Integrity Tech Advisory, iRhythm's 360K-Record Breach, and an Exploited NVIDIA GPU Flaw

Security leaders should know that CISA, the FBI, NSA and international partners issued a joint advisory on China-based Integrity Technology Group enabling Flax Typhoon-linked attacks on critical infrastructure, while medical device maker iRhythm disclosed a breach affecting at least 360,000 patients. Other items cover an exploited NVIDIA monitoring flaw, exposed European renewable-energy control systems, new PCI payment-AI guidance, and a notable security leadership change at Lumen.

CISA, FBI, NSA Warn China-Based Integrity Tech Enables Flax Typhoon Attacks

CISA, the FBI, NSA and international partners from the UK, Australia, Canada, Japan, New Zealand and Spain issued a joint advisory on October 8 warning that Integrity Technology Group, a China-based company with ties to the Chinese government, enables threat actors tracked as Flax Typhoon, Ethereal Panda and Red Juliett. The group combines large-scale botnets, VPN infrastructure and living-off-the-land techniques to target government, critical manufacturing, healthcare and IT organizations worldwide, exploiting eight listed CVEs, scanning tools, cross-site scripting and password spraying against Microsoft Exchange servers. Defenders are urged to disable unused services, sanitize web inputs and enforce MFA. (CISA)

FBI Seizes Domains Behind Flax Typhoon's Microscan and FishHub Tools

The FBI announced on October 9 that it had seized seven domains used to run Microscan and FishHub, hacking tools built by Integrity Technology Group for China-linked Flax Typhoon actors. Microscan scanned victims including a South Carolina power company, airports in Japan and Poland, and Taiwanese gas, power and university networks between 2022 and 2023, while FishHub delivered malware via spear phishing to roughly 20 Taiwanese universities. Officials called it the department's second disruption of Integrity Tech's infrastructure in two years, following a 2024 takedown of a 200,000-device Mirai botnet linked to the same company. (Help Net Security)

High-Severity NVIDIA DCGM Exporter Flaw Exposes Thousands of GPU Servers

Researchers at Lava found more than 2,000 internet-exposed servers running NVIDIA's DCGM Exporter monitoring tool, collectively reporting over 12,000 GPUs worth an estimated $100 million, none of which required authentication. The high-severity flaw, CVE-2026-47483, rated 8.2 on CVSS and patched by NVIDIA on July 28, 2026, lets unauthenticated attackers flood debug endpoints to exhaust memory, crashing GPU monitoring and potentially disrupting AI training or inference. Exposed hardware included Blackwell Ultra, H200 and H100 chips across nearly 300 organizations, with the US hosting 44% of affected GPUs. Administrators should upgrade to version 4.8.2 or later and disable unneeded profiling endpoints. (Help Net Security)

iRhythm Discloses Breach Affecting at Least 360,000 Patients

Medical device maker iRhythm began filing breach notices this week saying unauthorized access to third-party-hosted business applications between June 3 and June 8 exposed data on at least 360,000 people, including 298,647 in Texas and 69,526 in South Carolina. Stolen information included names, addresses, phone numbers, device serial numbers, insurance numbers and dates of service. The company's June 8-K filing with the SEC said a threat actor demanded payment to avoid disclosing exfiltrated data, though iRhythm says clinical systems, devices and manufacturing were unaffected and it has no evidence the data has been used for identity theft. (The Record from Recorded Future News)

PCI SSC Guidance Requires Human Sign-Off for AI Agents Touching Card Data

The PCI Security Standards Council published new guidance, Security Considerations for AI Systems, covering governance, access controls and testing for AI used in payment environments. It recommends a least-agency approach limiting each AI system's permissions to assigned tasks, an AI inventory tracking models and data use, and mandatory human sign-off before an agent takes any action involving cleartext cardholder data. The council also calls for isolating credentials from AI systems, encrypting or tokenizing payment data, and assessing external AI providers under existing third-party service provider requirements. The recommendations are advisory and don't override existing PCI DSS requirements. (Help Net Security)

Lumen Names Former Cox CISO Kim Keever as Chief Security Officer

Lumen Technologies named Kim Keever as Chief Security Officer, moving her from a CISO role she held at Cox Communications for more than a decade. At Lumen she will oversee security strategy across physical, digital and operational assets as the company expands network-as-a-service offerings and prepares its infrastructure for growing AI-driven demand. Before Cox, Keever held security leadership roles at The Coca-Cola Company, including CISO of its Bottling Investments Group. The appointment places a long-tenured telecom security executive in charge of protecting critical network infrastructure during a period of rapid AI-related expansion. (National CIO Review)

8,547 Wind and Solar Systems Found Exposed Across Europe

A joint study by Modat and NCSC-NL, the Dutch national cybersecurity center, identified 8,547 internet-facing systems at wind and solar sites across 35 countries that should not be reachable online, including turbine control pages with exposed Start, Stop and Reset buttons. Spain, Greece, Italy and Germany account for roughly three-quarters of confirmed solar exposures, while Germany and Italy dominate wind. Researchers found default credentials, exposed PLCs and site-identifying map data on some dashboards. NIS2 makes management bodies liable for these systems, and researchers urged operators to pull admin interfaces offline immediately and verify every remote command's origin. (Help Net Security)