Security Weekly: Burger King Japan Breach, Linux VM Escape and Exploited Cisco Flaw

Summary

The episode reports Burger King Japan’s statement that 11.18 million customer records were stolen and leaked, a Linux kernel VM-to-host flaw, an exploited Cisco email-gateway flaw, and a Meta GitHub repository breach, with advice on patching and service resilience.

Key points

• Burger King Japan said 11.18 million customer records—including names, birth dates, gender, email, phone and order history—were stolen and leaked. A third-party system manages information for its official app, but the transcript does not identify it as the breach cause.
• A Linux networking flaw reportedly let code in a virtual machine read host memory; researchers said their lab exploit could gain host admin access, crash the host or run code.
• Cisco reported that a path-traversal flaw in its Secure Email Gateway was exploited in the wild. The episode says it was patched in September and added to CISA’s Known Exploited Vulnerabilities catalog on October 14.
• Attackers accessed some GitHub repositories used by Meta, exposing mostly software code and a small amount of personal information; Meta notified about 1,500 people, mostly US employees.
• The episode says Microsoft announced Defender endpoint support for Linux and issued updates covering more than 1,400 security vulnerabilities, including at least one zero-day; Windows 10 patches were extended through October 2027.
• The host reports FBI arrests of American facilitators linked to North Korean laptop farms, including 40 farms targeted in Texas, and warns that seemingly easy remote-work offers can involve criminal exposure.
• The host recommends reviewing third-party access, repository contents and dependencies, preparing to patch quickly, and planning alternatives for critical service outages or cutoffs.

Vendors

Products

Related Articles

• Anthropic Says Unreleased AI Model Chained Flaws Into Working Exploitsthehackernews.comLinux
• Two CVSS 9.0 KSMBD Remote Code Execution Flaws Reported Before Kernel Fixesthehackernews.comLinux
• Europol IOCTA 2026 Warns AI and Anonymised Infrastructure Are Scaling Cybercrimegithub.com/jacobdjwilsonLinux
• ESET H1 2026 Threat Report Finds Rising ClickFix, QR Phishing and Malicious AI Skillsgithub.com/jacobdjwilsonLinux
• CrowdStrike 2026 Threat Hunting Report Highlights Faster Exploitation and Rising Identity Attacksgithub.com/jacobdjwilsonLinux