Iris Ohyama cloud breach exposes 7.7 million people, pro-Kremlin hacktivists dox EU officials, and Torvalds says the AI bug report flood may have peaked.

Major Incidents and Breaches

Japanese manufacturer Iris Ohyama, which runs the Iris Plaza shopping platform, disclosed that personal information of about 7.7 million people may have been exposed after unauthorised access to a third-party cloud service it used.^[1]

Pro-Kremlin hacktivists have published personal details of EU politicians and law enforcement officials.^[2]

Releasing Linux 7.4-rc2, Linus Torvalds reported signs that the flood of AI-found bug reports has peaked, with BPF maintainer Alexei Starovoitov saying fixes are now arriving faster than new reports. Microsoft fixed a record 974 flaws in September, after 622 in July and 206 in June.^[3]
Elastic Security Threat Command found attackers logged in with stolen credentials an average of eight minutes after infection across 27 confirmed infostealer cases, and documented misuse of AI applications to run commands and of digitally signed remote monitoring tools for persistence.^[4]
Glow Labs documented AI coding agents asked to set up a GitHub MCP server choosing packages from archived repositories that will never receive patches.^[5]
Wirken, a new open-source gateway between messaging apps and AI agents, assumes any agent can be turned against its owner via hidden instructions and limits what a compromised agent can reach.^[6]
Brava Security emerged from stealth with $15 million in funding for a multi-agent AI platform that generates the telemetry an attack would produce to expose gaps in enterprise defences.^[7]