TLDR INFORMATION SECURITY 2026-10-30

Watch the full walkthrough on demand.

HHS FILING PUTS IRHYTHM DATA BREACH TOLL AT 8.2 MILLION

In June, hackers accessed iRhythm's third-party-hosted business applications, demanded a ransom, and threatened to leak stolen data. HHS now lists 8,179,772 people as affected. Exposed data includes names, contact details, dates of birth, account and device identifiers, insurance numbers, and service dates. iRhythm says it has no evidence of identity theft and found no impact on medical devices, patient safety, manufacturing, or customer connections.

LINUX KERNEL TCP FLAW WITH 9.8 CVSS SCORE AFFECTS UBUNTU, RED HAT, AND OTHER DISTRIBUTIONS

Researchers from Anthropic uncovered a new use-after-free vulnerability in the Linux kernel that could lead to memory corruption, kernel memory reads, or system crashes. The vulnerability stems from a race condition in the TCP handshake and is fixed by ensuring all other CPUs finish reading the socket options before freeing them. Red Hat and other distros rate the vulnerability less severely because the race condition is complex to exploit.

LEAK WEBSITE RELEASES DATA ON THOUSANDS OF U.S. HOMELAND SECURITY EMPLOYEES

Distributed Denial of Secrets released data belonging to over 40K DHS employees. The data was obtained from an Okta instance, though Okta has stated that they were not breached. The stolen data includes DHS employees' names, phone numbers, and email addresses.

GOOGLE ANNOUNCES GEMINI 4 CARBON, ITS LATEST FRONTIER AI MODEL THAT YOU CAN'T USE

Google announced Gemini 4 Carbon two weeks after Gemini 4 Argon. It targets vulnerability detection, validation, remediation, and secure code generation. Google says Carbon is twice as likely as Argon to produce vulnerability-free code and resisted all prompt-injection attempts in Grey Swan testing.

SECURING INTERNET-CRITICAL SOFTWARE: HOW WE COULD HAVE BACKDOORED BASH

GNU Savannah's Savane forge passed a user's email address unescaped into a shell command during GPG key testing, so an RFC-valid address containing backtick-wrapped commands gave any registered user code execution on the backend. Hacktron researchers used that foothold to read database credentials, grant themselves superuser, and impersonate Bash maintainer Chet Ramey, which exposed an SSH key page that would have allowed pushes to upstream Bash, before an unpatched GameOver(lay) kernel bug gave them root and a key to a GNU backup server. The FSF fixed all 26 reported flaws, and forge operators should pass process arguments as arrays rather than shell strings, treat email local parts as untrusted input, and verify that LTS kernels actually receive backported fixes.

THREAT HUNTING FOR MALICIOUS IP-KVM USAGE

IP-KVM devices like PiKVM let remote operators drive a machine at the hardware layer with input indistinguishable from a local user, a tactic North Korean IT workers used to control laptop farms. Nebulock's hunt guide treated its sparse-peripheral and onboarding-timing heuristics as triage signals rather than attribution, since product strings and VID/PIDs can be spoofed. Threat hunters should search USB telemetry for known KVM vendors, then flag rare composite HID devices that also expose storage, networking, or video, and correlate hits with new-hire timing and identity anomalies before escalating to physical inspection.

PROJECT QUARRY

Project Quarry is a Python framework for detecting threats and behavior patterns in agent conversations. Write rules over messages, tool calls, tool results, and event order. You can also call a configured model adapter from a rule when local checks are not enough.

GITHUB PACKAGE FIREWALL IN PUBLIC PREVIEW

GitHub launched a package firewall in public preview for GitHub Enterprise Cloud, including data-resident deployments. It sits between coding agents, CI/CD hosts, and upstream registries, inspecting npm metadata requests and package downloads. Administrators can set cooldown periods, check GitHub Advisory Database advisories, and block attestation downgrades. Blocked packages can receive exceptions through a request workflow. The preview is free - general availability will use metered billing.

VULNERATOR AI

Vulnerator AI runs a pentest as an OODA loop: Nous Research's Hermes agent picks the next tool and runs it on a Kali container through MCP, with nmap, nuclei, ffuf, sqlmap, and Prowler on hand. Unlike most agentic pentest frameworks, it drops the orchestration core, REST API, and UI. That leaves four containers, including a headless Playwright browser for web testing and an MCP front door that lets Claude Code or other clients start, steer, and stop runs. Mistral Large 4 on OpenRouter drives the loop by default and falls back to GLM-5.3 Flash, and local Ollama inference is documented as an option.

ATTACKER IMPERSONATES AI BOTS TO SCAN ORGS FOR KEYS, CREDENTIALS

A scanner has impersonated 32 AI bots from OpenAI, Anthropic, Perplexity, Meta, and other providers since late September. It sends bursts of 50–190 requests, probes about 90 paths, and seeks passwords, API keys, cloud credentials, configuration files, and private SSH keys. On one October day, 48% of Cequence-protected organizations received the traffic. Most requests were blocked or failed.

JAPAN AIRLINES WARNS OF DATA BREACH AS COUNTRY GRAPPLES WITH MULTIPLE CYBER INCIDENTS

Japan Airlines is notifying 92K customers of a data breach exposing their data. The breach came through a third party that runs Japan Airlines' reservation, ticketing, and check-in systems. For most customers, the attackers retrieved only names, reservation codes, and flight information. However, for about 2,000 customers, they also retrieved passport numbers, frequent flyer numbers, email addresses, and phone numbers.

OPENAI SAYS IT WILL NO LONGER TRAIN ITS AI MODELS ON THE LIVE INTERNET, CITING ‘SIGNIFICANT RISKS'

After multiple instances of OpenAI models accidentally attacking unauthorized sites in tests, the frontier lab announced it will cut models' internet access during training. Previously, OpenAI employees had said this would be infeasible. However, OpenAI announced that they will create a cached and indexed version of the public internet for model training.

SOUTH KOREA'S FINANCIAL INDUSTRY HIT BY FRESH WAVE OF CYBERATTACKS

Daishin Securities has reported a breach that exposed names, email addresses, and mobile numbers for 38,490 customers.

26,400 VALID CLOUD AND AI CREDENTIALS FOUND EXPOSED IN PUBLIC GITEE REPOSITORIES

A researcher scanned 7.25 million public Gitee repositories and found 26,400 working credentials, including 9,473 Alibaba Cloud AccessKey pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, and 1,348 OpenAI keys.

POLYMARKET RESUMES TRADING AFTER $2.65 MILLION EXPLOIT, SAYS THIRD-PARTY PROVIDER WAS COMPROMISED

Polymarket lost about $2.65 million within minutes after a third-party provider was compromised, forcing the exchange into cancel-only mode before it restored trading and pledged to fully reimburse affected traders.