Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software. The changelog runs to hundreds of entries, so anyone planning to read the whole thing might want to put the kettle on. Microsoft's release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages. So that's not necessarily 470 separate security holes, but it's still an impressive amount of patching for one release. The fixes span OpenSSL, curl, Kubernetes, Docker, QEMU, and a lengthy list of other packages that underpin modern Linux environments. The generic Linux kernel has been updated to version 6.6.161.1. There's also been some housekeeping following the eMudhra certificate incident, tracked as CVE-2026-114406. Microsoft has removed or distrusted root certificates that could validate compromised eMudhra intermediate certificates, while adding checks in Python and Go to reject the affected certificates. It has also preserved SSL.com TLS trust where required, presumably to avoid fixing one certificate headache by creating another. Container infrastructure gets plenty of attention, too, with fixes spanning KubeVirt, containerd, Docker Compose, and other components used to keep cloud workloads running. Several CVEs crop up repeatedly across these packages, helping explain the eye-watering number of entries in the changelog. The release includes less security-focused changes too, including new Dockerfiles, an OpenVMM patch for confidential computing support, fixes for systemd hangs, and adjustments to GRUB Secure Boot metadata. The hefty release comes amid an AI-fueled surge in vulnerability discovery that has left developers struggling to keep up with the resulting patch workload. As The Register reported earlier today, Linux creator Linus Torvalds reckons there may finally be signs that the flood is easing, at least in some corners of the kernel. Torvalds said fixes are now arriving faster than new bug reports in the kernel's eBPF subsystem, although he noted that most other areas haven't reached that point. Whether the wider software industry is anywhere close to catching up is another matter, and Microsoft hasn't said if AI-assisted research contributed to the vulnerabilities addressed in this release. Azure Linux, formerly known as CBL-Mariner, is Microsoft's own Linux distribution, developed primarily for its cloud infrastructure and services. That makes keeping its many components patched rather more important than the modest version-number bump might suggest. And judging by the size of this latest changelog, Microsoft's patching teams aren't likely to be putting their feet up anytime soon. ®

Toilet paper purveyor Who Gives A Crap has found itself in a bit of a mess after an intruder accessed customer information through a third-party software provider, leaving the company scrambling to clean up a breach affecting shoppers in the UK, US, and Australia. In an email sent to affected customers over the weekend, seen by The Register, the loo roll seller warns that personal information was accessed without authorization after a security incident at an unnamed US-based marketing software provider. The email explains that the intruder gained access to the supplier's systems on October 30. The provider spotted the intrusion the following day and says it secured its systems by November 1, although Who Gives A Crap wasn't told until November 6. It's unclear why the supplier sat on the bad news for another five days before passing it on. The exposed information includes customers' names, email addresses, phone numbers, mailing addresses, and total spending with the company. In other words, someone may now know not only where you live, but just how much of your hard-earned cash you've flushed down the crapper. Payment information, order details, and passwords were not involved, and customers' accounts were not directly accessed. That's something of a relief, although whether the intruder actually made off with the data remains a pressing question. "We don't yet know whether the information was copied or downloaded," the company told customers, adding that it had found no evidence of misuse. In a separate public statement, Who Gives A Crap co-founder and CEO Simon Griffiths confirmed that the incident affected customers across the company's Australian, UK, and US stores. Canadian customers, meanwhile, appear to have escaped this particular toilet emergency, with the supplier reporting that no personal information belonging to shoppers in the country was accessed. Who Gives A Crap says it has since disconnected the provider from its systems, changed access credentials, and begun warning affected customers to watch out for suspicious emails, texts, calls, and other unsolicited communications. "The main concern is scam or phishing messages that use your real details to look convincing," the company warned in its customer email. While Who Gives A Crap has been busy cleaning up, the supplier at the center of this particular stink remains a mystery. The company hasn't identified the software provider or disclosed how many customers were affected, including those in the UK, and didn’t respond to our questions. Griffiths said the company is "engaging with the relevant regulatory authorities, as required." In the UK, the ICO told The Register: "We can confirm Who Gives A Crap Limited has reported an incident and we are assessing the information provided." Who Gives A Crap has plenty of toilet paper to hand, although cleaning up this particular situation might require more than a few rolls. ®

A validation error has stopped Outlook.com from accepting legitimate emails. The problem appears widespread and, according to reports from affected users, can result in non-delivery reports with error codes related to SPF (Sender Policy Framework) validation failures. Other users have reported errors highlighting a lack of DMARC (Domain-based Message Authentication, Reporting, and Conformance) information. The troubles began at the end of last week and appear to be the result of Microsoft tightening the rules (or at least attempting to do so) for accepting emails. The company's consumer email services are affected, and it appears that if a domain doesn't have working SPF or if it has a missing DMARC record, then Outlook.com and its ilk will treat it as suspicious and not accept emails. The rules are designed to deal with spam, bulk senders, and the like. In 2025, Microsoft announced new rules designed to strengthen email authentication for domains sending more than 5,000 emails per day. In addition to DMARC and SPF compliance, DKIM (DomainKeys Identified Mail) was also required. Although this seemed like a good idea to ward off spammers, small senders now appear to be affected. According to complainants in the Outlook forum, a single email with just one line might now be rejected. Furthermore, Microsoft has not issued any advisory to customers explaining how the rules have changed. Although some customers insist their DMARC, SPF, and DKIM settings are compliant, many more have reported that once they set them to Microsoft's preferences, email began flowing once more. SPF must pass for the sending domain (the domain's DNS record should accurately list authorized IP addresses/hosts). DKIM must pass to validate email integrity and authenticity. DMARC must have at least p=none and align with either SPF or DKIM (preferably both). The Register asked the Windows giant for more information, but we have yet to receive a response. To make matters worse, the glitch also appears to be intermittent. A resend attempt might succeed following a rejection. To compound the situation, the rejection error message may also be vague about what caused the bounce in the first place. A moderator in Microsoft's support forum acknowledged the bug and said it was "classified as a service degradation." "Microsoft is actively investigating the underlying cause of this email delivery issue, and engineering teams are actively analyzing service telemetry and customer-provided data to identify the source of the issue." Still. It could be worse. Earlier today, several users in Europe, the Middle East, and Africa were affected by another Microsoft whoopsie – a "recent service change" that caused some connections to be abruptly terminated. Outlook on the web, as well as the Purview and Defender portals were all affected. Microsoft reverted the change in the Exchange Online front-end infrastructure, and all was well. It has yet to say what else, if anything, might have changed in its email services to cause legitimate messages to bounce back. ®

Japanese electronics giant Iris Ohyama has taken down its online store after discovering that attackers may have accessed the personal information of 7.7 million customers, leaving shoppers unable to place orders. The retailer, which sells everything from home appliances and furniture to pet supplies, first disclosed the incident on October 29, a day after discovering a suspicious file on a third-party cloud service used by its Iris Plaza ecommerce operation. Iris Plaza immediately suspended its website and associated systems and began investigating, subsequently confirming unauthorized access. Iris Ohyama has since revealed that the potentially compromised cloud environment contained personal information belonging to approximately 5.8 million registered customers, including former members, and another 1.9 million people who had purchased products without creating an account or participated in promotional campaigns. The potentially exposed information includes names, addresses, phone numbers, email addresses, dates of birth, gender, and passwords, although the company says the exact information at risk varies between customers. Some of that data, including passwords, was encrypted, but Iris Ohyama hasn't explained what protection was used. It has advised customers who reused their Iris Plaza passwords elsewhere to change them, presumably before someone else gets the opportunity. There is some good news for anyone who has handed over their credit card details, as the retailer says it didn't store payment information in the affected cloud service and that it hasn't been compromised. It remains unclear whether the attackers actually made off with any personal information. In its FAQ, Iris Plaza says it is still investigating the possibility of a data leak and has yet to establish the full extent of the intrusion. Meanwhile, Iris Plaza's website is still down, and the company isn't saying when it'll be back. Orders are also taking longer to ship, while customers trying to cancel a purchase have been told they may have to turn the delivery driver away if their parcel arrives before the cancellation is processed. Fortunately for anyone desperate to buy a new rice cooker, Iris Plaza's stores on Rakuten, Yahoo! Shopping, and auPAY Market are still operating. The company says it has found no evidence that those stores were affected. Iris Ohyama has reported the incident to Japanese authorities and says it will contact potentially affected customers individually. It has also warned shoppers to watch out for phishing emails, fraudulent calls, and fake websites impersonating the retailer. The company has yet to identify the cloud provider involved, explain how the attackers got in, or establish whether any of those 7.7 million records actually left its systems. ®

The worst of the patchpocalypse may be behind us, according to Linus Torvalds. Writing in his weekly kernel update post, the Linux kernel dev leader delivered Linux 7.4 rc2 – the second rough cut of the next kernel – which he rated as a big release for two reasons. One is that he left some code out of rc1, because he was busy and because it was already the largest such release in the history of the kernel. The other is what Torvalds described as “various AI fixes.” Such fixes are necessary because ever since Anthropic launched its Mythos bug-finding model in April, developers have been able to find more software flaws than was previously possible. Microsoft, for example, addressed a record 974 flaws in September – its third record fixing spree this year after it whacked 622 flaws in July and 206 in June. Oracle addressed 1,449 flaws in a single month. That’s many more patches than IT teams are set up to handle, yet they must find ways to deal with bugs more quickly because attackers are increasingly targeting flaws found by AI. Torvalds’ post suggests that, perhaps, the worst of this is behind us. “This time around Alexei claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true,” he wrote. That’s a reference to Alexei Starovoitov, co-creator and lead dev on the Extended Berkeley Packet Filter (eBPF), the project that makes it possible to run sandboxed programs within the Linux kernel. “I think most other areas haven't reached that point yet, but it's at least a sign that we _may_ be starting to see the tide starting to turn,” he added. “Don't hold your breath, but maybe cross your fingers we'll be getting there in the not entirely distant future.” If Torvalds is correct, that’s welcome news. The Linux kernel’s 40-million-plus lines of code makes it one of the world’s bigger software projects. If AI soon stops finding flaws in other parts of the kernel beyond eBPF, perhaps the deluge of fixes developers and users alike will need to handle has peaked. ®

Huawei claims it’s built a desktop PC that uses only parts made in CHina. The company launched the Qingyun HM650 last week and said it uses Huawei’s own Kirin X90 processor, a ten-core 20-thread machine with a clock speed of 2.3 GHz. The machine runs a newly developed enterprise version of HarmonyOS, the OS Huawei developed to end its dependence on Android and which it intends to run on most of the devices it makes. A single Chinese government agency has reportedly signed up for 600 of the machines. That’s not an indication this machine is a curiosity, because Beijing has ordered all government entities to shift from Wintel boxes to local alternatives. While Huawei has reportedly claimed local companies manufactured 100 percent of the components in the machine, it is unclear if all those components use Chinese designs. The Register mentions that uncertainty as many non-Chinese companies continue to operate factories in China. Even if Huawei is using some parts that aren’t entirely Chinese, the debut of the Qingyun HM650 is bad news for Intel, AMD, and Qualcomm, as all are suffering as the PC market shrinks due to the rising cost of memory. China’s government is an enormous buyer, and losing the chance to bid for its business is unlikely to be helpful. Japan announces emergency response package after wave of cyberattacks Japan’s government last Friday announced emergency funding to help local organizations strengthen the nation's cyber-defences. The ¥10 billion ($63 million) package follows a wave of cyberattacks that have disrupted railways, retailers, KFC’s logistics provider, and cloud computing operators. The emergency package aims to help Japanese government agencies to use AI to nail infosec basics, and to build tools that let the National Cybersecurity Office aggregate information about cyberattacks. Some funds will also go towards supporting victims. Lenovo’s APAC boss shifts to lead Motorola Lenovo is looking for a new leader of its Asia-Pacific operations after shifting the boss, Amar Babu, to a role as mobile business group general manager and global president at Motorola. Amar led Lenovo in the region for over five years and the company credited him with turning it into “a more balanced and diversified business and a key growth engine.” “Across the portfolio, AP maintained its #1 PC position, while our mobile business achieved notable growth, with Motorola reaching nearly 9 percent market share in India and the #2 smartphone OEM in Japan,” according to a company announcement. “Our infrastructure business achieved profitable growth and nearly double-digit market share, while Solutions & Services continued to strengthen its best-of-breed industry position and significantly increased its advanced services business mix to over 50 percent.” Lenovo has not named a new leader for its APAC outpost. Vietnam hails homegrown USB storage chip Vietnam’s government last week announced the nation’s first domestically-designed security chip - a 28-nanometer device that apparently integrates encryption algorithms in silicon. The chip is already in use on secure USB storage devices that Vietnam’s government employs to store info for government and defense agencies, plus the Communist Party. The nation hopes to use the chips to secure storage of the national digital signature certification system, and critical infrastructure systems in electricity, water, oil and gas, and telecommunications. Hanoi says the chip needs more testing before the government will trust it to protect state secrets, but hailed the chip as an important step towards development of sovereign security capabilities. Apple’s biggest ever education deal Apple last week quietly announced it has won its biggest-ever sale of Macs into the education market in the Philippines. Speaking on the company’s Q4 earnings call, CEO John Ternus said Apple sold 172,000 MacBook Neos to the Department of Education in the Philippines, which will deploy them to teachers and staff. ®

NHS staff drafted into a helpline after colleagues' health data was exposed online faced distressed callers, safeguarding concerns, and a "serious emotional impact," a review has found. The report [PDF] comes almost exactly a year after the Royal Cornwall Hospitals NHS Trust disclosed a data breach affecting 8,003 people, including current and former trust staff and non-trust workers. A member of the public discovered the exposure in November 2025. An Excel workbook published in response to a Freedom of Information request in February 2023 retained underlying sickness absence records that users could reveal through its pivot tables. Staff assigned to the helpline described difficult calls involving shouting, anger, and distress. Particularly difficult calls involved people distressed by the sensitivity of the disclosures or potentially in danger from domestic abuse. Call handlers said they had to make safeguarding assessments without training or an established process. "Such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach," the review noted. "This placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those." Members of the trust's clinical governance team were told just a day beforehand that they would staff the helpline. Despite their experience dealing with patient trauma, they received little preparation for the calls that followed. "The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up," the review noted. "Some staff had not finished reading the pre-prepared script which had arrived only 30 minutes before the center went live." Most call handlers only learned that their own data had been exposed while already working on the helpline, sometimes minutes before supporting others affected. Call handlers also said they had little choice about taking on the work and were expected to maintain their usual duties alongside it. The review stated that some staff members gave up weekends and worked long past their scheduled hours to meet the demands of both roles. "It's typical NHS, it runs on goodwill," one staffer told the team that compiled the report. The call center was only supposed to run for two weeks in December 2025, but due to the volume of calls, it was eventually stood down after 11 weeks, in February 2026. According to officials speaking at a trust board meeting on Thursday, the review and its findings have since been circulated among staff, and published online. How the spreadsheet slipped through Responding to a Freedom of Information Act (FOIA) request thought to be from a journalist researching a story about stress in the NHS, the Royal Cornwall Hospitals NHS Trust uploaded a spreadsheet to its public FOI Disclosure log in February 2023. This contained personal data and inadvertently exposed sickness absence information and sensitive health data related to 7,715 staff, 288 non-trust workers, as well as a small number of unidentified records. Crucially, this spreadsheet was uploaded in a format that allowed users to access the pivot table from which some data was derived. The data in these pivot tables would normally have been too sensitive to be included in FOIA responses. The first failure was that the request was handled by the trust's e-Rostering team instead of the People Information Unit, which had the expertise in responding to FOIA requests with complex datasets. The e-Rostering team compiled the response using the team's own data, but incorrectly believed they had stripped the spreadsheet of the sensitive data that would later be exposed. Standard procedures instructed request handlers to follow several steps to ensure sensitive data was stripped before documents are published, some of which were skipped. For starters, one FOI officer assigned to the response either failed to run the spreadsheet through Excel's Document Inspector, which formed part of the usual procedures, or failed to act upon its recommendations. This feature can flag pivot tables and potentially hidden cached data, but cannot determine whether that data is sensitive or automatically remove the cache. Staff also failed to follow instructions to convert the spreadsheet to PDF. Investigators found that doing so prevented users clicking through to the underlying records, although they could not guarantee that no hidden data remained technically accessible. At the time, internal guidance did not require conversion to CSV, which would have removed the workbook's pivot-table functionality and embedded cache. The trust's sign-off process also focused on answering the request's questions and meeting their public relations duties, and falsely assumed that the data had been adequately sanitized before the final review. The spreadsheet was made available for 33 months, although the trust is not sure how many times it was viewed during that time. Its logs only covered the 12 months before a member of the public alerted it to the pivot table issue. These indicated that it had been accessed 340 times, although the review noted there was no way of knowing how many of these, if any, led to pivot tables being accessed, or even if it was viewed by a human, with web crawlers adding to the total view count. The trust has since implemented a number of changes to prevent a recurrence of the breach, including the mandatory password-protecting of any Excel workbook as part of FOIA responses. A senior information governance officer must now approve spreadsheet responses before executive sign-off. Revised guidance circulated in November 2025 also called for conversion to CSV, although investigators found that this requirement had not been incorporated into the formal operating procedure and recommended updating it. The review says the Information Commissioner's Office closed its case after the trust implemented its recommendations. A spokesperson for the Royal Cornwall Hospitals said: "We are deeply sorry for the accidental sharing of sickness absence data which we reported in November 2025, and for the distress and concern it caused those colleagues whose data was involved. "An independent investigation has now been completed, and the report has been published in full on our website in the interests of transparency and accountability. "The investigation has helped us understand what happened and identify areas where improvements were needed. We have already implemented a number of measures to strengthen our processes, particularly around the management of Freedom of Information requests and responses. "The protection of personal information is of the utmost importance to us, and we remain committed to learning from this incident and preventing a similar event from happening again. "We continue to provide support to colleagues who have been affected." ®