🇯🇵 KDDI Breach 14.2M, 🎾 Kinahan Cartel Padel, 🐧 Linux Kernel PoCs

KDDI's disclosure of up to 14.2 million exposed email logins across six Japanese ISPs is the day's defining story. KDDI breach stemmed from a vulnerability in an unnamed third-party component, and KDDI has not said how many passwords were stored in plaintext or which hashing was used. The blast radius is credential reuse; affected customers should reset email passwords and enable two-factor authentication immediately.

Public exploits now exist for two Linux kernel privilege escalation flaws. CVE-2026-46331 (pedit-cow) corrupts shared page-cache memory through the act_pedit subsystem and had a working exploit within 24 hours of assignment; CVE-2026-43503 (DirtyClone) abuses skbuff shared-fragment handling. Linux kernel LPE PoCs affect every distribution lacking the complete DirtyFrag patch chain; blacklist act_pedit or disable unprivileged user namespaces where feasible.

Bellingcat identified a sanctioned Kinahan cartel lieutenant competing openly in Dubai padel tournaments, the first public photos in nearly a decade, as three of seven sanctioned figures have now been arrested.

Watchlist: kernel patch status across RHEL, Debian, and Ubuntu fleets, KDDI-linked account resets, and credential-stuffing defenses on email and financial accounts.