Hackers got into Quest's lab test system

Hi there, this is your daily ☕️ Cyberpresso.

Hackers breach Quest Diagnostics lab LINK

• Quest Diagnostics said hackers broke into its Quanum Lab Services Manager, the system healthcare clients use to order lab tests and view results, and may have reached patient health and personal information.
• The company found the intrusion on October 21, 2026, suspended access to the platform, called in outside security experts, and notified federal law enforcement, but has not said how many patients or which records were affected.
• Quest said its main operations kept running and providers using direct lab interfaces or electronic medical records can still place orders; the attackers and their entry point remain unknown, and legal notifications will follow once the scope is clear.

Stolen login tokens breach 79 firms' email LINK

• Huntress found that an attacker broke into 79 organizations' Microsoft 365 accounts between July and September by replaying stolen sign-in tokens rather than guessing passwords, succeeding hundreds of times amid over 200,000 failed attempts.
• The active campaign skips passwords entirely by capturing "proof of login" tokens minted after MFA, using fake sign-in pages, device-code phishing, and relays hosted on German provider 1337 Services, then replaying the tokens from rented servers.
• To keep access, the attacker registered its own authenticator apps and at least 48 fake devices in victim directories, and Huntress advises businesses to require MFA for all users, apps, and client types through Conditional Access Policies.

Public leak exposes Linux kernel flaws LINK

• Several unpatched Linux kernel bugs were posted to public mailing lists in October, laying out technical details before fixes reached most systems, including two serious holes in the KSMBD file server.
• Both top flaws, scored 9.0, hit KSMBD and could let remote attackers run code; one stems from a network race condition, the other from an integer underflow in SMB Direct, and neither had a CVE assigned.
• No mainline fix exists yet, though a patch for the second bug sits in a branch for Linux 7.5; administrators are told to turn off unused KSMBD, limit sharing to trusted networks, and apply vendor updates once released.

Node.js flaw lets attackers run code LINK

• Node.js patched a memory bug in its Brotli decompression code, nicknamed Node2Shell, that can crash an app, leak memory, or let attackers run their own code if they feed it malformed compressed data.
• The flaw, CVE-2026-111497, is an out-of-bounds write hitting every supported Node.js line and older Bun releases; the fix is upgrading to a patched Node.js version for your release line, or rebuilding affected container images.
• No real-world attacks had been reported as of yesterday, but researchers published a proof of concept that ran code on an unmodified Node.js build in lab tests, though it failed on some attempts.

Arista patches third VeloCloud zero-day LINK

• Arista Networks has released patches for its third VeloCloud Orchestrator zero-day in four months, fixing a flaw that let remote attackers reach privileged internal functions and tamper with the management tool and its data.
• The critical SQL injection bug, tracked as CVE-2026-114625, is being actively exploited and needs only a low-privilege authenticated session, since VeloCloud Orchestrator deployments are exposed by default with no setting that can block the exposure.
• Every release before the three new fixed versions is vulnerable; Arista patched hosted setups and tells on-premises users to update now, block the two attacking IP addresses, and watch logs for suspicious requests.

Strategies & Tactics

> I Gave 14 LLMs AWS Keys. Here’s What They Wanted to Do Next: Mapping what 14 AI models propose after an AWS breach reveals predictable attacker behavior like identity checks and secret theft, letting defenders build matching detections.

> Package managers have an integrity problem - The Trail of Bits Blog: Most package managers fail to verify that downloaded code hasn't been tampered with, leaving developers open to attacks from compromised package repositories.

> How cloud-native segmentation contains lateral movement across accounts and clouds: Treat cloud account boundaries and workload identity, not just network rules, as the primary limits on how far an attacker can spread after a breach.

> Degraded-mode operations: designing a Minimum Secure Operating Capability: Decide in advance which security controls must survive an outage and who may accept the risk, so breach containment holds when systems degrade.

> Unboxing Phishing Kits: Huntress Examines 3 Real Kits: Dissecting real phishing kits shows they now steal authenticated session tokens, not just passwords, so defenders must correlate signals across identity, device, and mailbox rather than trusting completed logins.

Other news you might like

• Hackers hijack exposed AI models to launch cyberattacks at victims’ expense LINK

• Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image LINK

• Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability LINK

• Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks LINK

• Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies LINK

• Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected LINK

Trending tools

Google Gemini 3.8 Flash and Cyber: fast, low-cost models for agentic workflows, long-horizon coding, multi-step reasoning, autonomous tasks, and cybersecurity vulnerability detection. LINK

Ghostifier: scans your inbox headers to find who holds your data, then unsubscribes, opts out of sales, and sends tracked deletion requests automatically. LINK

Replay QA Security Scan: automated pentesting for web apps that detects injection flaws, broken access control, IDOR, and cross-tenant data exposure introduced by AI coding agents. LINK

chat-recall: searches your team's AI assistant conversations across six coding tools, redacting passwords locally so you can recover past work and catch leaks. LINK

Koreshield: screens customer messages, retrieved docs, and tool calls to block prompt injection, data leaks, and unsafe agent actions, with full audit logging. LINK

Strac Comply: automates compliance for SOC 2, ISO 27001, HIPAA and PCI DSS, running 100+ continuous tests across AWS, Okta, GitHub and more. LINK

Trending papers & reports

Deepfake-detector attacks craft nearly invisible image tweaks that fool detectors ~100% of the time in lab conditions but only ~7% against unseen real-world systems, showing these fakes still struggle to transfer across different detectors. LINK

Document-fed chatbot security maps 118 defense studies and shows that blocking word-for-word copying does not stop private facts from leaking, since a guard cut verbatim copying to 0% yet multi-query attacks still recovered sensitive data. LINK

Jailbreak scorecards get a new yardstick that docks attacks for every repeated probe at a chatbot, since each extra attempt is another chance for defenses to catch it, cutting some methods' success scores by up to ~12 points. LINK

Model fingerprinting reads the internal makeup of an open-weight AI model to identify its origin, letting owners prove ownership and audit reuse without running the model or crafting test prompts. LINK

Scam-bot cost traps flip the economics of automated fraud by feeding AI scam systems harmless busywork that inflates their computing bill up to ~2,500x, draining attackers' resources without ever handing over money or credentials. LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!