Security News
Jensen Huang Confirms Affair With Alleged Chinese Spy — Board Investigates
Nvidia CEO Jensen Huang confirmed in a Sunday email to staff that he had an affair with the Chinese businesswoman identified by US intelligence as a Ministry of State Security recruit. Nvidia's board has opened an independent investigation. Huang says he was unaware of her intelligence role. The congressional testimony he has been summoned to give now carries considerably more weight.
SSHole CVE-2026-123158 Actively Exploited — SANS ISC Honeypot Data
SANS Internet Storm Center honeypot data confirms that CVE-2026-123158 (OpenSSH authentication bypass, "SSHhole") is under active exploitation in the wild. Volume of attempts has increased since the emergency patches shipped last week. SSH is foundational remote access infrastructure — patch immediately if you have not already done so.
Iris Ohyama: 7.7 Million Customers Exposed via Third-Party Cloud
Japanese retailer Iris Ohyama disclosed that ~7.7 million Iris Plaza customer records may have been exposed after unauthorised access to a third-party cloud service. The breach is in the supplier's infrastructure, not Iris Ohyama's own systems. This is the third major third-party cloud exposure in a fortnight.
CrowdStrike Announces AI Kill Switch for Rogue Agents
CrowdStrike's Falcon Guardian now includes an "AI Kill Switch" giving security teams the ability to detect and terminate rogue AI agents. A direct market response to the week's AI containment failures. Whether software-defined controls are sufficient against agents that have already demonstrated sandbox escape is the question practitioners will be testing.
Claude Code "Don't Ask Again" Leaks Credentials in 1,122 Public GitHub Repos
The .claude/settings.local.json file — written when developers approve commands with "Yes, and don't ask again" — appears in 1,122 public GitHub repositories with passwords and API keys embedded. Not a cryptographic vulnerability — a secret management hygiene failure. Audit .gitignore across repositories using Claude Code.
Python CVEs Triple, PyPI Malware Up 60%
Python security developer Seth Larson reports that CVEs in Python and pip have tripled in the past year, and malware removed from PyPI has increased 60%. Anthropic is funding a new security developer role for the Python ecosystem. Package repository supply chain attacks remain highly effective and rising.
Taiwan National Institute of Cyber Security Alleged Breach — UNC6783
Threat actor UNC6783 has claimed a data breach of Taiwan's National Institute of Cyber Security. No confirmed data volume yet. Targeting a national cyber security institution is a force-multiplier move — it is both symbolically significant and potentially operationally valuable for understanding the defender's posture.
Ransomware Activity
7 victims · 2 groups · No healthcare or UK organisations.
Deadlock — 6 victims
Fidex 🇲🇽 | NoseTea 🇺🇸 Retail | Coopebis 🇨🇷 Agriculture/Food | Trinity Custom Homes 🇺🇸 Manufacturing | Chonlatee 🇹🇭 | Kadick 🇺🇸
Barracuda — 1 victim
ADG Blatt 🇩🇪
Threat Intelligence
UNC6783 claimed access to Taiwan's National Institute of Cyber Security (above). HADES CYBER CRIME is selling multiple Indonesian government databases including General Elections Commission records, population data (Dukcapil), vaccination data, and vehicle registration (Samsat) records. Alleged breaches also at the Central Bank of Argentina, Ecuador's Ministry of Labor, and Malaysia's SWCorp government employee records. VirgoCX (Canada, Financial Services) alleged breach reported by cookiemonster112.
HIBP / NCSC / CISA KEV
No new HIBP breach additions in the last 48 hours. No new NCSC advisories. No new CISA Known Exploited Vulnerabilities.