Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software. The changelog runs to hundreds of entries, so anyone planning to read the whole thing might want to put the kettle on. Microsoft's release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages. So that's not necessarily 470 separate security holes, but it's still an impressive amount of patching for one release. The fixes span OpenSSL, curl, Kubernetes, Docker, QEMU, and a lengthy list of other packages that underpin modern Linux environments. The generic Linux kernel has been updated to version 6.6.161.1. There's also been some housekeeping following the eMudhra certificate incident, tracked as CVE-2026-114406. Microsoft has removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, while adding checks in Python and Go to reject the affected certificates. It has also preserved SSL.com TLS trust where required, presumably to avoid fixing one certificate headache by creating another. Container infrastructure gets plenty of attention, too, with fixes spanning KubeVirt, containerd, Docker Compose, and other components used to keep cloud workloads running. Several CVEs crop up repeatedly across these packages, helping explain the eye-watering number of entries in the changelog. The release includes less security-focused changes too, including new Dockerfiles, an OpenVMM patch for confidential computing support, fixes for systemd hangs, and adjustments to GRUB Secure Boot metadata. The hefty release comes amid an AI-fueled surge in vulnerability discovery that has left developers struggling to keep up with the resulting patch workload. As The Register reported earlier today, Linux creator Linus Torvalds reckons there may finally be signs that the flood is easing, at least in some corners of the kernel. Torvalds said fixes are now arriving faster than new bug reports in the kernel's eBPF subsystem, although he noted that most other areas haven't reached that point. Whether the wider software industry is anywhere close to catching up is another matter, and Microsoft hasn't said if AI-assisted research contributed to the vulnerabilities addressed in this release. Azure Linux, formerly known as CBL-Mariner, is Microsoft's own Linux distribution, developed primarily for its cloud infrastructure and services. That makes keeping its many components patched rather more important than the modest version-number bump might suggest. And judging by the size of this latest changelog, Microsoft's patching teams aren't likely to be putting their feet up anytime soon. ®

The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file

Toilet paper purveyor Who Gives A Crap has found itself in a bit of a mess after an intruder accessed customer information through a third-party software provider, leaving the company scrambling to clean up a breach affecting shoppers in the UK, US, and Australia. In an email sent to affected customers over the weekend, seen by The Register, the loo roll seller warns that personal information was accessed without authorization after a security incident at an unnamed US-based marketing software provider. The email explains that the intruder gained access to the supplier's systems on October 30. The provider spotted the intrusion the following day and says it secured its systems by November 1, although Who Gives A Crap wasn't told until November 6. It's unclear why the supplier sat on the bad news for another five days before passing it on. The exposed information includes customers' names, email addresses, phone numbers, mailing addresses, and total spending with the company. In other words, someone may now know not only where you live, but just how much of your hard-earned cash you've flushed down the crapper. Payment information, order details, and passwords were not involved, and customers' accounts were not directly accessed. That's something of a relief, although whether the intruder actually made off with the data remains a pressing question. "We don't yet know whether the information was copied or downloaded," the company told customers, adding that it had found no evidence of misuse. In a separate public statement, Who Gives A Crap co-founder and CEO Simon Griffiths confirmed that the incident affected customers across the company's Australian, UK, and US stores. Canadian customers, meanwhile, appear to have escaped this particular toilet emergency, with the supplier reporting that no personal information belonging to shoppers in the country was accessed. Who Gives A Crap says it has since disconnected the provider from its systems, changed access credentials, and begun warning affected customers to watch out for suspicious emails, texts, calls, and other unsolicited communications. "The main concern is scam or phishing messages that use your real details to look convincing," the company warned in its customer email. While Who Gives A Crap has been busy cleaning up, the supplier at the center of this particular stink remains a mystery. The company hasn't identified the software provider or disclosed how many customers were affected, including those in the UK, and didn’t respond to our questions. Griffiths said the company is "engaging with the relevant regulatory authorities, as required." In the UK, the ICO told The Register: "We can confirm Who Gives A Crap Limited has reported an incident and we are assessing the information provided." Who Gives A Crap has plenty of toilet paper to hand, although cleaning up this particular situation might require more than a few rolls. ®

submitted by /u/certkit
[link] [comments]

A validation error has stopped Outlook.com from accepting legitimate emails. The problem appears widespread and, according to reports from affected users, can result in non-delivery reports with error codes related to SPF (Sender Policy Framework) validation failures. Other users have reported errors highlighting a lack of DMARC (Domain-based Message Authentication, Reporting, and Conformance) information. The troubles began at the end of last week and appear to be the result of Microsoft tightening the rules (or at least attempting to do so) for accepting emails. The company's consumer email services are affected, and it appears that if a domain doesn't have working SPF or if it has a missing DMARC record, then Outlook.com and its ilk will treat it as suspicious and not accept emails. The rules are designed to deal with spam, bulk senders, and the like. In 2025, Microsoft announced new rules designed to strengthen email authentication for domains sending more than 5,000 emails per day. In addition to DMARC and SPF compliance, DKIM (DomainKeys Identified Mail) was also required. Although this seemed like a good idea to ward off spammers, small senders now appear to be affected. According to complainants in the Outlook forum, a single email with just one line might now be rejected. Furthermore, Microsoft has not issued any advisory to customers explaining how the rules have changed. Although some customers insist their DMARC, SPF, and DKIM settings are compliant, many more have reported that once they set them to Microsoft's preferences, email began flowing once more. SPF must pass for the sending domain (the domain's DNS record should accurately list authorized IP addresses/hosts). DKIM must pass to validate email integrity and authenticity. DMARC must have at least p=none and align with either SPF or DKIM (preferably both). The Register asked the Windows giant for more information, but we have yet to receive a response. To make matters worse, the glitch also appears to be intermittent. A resend attempt might succeed following a rejection. To compound the situation, the rejection error message may also be vague about what caused the bounce in the first place. A moderator in Microsoft's support forum acknowledged the bug and said it was "classified as a service degradation." "Microsoft is actively investigating the underlying cause of this email delivery issue, and engineering teams are actively analyzing service telemetry and customer-provided data to identify the source of the issue." Still. It could be worse. Earlier today, several users in Europe, the Middle East, and Africa were affected by another Microsoft whoopsie – a "recent service change" that caused some connections to be abruptly terminated. Outlook on the web, as well as the Purview and Defender portals were all affected. Microsoft reverted the change in the Exchange Online front-end infrastructure, and all was well. It has yet to say what else, if anything, might have changed in its email services to cause legitimate messages to bounce back. ®

A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed

Japanese electronics giant Iris Ohyama has taken down its online store after discovering that attackers may have accessed the personal information of 7.7 million customers, leaving shoppers unable to place orders. The retailer, which sells everything from home appliances and furniture to pet supplies, first disclosed the incident on October 29, a day after discovering a suspicious file on a third-party cloud service used by its Iris Plaza ecommerce operation. Iris Plaza immediately suspended its website and associated systems and began investigating, subsequently confirming unauthorized access. Iris Ohyama has since revealed that the potentially compromised cloud environment contained personal information belonging to approximately 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products without creating an account or participated in promotional campaigns. The potentially exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords, although the company says the exact information at risk varies between customers. Some of that data, including passwords, was encrypted, but Iris Ohyama hasn't explained what protection was used. It has advised customers who reused their Iris Plaza passwords elsewhere to change them, presumably before someone else gets the opportunity. There is some good news for anyone who has handed over their credit card details, as the retailer says it didn't store payment information in the affected cloud service and that it hasn't been compromised. It remains unclear whether the attackers actually made off with any personal information. In its FAQ, Iris Plaza says it is still investigating the possibility of a data leak and has yet to establish the full extent of the intrusion. Meanwhile, Iris Plaza's website is still down, and the company isn't saying when it'll be back. Orders are also taking longer to ship, while customers trying to cancel a purchase have been told they may have to turn the delivery driver away if their parcel arrives before the cancellation is processed. Fortunately for anyone desperate to buy a new rice cooker, Iris Plaza's stores on Rakuten, Yahoo! Shopping, and auPAY Market are still operating. The company says it has found no evidence that those stores were affected. Iris Ohyama has reported the incident to Japanese authorities and says it will contact potentially affected customers individually. It has also warned shoppers to watch out for phishing emails, fraudulent calls, and fake websites impersonating the retailer. The company has yet to identify the cloud provider involved, explain how the attackers got in, or establish whether any of those 7.7 million records actually left its systems. ®

The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an

Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker

submitted by /u/nimesh404
[link] [comments]

Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could

Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.

A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week. The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login. The researchers are highly confident that the attacker is a single person

The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty. According to reports from Bloomberg and CNBC, Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026. If proven guilty, the

U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of inventory. "The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement

The worst of the patchpocalypse may be behind us, according to Linus Torvalds. Writing in his weekly kernel update post, the Linux kernel dev leader delivered Linux 7.4 rc2 – the second rough cut of the next kernel – which he rated as a big release for two reasons. One is that he left some code out of rc1, because he was busy and because it was already the largest such release in the history of the kernel. The other is what Torvalds described as “various AI fixes.” Such fixes are necessary because ever since Anthropic launched its Mythos bug-finding model in April, developers have been able to find more software flaws than was previously possible. Microsoft, for example, addressed a record 974 flaws in September – its third record fixing spree this year after it whacked 622 flaws in July and 206 in June. Oracle addressed 1,449 flaws in a single month. That’s many more patches than IT teams are set up to handle, yet they must find ways to deal with bugs more quickly because attackers are increasingly targeting flaws found by AI. Torvalds’ post suggests that, perhaps, the worst of this is behind us. “This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true,” he wrote. That’s a reference to Alexei Starovoitov, co-creator and lead dev on the Extended Berkeley Packet Filter (eBPF), the project that makes it possible to run sandboxed programs within the Linux kernel. “I think most other areas haven't reached that point yet, but it's at least a sign that we _may_ be starting to see the tide starting to turn,” he added. “Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future.” If Torvalds is correct, that’s welcome news. The Linux kernel’s 40-million-plus lines of code makes it one of the world’s bigger software projects. If AI soon stops finding flaws in other parts of the kernel beyond eBPF, perhaps the deluge of fixes developers and users alike will need to handle has peaked. ®

submitted by /u/fagnerbrack
[link] [comments]

Huawei claims it’s built a desktop PC that uses only parts made in CHina. The company launched the Qingyun HM650 last week and said it uses Huawei’s own Kirin X90 processor, a ten-core 20-thread machine with a clock speed of 2.3 GHz. The machine runs a newly developed enterprise version of HarmonyOS, the OS Huawei developed to end its dependence on Android and which it intends to run on most of the devices it makes. A single Chinese government agency has reportedly signed up for 600 of the machines. That’s not an indication this machine is a curiosity, because Beijing has ordered all government entities to shift from Wintel boxes to local alternatives. While Huawei has reportedly claimed local companies manufactured 100 percent of the components in the machine, it is unclear if all those components use Chinese designs. The Register mentions that uncertainty as many non-Chinese companies continue to operate factories in China. Even if Huawei is using some parts that aren’t entirely Chinese, the debut of the Qingyun HM650 is bad news for Intel, AMD, and Qualcomm, as all are suffering as the PC market shrinks due to the rising cost of memory. China’s government is an enormous buyer, and losing the chance to bid for its business is unlikely to be helpful. Japan announces emergency response package after wave of cyberattacks Japan’s government last Friday announced emergency funding to help local organizations strengthen the nation's cyber-defences. The ¥10 billion ($63 million) package follows a wave of cyberattacks that have disrupted railways, retailers, KFC’s logistics provider, and cloud computing operators. The emergency package aims to help Japanese government agencies to use AI to nail infosec basics, and to build tools that let the National Cybersecurity Office aggregate information about cyberattacks. Some funds will also go towards supporting victims. Lenovo’s APAC boss shifts to lead Motorola Lenovo is looking for a new leader of its Asia-Pacific operations after shifting the boss, Amar Babu, to a role as mobile business group general manager and global president at Motorola. Amar led Lenovo in the region for over five years and the company credited him with turning it into “a more balanced and diversified business and a key growth engine.” “Across the portfolio, AP maintained its #1 PC position, while our mobile business achieved notable growth, with Motorola reaching nearly 9 percent market share in India and the #2 smartphone OEM in Japan,” according to a company announcement. “Our infrastructure business achieved profitable growth and nearly double-digit market share, while Solutions & Services continued to strengthen its best-of-breed industry position and significantly increased its advanced services business mix to over 50 percent.” Lenovo has not named a new leader for its APAC outpost. Vietnam hails homegrown USB storage chip Vietnam’s government last week announced the nation’s first domestically-designed security chip - a 28-nanometer device that apparently integrates encryption algorithms in silicon. The chip is already in use on secure USB storage devices that Vietnam’s government employs to store info for government and defense agencies, plus the Communist Party. The nation hopes to use the chips to secure storage of the national digital signature certification system, and critical infrastructure systems in electricity, water, oil and gas, and telecommunications. Hanoi says the chip needs more testing before the government will trust it to protect state secrets, but hailed the chip as an important step towards development of sovereign security capabilities. Apple’s biggest ever education deal Apple last week quietly announced it has won its biggest-ever sale of Macs into the education market in the Philippines. Speaking on the company’s Q4 earnings call, CEO John Ternus said Apple sold 172,000 MacBook Neos to the Department of Education in the Philippines, which will deploy them to teachers and staff. ®

submitted by /u/ryanmerket
[link] [comments]