Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident ยท updates https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026 On Oct 26 2026, no-code platform Bubble posted on status.bubble.io that it is responding to an active security incident after detecting unauthorized access to parts of its systems. Bubble has confirmed the attacker accessed third-party tokens and credentials, such as API keys used in the API Connector and plugins, belonging to a subset of Bubble users, and says it is contacting affected users directly. As part of containment it may temporarily take parts of its infrastructure offline, which can affect both the Bubble editor and live Bubble apps. Bubble says the scope may change as the investigation continues and that official messages will come only from bubble.io and status.bubble.io. en Mon, 26 Oct 2026 00:00:00 GMT Bubble says an attacker accessed users' third-party API keys and tokens in an active security incident: Bubble posts an active security incident on its status page: it detected unauthorized access to parts of its systems and confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector and plugins) belonging to a subset of Bubble users. Bubble is contacting affected users and warns it may take parts of its infrastructure offline, affecting the editor and live apps, as part of containment. https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026 https://pwn.watch/i/bubble-security-incident-third-party-tokens-oct-2026#2026-10-26-1fc568bf Mon, 26 Oct 2026 00:00:00 GMT high <p><a href="https://status.bubble.io/">Source</a></p>