Avalonia UI
Breach limited to CMS
Avalonia security incident: CMS breach, packages and customer data unaffected
Avalonia reported that unauthorised access during the 22-23 October 2026 attack was limited to its marketing website CMS. The entry point was an administrator token accidentally embedded in browser-delivered JavaScript. All 39 attempts to publish to its NuGet feeds were rejected, and customers need not reset passwords or replace licence keys.