The threats that don’t make headlines are the ones that get you
The week of October 22, 2026 produced a serious batch of security incidents that most small business owners probably scrolled past. Critical PHP and GitLab remote code execution flaws grabbed attention. But underneath those, there were authentication bypasses, stolen credentials, and NFC bank fraud that are frankly more relevant to the average business running SaaS tools and off-the-shelf software.
If you’re running a small or mid-size business, the practical question is: which of these actually touches your environment? More than you’d think.
Laravel’s authentication bypass is a real problem
Laravel is one of the most widely used PHP frameworks on the planet. On October 22, 2026, a critical flaw was patched, CVE-2026-114509, with a CVSS score of 9.2. The short version: an attacker with no credentials at all could authenticate as any existing user on routes protected by Laravel’s built-in TokenGuard. No password needed. No token needed.
The vulnerability affects MySQL and MariaDB configurations specifically, where a crafted non-string credential value confuses the authentication query into matching the wrong user record. The fix is in versions 13.29.0 and 12.68.0.
If your business runs any web application built on Laravel, or if a vendor or developer built something for you on Laravel, you need to confirm which version they’re running. Today, not next sprint.
Credentials are still being stolen from cloud infrastructure
Andromeda disclosed on October 13, 2026, that unauthorized access to credentials in its environment began around October 9th as part of what it described as an industry-wide attack. Customer credentials were exposed. The company said there’s no evidence customer models or datasets were accessed, but credentials themselves are the entry point for everything else.
This connects to a pattern worth paying attention to. AI infrastructure providers are becoming attractive targets specifically because businesses are storing sensitive data and API keys with them. If you’re using AI tools in your workflow, your credentials to those platforms deserve the same treatment as your banking credentials. That means unique passwords, MFA, and regular rotation. The risks that come with AI tool adoption go well beyond the tools themselves.
NFC fraud is not a distant problem
Dutch police arrested two suspects in a scheme that stole roughly 380,000 euros from 170 victims using AI-generated audio clips and NFC relay fraud. The scam worked like this: victims got a phone call with a convincing AI-generated voice claiming suspicious activity on their bank account, then were told to download an app and hold their bank card against their phone. The NFC chip data was forwarded directly to the attacker, who used it for unauthorized withdrawals.
This is a social engineering attack, and it works because the audio sounds legitimate. Employees who handle company finances or vendor payments are the right audience for a quick refresher on this one.
Patch fatigue is real, but some patches can’t wait
Roundcube pushed versions 1.6.20 and 1.7.5, fixing 20 issues including IMAP command injection and SSRF bypass. GLPI 11.0.8 had an unauthenticated SQL injection flaw that could expose the entire application database, patched in 11.0.9. NVIDIA AIStore carried CVE-2026-65162, a CVSS 10.0 flaw allowing Kubernetes host takeover.
Not every patch is urgent. But authentication bypasses and unauthenticated database reads are in a different category. The challenge for small businesses is knowing which updates fall into which bucket. That’s exactly where patch counts can mislead you into thinking volume equals priority.
- Laravel CVE-2026-114509: patch to 13.29.0 or 12.68.0 immediately
- GLPI: update to 11.0.9 if you run it
- Roundcube: move to 1.6.20 or 1.7.5
- AI platform credentials: audit and rotate now
The common thread across all of this is that basic hygiene, patching, MFA, and credential management, still prevents the majority of these attacks. Exine works with NJ and NYC businesses on exactly this through managed IT and cybersecurity for businesses that don’t have a full internal security team.
FAQ
How do I know if my web app uses Laravel?
Ask your developer or check your codebase for a composer.json file that lists laravel/framework as a dependency. If a vendor built your app, email them directly and ask which version of Laravel they’re running. Don’t accept “it’s up to date” without a version number.
What is NFC relay fraud and can it affect my employees?
NFC relay fraud captures the data from a contactless bank card by tricking someone into holding their card against a phone running a malicious app. Any employee with access to company payment cards is a potential target. Training them to recognize social engineering calls is your first line of defense.
Do I need to worry about Kubernetes vulnerabilities as a small business?
If you don’t run Kubernetes yourself, probably not directly. But if you use cloud services or managed platforms built on Kubernetes, your provider’s patch status matters. Ask them whether CVE-2026-65162 has been addressed in their environment.
How often should we rotate API credentials for AI tools?
At minimum, rotate them every 90 days and immediately after any vendor-reported incident. Store them in a secrets manager rather than in code or shared documents. If a platform you use reports a credential exposure, treat your own keys as compromised until you’ve rotated them.
