this with attacks on Northflank, OpenCode, Warp and Lightning AI under the name Black October. Here's the bit customers will remember. On October twenty-sixth Railway said it couldn't refund spend on compromised keys. Now it says it will cover charges that AI providers decline to refund. Good reversal, and it came after the bill was in. Tokens for one thousand eight hundred fifty-two users were also exposed, including GitHub OAuth tokens and agent keys; Railway reset them and says it found no logins using stolen credentials, and no sign that customer Git repos or databases were touched. The attacker was out by October twenty-first. If your platform holds your AI keys, its isolation is now part of your spending limit.
BleepingComputer, on a virtualization management flaw:
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
Xen Orchestra is the web console from French company Vates for running XCP-ng, the open-source hypervisor. So the prize here is every virtual machine on the pool, not one box. Vates tracks it as VSA-2026-062; there's no CVE or score yet. Anyone who can reach the management interface can send a crafted cookie holding an empty JSON object, and Xen Orchestra logs them in as the owner of an existing token, no credentials needed. Vates says that can mean code execution on managed pools and root on XCP-ng nodes. Researchers Filip Magic and Christoffer Olsen of TDC NET Security found it. And it doesn't log the cookie. Vates says detection has to come from HTTP monitoring. Vates confirms active exploitation and has published indicators: connections to its listed attacker infrastructure, a VM named pivot2, VMs configured to use a file as a serial port, and cron files with ustar in the name. It says those belong to this one campaign, and other actors may look different. The fix is Xen Orchestra 6.9.1 stable or 6.10.0 latest. If you can't update, Vates says restrict the console to a dedicated management network and block the known malicious addresses. If you think you were hit, rotate the passwords and secrets your virtualization environment uses. And if that console faces the internet, that's the actual problem.
Jonathan Greig, writing in The Record from Recorded Future News:
Among the 1,093 bugs disclosed on Tuesday, Microsoft said one is being exploited in the wild: CVE-2026-124194. The company said it has a severity score of 6.5 and impacts Microsoft Outlook.
Counts vary by what you include. BleepingComputer's tally is one thousand two hundred thirty-five. Either way, it's more than a thousand for the second straight month. The exploited one, per Microsoft: an attacker sends a crafted message file and persuades someone to open it in Outlook. Outlook then connects to an attacker-controlled location without the usual external-content warning, which can leak authentication information usable to impersonate that user. One analysis says that's an NTLMv2 password hash. Microsoft credits Benoît Sevens with finding it using Anthropic's Claude. It hasn't said who's exploiting it, since when, or how widely, and CISA has given federal agencies until the end of the month. Rated Moderate, so a severity-sorted queue would bury it. A write-up by Ryan Cole notes it's the third month running that the bug attackers actually use sits below Critical. A thousand fixes, and the order of work is: the exploited one first. The same CISA push also covered Barracuda's email gateway flaws, which we covered Friday as a disclosure. Barracuda said Monday evening they're now exploited against a small number of organizations, and attacks need access to the admin interface. Plus an exploited Chrome zero-day patched this week. Check that automatic updates are actually on.
Swati Khandelwal, writing in The Hacker News, on NEAR AI:
But the TEE "does not protect against a vulnerability in the software running inside the environment," the company said. SGLang runs inside the TEE, which is how the attacker could reach requests there.
NEAR AI sells AI inference with a confidential mode, where requests run in a trusted execution environment meant to keep them private even from NEAR AI. SGLang is the open-source inference engine doing the work inside that environment. NEAR AI says that on Sunday, November eighth, an attacker used a remote code execution flaw in SGLang to run code on one inference server and could have seen requests processed there that day, confidential ones included. From there it reached a system behind the deprecated Private Chat product and downloaded names, emails and some plan and balance details for about a hundred users. It also reached eighteen agents on an older NEAR AI Agents deployment outside the TEE, taking chat history, settings and logs. Two customers' cloud API keys sat in those logs; both are revoked. NEAR AI says it revoked sessions and admin credentials, replaced agent tokens, patched SGLang on every inference server and finished a forensic review. It reported the flaw to the SGLang project, but hasn't given a CVE, the affected versions, or whether a fix has shipped upstream. Which leaves everyone else running SGLang without much to act on. And NEAR AI hasn't said whether people whose requests crossed that server on Sunday were contacted. Brave's Leo assistant runs some chats through NEAR AI's TEE; NEAR AI hasn't said whether this server handled any. Confidential computing protects the data from the host. It doesn't protect it from the code you invited inside.
Got a story we should be watching, or a call you think we got wrong? Write to lanterncybersecuritydaily at lantern podcasts dot com. We read it.
Today's short list: Railway customers, check your rotated keys and provider bills; Xen Orchestra admins, update and hunt for those indicators; everyone, get the Outlook fix in. Lantern Cybersecurity Daily is made by Lantern Podcasts. See you tomorrow, Thursday, November twelfth.