|
🩺 Hackers breach Quest Diagnostics lab
LINK
|
- Quest Diagnostics said hackers broke into its Quanum Lab Services Manager, the system healthcare clients use to order lab tests and view results, and may have reached patient health and personal information.
- The company found the intrusion on October 21, 2026, suspended access to the platform, called in outside security experts, and notified federal law enforcement, but has not said how many patients or which records were affected.
- Quest said its main operations kept running and providers using direct lab interfaces or electronic medical records can still place orders; the attackers and their entry point remain unknown, and legal notifications will follow once the scope is clear.
|
📧 Stolen login tokens breach 79 firms' email
LINK
|
- Huntress found that an attacker broke into 79 organizations' Microsoft 365 accounts between July and September by replaying stolen sign-in tokens rather than guessing passwords, succeeding hundreds of times amid over 200,000 failed attempts.
- The active campaign skips passwords entirely by capturing "proof of login" tokens minted after MFA, using fake sign-in pages, device-code phishing, and relays hosted on German provider 1337 Services, then replaying the tokens from rented servers.
- To keep access, the attacker registered its own authenticator apps and at least 48 fake devices in victim directories, and Huntress advises businesses to require MFA for all users, apps, and client types through Conditional Access Policies.
|
🐧 Public leak exposes Linux kernel flaws
LINK
|
- Several unpatched Linux kernel bugs were posted to public mailing lists in October, laying out technical details before fixes reached most systems, including two serious holes in the KSMBD file server.
- Both top flaws, scored 9.0, hit KSMBD and could let remote attackers run code; one stems from a network race condition, the other from an integer underflow in SMB Direct, and neither had a CVE assigned.
- No mainline fix exists yet, though a patch for the second bug sits in a branch for Linux 7.5; administrators are told to turn off unused KSMBD, limit sharing to trusted networks, and apply vendor updates once released.
|
💻 Node.js flaw lets attackers run code
LINK
|
- Node.js patched a memory bug in its Brotli decompression code, nicknamed Node2Shell, that can crash an app, leak memory, or let attackers run their own code if they feed it malformed compressed data.
- The flaw, CVE-2026-111497, is an out-of-bounds write hitting every supported Node.js line and older Bun releases; the fix is upgrading to a patched Node.js version for your release line, or rebuilding affected container images.
- No real-world attacks had been reported as of yesterday, but researchers published a proof of concept that ran code on an unmodified Node.js build in lab tests, though it failed on some attempts.
|
🔓 Arista patches third VeloCloud zero-day
LINK
|
- Arista Networks has released patches for its third VeloCloud Orchestrator zero-day in four months, fixing a flaw that let remote attackers reach privileged internal functions and tamper with the management tool and its data.
- The critical SQL injection bug, tracked as CVE-2026-114625, is being actively exploited and needs only a low-privilege authenticated session, since VeloCloud Orchestrator deployments are exposed by default with no setting that can block the exposure.
- Every release before the three new fixed versions is vulnerable; Arista patched hosted setups and tells on-premises users to update now, block the two attacking IP addresses, and watch logs for suspicious requests.
|
|
