Times Car confirms data breach affecting 6.6 million user accounts

🕵️ RESEARCH & DEEP DIVES

• Japan railway operator Keio confirms ransomware attack disrupted business systems
  Japanese railway operator Keio was hit by a ransomware attack that disrupted its hotel business systems.

  • Keio Corporation is a major Japanese private railway operator with 69 stations and 85 km of track, plus a hospitality arm of 25 hotels and over 2,200 employees.
  • Ransomware hit the group's servers in the early hours of September 26, 2026, disrupting business systems including payment systems; train operations appear unaffected.
  • The disruption affects the hospitality side, with Keio Plaza Hotel Tokyo warning of delays on some customer-facing services.
  • Keio shut down its network to contain the damage, reported the incident to police, and is investigating the attack route with external experts, including whether customer or business partner data was accessed.
  • No ransomware group has claimed the attack; separately, Tokyo Metro disclosed unauthorized access exposing 59,000 member email addresses, though it is unclear if the incidents are linked.
  Sources 📄 Source: keio.co.jp · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• Times Car confirms data breach affecting 6.6 million user accounts
  Japanese car-sharing service Times Car confirmed a cyberattack compromised data of about 6.6 million current and former members.

  • Affects 6.6 million current and former Times Car members, plus current and former members of the Times Business Service corporate account program
  • Exposed data includes names, addresses, birth dates, phone numbers, emails, driver's license info and ID document images, passwords, and linked service IDs
  • Passwords were stored in a form that cannot be restored (encrypted or hashed); credit card information was unaffected
  • A third party accessed systems at the beginning of September; unauthorized access was blocked on September 26 and the breach was disclosed on September 25
  • No evidence the stolen data has been distributed online; a forensic investigation with an external expert is underway
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• Carbonato Botnet Deploys AI Agent on Exposed Docker Hosts to Steal AI API Keys
  ThreatDown discovered a botnet called Carbonato that compromises unauthenticated Docker daemons and installs an AI agent that steals AI API keys.

  • Targets servers running unauthenticated Docker daemons exposed on port 2375
  • Installs an AI agent built on the open source Hermes Agent framework from Nous Research, driven by a 39-line prompt
  • Agent executes commands from an attacker-controlled Telegram chat and prioritizes stealing AI API keys over access tokens, SSH keys, and databases
  • Establishes persistence via an SSH reverse tunnel and spreads to other reachable Docker hosts with conventional scripts
  • ThreatDown found 59 repositories, 234 image tags, 605 blobs, and 4.3 GB of image data on an attacker-controlled registry exposed since May; clues suggest operators may be based in Costa Rica
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• Hackers Use NeedyMantis Malware to Maintain Long-Term Access in Breached Networks
  Microsoft has identified a malware family called NeedyMantis used to maintain long-term access in targeted breaches.

  • Targets include telecom organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors, with activity dating back to at least October 2025.
  • NeedyMantis uses DLL sideloading via legitimate apps like Poedit, curl, Vim, and TightVNC, posing as DLLs from Microsoft Office, Broadcom, Intel, and NVIDIA.
  • The loader unpacks stages from an encrypted archive; the main component communicates with C2 over HTTPS then WebSocket (domain: corp.tripswithengine[.]com, user agent firefox/21.0).
  • One group using it is Storm-3069 (Microsoft-tracked, tied to the DAEMON Tools supply chain attack), assessed to originate in China, though attribution is unconfirmed.
  • Published IOCs include SHA-256 hashes (e.g., e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e for WinSparkle.dll loader) and file paths like %ProgramFiles%\Poedit\WinSparkle.dll.
  Sources 📎 Coverage: thehackernews.com · 👁 via The Hacker News

• Laravel debug pages XSS via Tippy.js tooltips fixed in 12.69.0 and 13.30.0
  Laravel fixed a DOM-based XSS in exception debug pages (CVE-2026-102279) affecting versions prior to 12.69.0 and 13.30.0.

  • Affects Laravel applications running versions prior to 12.69.0 (12.x) or 13.30.0 (13.x) with APP_DEBUG=true.
  • Attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based cross-site scripting.
  • The XSS triggers when a user hovers over the tooltip on an exception debug page; CVSS 3.1 score 3.1 (CWE-80).
  • Fixed in Laravel framework releases 12.69.0 and 13.30.0.
  Sources 📎 Coverage: github.com · 👁 via CVE ThreatInt

📰 RESEARCH & DEEP DIVES

• Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks — The Hacker News

• brace-expansion: DoS via uncontrolled recursion on nested brace groups causin... — CVE ThreatInt

• Flatpak: flatpak: denial of service via unsanitized keys in exported desktop ... — CVE ThreatInt

• Flatpak: flatpak: world-writable temporary child repositories in system-helpe... — CVE ThreatInt

• Flatpak: flatpak: world-readable oci authentication token in system-helper ca... — CVE ThreatInt

• brace-expansion: Quadratic-time expansion of the \{a\},b\} rewrite causes CPU ... — CVE ThreatInt

• brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing st... — CVE ThreatInt

• PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerP... — CVE ThreatInt

• VxWorks 7 Memory allocationIn Wind River VxWorks 7 prior to 26.09, specific s... — CVE ThreatInt

• PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity ... — CVE ThreatInt

• Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command... — CVE ThreatInt

• In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::termi... — CVE ThreatInt

• In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::on... — CVE ThreatInt

• In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSes... — CVE ThreatInt

• PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetPyJWT is a Python... — CVE ThreatInt

• PyJWT accepts public JWK containers as HMAC secretsPyJWT is a Python implemen... — CVE ThreatInt

• PyJWT BOM BypassPyJWT is a Python implementation of JSON Web Token standards.... — CVE ThreatInt

• PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CV... — CVE ThreatInt

• Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAu... — CVE ThreatInt

• PyJWT: ReDoS vulnerability when calling the is_pem_format function.PyJWT is... — CVE ThreatInt

• Your SBOM Is Fan Fiction — r/netsec

• Three OrdaSoft Joomla Extensions Have Unauthenticated SQL Injections in Their Sort Order — mysites.guru (discovered)

• Threat groups ramp up social-engineering attacks against healthcare sector — r/cybersecurity

• •