Japan's Biggest Taxi Company Just Got Hacked

Nihon Kotsu, Japan's largest taxi and chauffeur operator, confirmed over the weekend that attackers broke into its internal systems, according to Bleeping Computer. The company operates 8,558 taxis and over 2,000 chauffeur vehicles, employs more than 18,000 people, and pulls in roughly $1 billion in annual revenue. It is, in short, not a small target.

The attackers got in through malware infection. Nihon Kotsu detected the intrusion and pulled the plug on affected systems to stop further spread — the digital equivalent of slamming every door shut and hoping the fire stays contained. As a result, the taxi dispatch system, web bookings, reservation management, and telephone services all went offline and remain unavailable.

One detail worth noting: the company's specialised taxi service for pregnant women approaching their due date is suspended across Tokyo and several surrounding cities. That is not an abstract inconvenience.

No ransomware group has claimed responsibility yet, and no confirmed data leak has been reported, though the company is actively investigating. External cybersecurity experts have been brought in.

If you use Nihon Kotsu services, the company recommends the GO taxi app as an alternative for now. More importantly: if you receive any email or message appearing to come from Nihon Kotsu, do not open attachments or click links. Attackers frequently impersonate victims immediately after a breach.

Researchers have demonstrated an attack that plants false information inside an AI agent's long-term memory using nothing but a single crafted email, according to The Hacker News. The technique, called stealth memory injection, targets personal AI agents — tools like OpenClaw that persist information about you between sessions, reading notes about your preferences and history at the start of every conversation.

The attacker sends an email to someone whose agent monitors their inbox. Hidden inside is an instruction aimed at the agent, not the human. The agent quietly writes a false "fact" into its memory files, says nothing about it in the visible reply, and then acts on that false fact in every future session.

The tool behind these attacks, named MemGhost, succeeded in 87.5% of test runs. One demonstrated payload told the agent the user's daily bank transfer limit had been raised to $10,000.

If you use an AI assistant with memory and inbox access, review its stored memory files directly and audit what it actually knows about you.

What Balbooa Forms is: A drag-and-drop form builder for Joomla websites that lets site owners create contact forms with file upload functionality.

What it is: The plugin fails to restrict which file types users can upload. An attacker can submit a PHP script through the form's upload feature and trigger it to run on the server, achieving RCE (remote code execution — the ability to run arbitrary commands on a machine they don't own).

Who's at risk: Any Joomla site running Balbooa Forms below version 2.4.1. CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog, meaning active exploitation is confirmed in the wild, according to Bleeping Computer.

CVSS: Not yet scored — treat as Critical. CISA ordered federal agencies to patch within three days.

Root cause: The upload feature lacks validation on file type. Think of it as a secure post box with a slot wide enough to fit a crowbar — the opening exists for legitimate use, but nothing checks what comes through it.

Attack vector: An attacker visits a Joomla site running the vulnerable plugin, submits a PHP file through the public-facing upload form, then navigates directly to that file's URL on the server to execute it. This worked as a zero-day from July 8, one day before a patch was released.

Recommended actions:

1. Update Balbooa Forms to version 2.4.1 immediately.
2. Audit your server for unexpected PHP files in upload directories.
3. If you cannot patch immediately, disable file upload functionality in the plugin settings.

Starting September 1, 2026, Microsoft will begin making passkeys the default sign-in method for Microsoft Entra ID (the identity system used by Microsoft 365 and most corporate Microsoft accounts), according to Help Net Security.

A passkey is a login credential stored on your device — your phone or laptop — that uses biometrics or a PIN instead of a password. It cannot be phished, because there is nothing to hand over to a fake website.

If your organisation uses SMS codes for multi-factor authentication (MFA), you will be prompted to set up a passkey the next time you log in. By February 2027, SMS-based MFA will no longer be accepted without registering a passkey first.

You do not need to do anything right now — Microsoft will prompt you. But when that prompt appears, accept it. Passkeys are meaningfully more secure than SMS codes, which can be intercepted.

The EU and UK jointly sanctioned dozens of Russian individuals and entities this week, citing coordinated cyberattacks against European critical infrastructure, government networks, and public services, according to Help Net Security. The EU called it its largest-ever cyber sanctions package. The UK separately sanctioned individuals linked to Lumma Stealer — credential-theft malware with at least 2,100 confirmed UK victims in the last six months. For everyday users, the practical note is this: credential theft is an active, state-linked operation, not just opportunistic crime.