--- title: Security incident update: 22–23 October 2026 | daily.dev description: Avalonia confirms attackers gained unauthorized access to the content management system behind its marketing website, after an administrator credential was... canonical: https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security incident update: 22–23 October 2026 | daily.dev og:description: Avalonia confirms attackers gained unauthorized access to the content management system behind its marketing website, after an administrator credential was... og:url: https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt og:image: https://api.daily.dev/og/posts/5mwEnfVbt.png og:image:alt: Security incident update: 22–23 October 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security incident update: 22–23 October 2026 **[Avalonia UI Blog](https://daily.dev/sources/avalonia-blog)** · 10 min read · 0 upvotes · 0 comments ## Summary Avalonia confirms attackers gained unauthorized access to the content management system behind its marketing website, after an administrator credential was accidentally exposed in client-side JavaScript. The token had been exposed since at least April 2026, and recorded administrator activity ran from 22:37 on October 22 until 01:22 on October 23. Attackers also made 39 rejected attempts to publish packages to Avalonia's NuGet feeds and tried to access customer accounts and licensing systems, and those attempts were unsuccessful. Based on current findings, no customer data, licence keys, or source code were exposed, and no customer action is required. The request signatures and execution patterns point to ARTEX, an open-source, AI-assisted penetration-testing framework, or a derivative of it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers get into Avalonia's CMS in the October 2026 incident? Attackers used a CMS administrator token that was accidentally embedded in client-side JavaScript delivered to website visitors, due to a misconfiguration that exposed an environment variable in the browser bundle. The token had reportedly been exposed since at least April 2026. Avalonia revoked the credential, rebuilt the website without it, and purged cached copies. _Teams hardening credential handling in client-side builds can track incident postmortems like this on daily.dev._ ### Did the Avalonia security incident affect NuGet packages or customer data? No. All 39 attempts by the attacker to publish packages to Avalonia's NuGet feeds were rejected, and no package tampering was found. There was also no evidence of unauthorized access to customer portal records, payment information, licence keys, or restricted product source code. Customers were told no action, such as password resets or package reinstalls, was required. _Developers evaluating supply chain risk after vendor breaches can follow incident updates like this via daily.dev._ ### What is ARTEX and why was it mentioned in the Avalonia breach report? ARTEX is an open-source, AI-assisted penetration-testing framework whose request signatures and execution patterns matched those observed during the attack on Avalonia, or a derivative of it was used. It has reportedly also been used by state-aligned threat actors in unrelated campaigns, though its public availability means its use does not identify the specific operator behind an attack. _Security engineers tracking AI-assisted attack tooling can follow coverage of tools like ARTEX on daily.dev._ ## Similar posts on daily.dev - [Axios Maintainer Confirms Social Engineering Attack Behind n...](https://daily.dev/posts/axios-maintainer-confirms-social-engineering-attack-behind-n--gwaje9fz9) · Socket · 4 upvotes · 0 comments - [Two different attackers poisoned popular open source tools](https://daily.dev/posts/two-different-attackers-poisoned-popular-open-source-tools-p4gnqzolb) · The Register · 2 upvotes · 0 comments - [Popular Codex npm package stole developer tokens for a month](https://daily.dev/posts/popular-codex-npm-package-stole-developer-tokens-for-a-month-szppthxmu) · The Next Web · 1 upvotes · 1 comments - [Attack targeting OpenAI Codex users exposes AI software supply chain risks](https://daily.dev/posts/attack-targeting-openai-codex-users-exposes-ai-software-supply-chain-risks-x1yygxvy1) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security incident update: 22–23 October 2026","url":"https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt"},"datePublished":"2026-10-23T14:40:35.784Z","dateModified":"2026-10-23T14:41:13.203Z","description":"Avalonia confirms attackers gained unauthorized access to the content management system behind its marketing website, after an administrator credential was...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c163336101ad512f50c277b33b9a549?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c163336101ad512f50c277b33b9a549?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Avalonia UI Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Avalonia UI Blog","logo":"https://media.daily.dev/image/upload/s--dntcJgqc--/f_auto,q_auto/v1773656510/logos/avalonia-blog?_a=BAMAMiiu0","url":"https://daily.dev/sources/avalonia-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nuget","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Avalonia UI Blog","item":"https://daily.dev/sources/avalonia-blog"},{"@type":"ListItem","position":3,"name":"Security incident update: 22–23 October 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-incident-update-22-23-october-2026-5mwenfvbt#faq","mainEntity":[{"@type":"Question","name":"How did attackers get into Avalonia's CMS in the October 2026 incident?","acceptedAnswer":{"@type":"Answer","text":"Attackers used a CMS administrator token that was accidentally embedded in client-side JavaScript delivered to website visitors, due to a misconfiguration that exposed an environment variable in the browser bundle. The token had reportedly been exposed since at least April 2026. Avalonia revoked the credential, rebuilt the website without it, and purged cached copies. Teams hardening credential handling in client-side builds can track incident postmortems like this on daily.dev."}},{"@type":"Question","name":"Did the Avalonia security incident affect NuGet packages or customer data?","acceptedAnswer":{"@type":"Answer","text":"No. All 39 attempts by the attacker to publish packages to Avalonia's NuGet feeds were rejected, and no package tampering was found. There was also no evidence of unauthorized access to customer portal records, payment information, licence keys, or restricted product source code. Customers were told no action, such as password resets or package reinstalls, was required. Developers evaluating supply chain risk after vendor breaches can follow incident updates like this via daily.dev."}},{"@type":"Question","name":"What is ARTEX and why was it mentioned in the Avalonia breach report?","acceptedAnswer":{"@type":"Answer","text":"ARTEX is an open-source, AI-assisted penetration-testing framework whose request signatures and execution patterns matched those observed during the attack on Avalonia, or a derivative of it was used. It has reportedly also been used by state-aligned threat actors in unrelated campaigns, though its public availability means its use does not identify the specific operator behind an attack. Security engineers tracking AI-assisted attack tooling can follow coverage of tools like ARTEX on daily.dev."}}]} ```