The Hacker News
Most trusted, widely-read independent cybersecurity news source for everyone; supported by hackers and IT professionals — Send TIPs to admin@thehackernews.com
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A research...
Posted on 15 October 2026 | 8:24 pm
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in w...
Posted on 15 October 2026 | 6:49 pm
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks t...
Posted on 15 October 2026 | 4:01 pm
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of I...
Posted on 15 October 2026 | 4:00 pm
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a re...
Posted on 15 October 2026 | 2:11 pm
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.
There ar...
Posted on 15 October 2026 | 12:58 pm
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along w...
Posted on 15 October 2026 | 12:28 pm
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October ...
Posted on 15 October 2026 | 12:07 pm
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,2...
Posted on 15 October 2026 | 11:46 am
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
The v...
Posted on 15 October 2026 | 11:46 am
Why AI Confidence Is Not Validation
AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools a...
Posted on 15 October 2026 | 11:04 am
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with thei...
Posted on 15 October 2026 | 10:42 am
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.
Th...
Posted on 15 October 2026 | 8:45 am
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Langflow is an open-source platform that ...
Posted on 15 October 2026 | 7:07 am
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop...
Posted on 15 October 2026 | 6:43 am
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating sy...
Posted on 14 October 2026 | 6:38 pm
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three a...
Posted on 14 October 2026 | 5:38 pm
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cl...
Posted on 14 October 2026 | 5:09 pm
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to ...
Posted on 14 October 2026 | 4:34 pm
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Co...
Posted on 14 October 2026 | 12:30 pm
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported ...
Posted on 14 October 2026 | 12:13 pm
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security team...
Posted on 14 October 2026 | 11:50 am
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user ...
Posted on 14 October 2026 | 11:19 am
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with...
Posted on 14 October 2026 | 11:08 am
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.
TL;DR
During an aut...
Posted on 14 October 2026 | 11:00 am
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions....
Posted on 14 October 2026 | 7:46 am
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is t...
Posted on 14 October 2026 | 5:52 am
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said ha...
Posted on 14 October 2026 | 4:34 am
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room
A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the c...
Posted on 14 October 2026 | 1:59 am
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off...
Posted on 13 October 2026 | 6:20 pm
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. ...
Posted on 13 October 2026 | 6:03 pm
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volex...
Posted on 13 October 2026 | 5:33 pm
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security a...
Posted on 13 October 2026 | 5:28 pm
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was...
Posted on 13 October 2026 | 4:18 pm
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally r...
Posted on 13 October 2026 | 1:12 pm
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next.
With AI accelerating r...
Posted on 13 October 2026 | 11:57 am
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or ...
Posted on 13 October 2026 | 11:09 am
Product Walkthrough: Bitdefender AI Visibility and Control
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed.
A developer adds a coding assistant as an editor extensio...
Posted on 13 October 2026 | 10:30 am
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores...
Posted on 13 October 2026 | 8:48 am
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take ad...
Posted on 13 October 2026 | 8:44 am
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that cou...
Posted on 13 October 2026 | 8:43 am
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps...
Posted on 13 October 2026 | 6:00 am
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. ...
Posted on 12 October 2026 | 3:16 pm
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot wh...
Posted on 12 October 2026 | 11:55 am
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devic...
Posted on 12 October 2026 | 11:21 am
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances wit...
Posted on 12 October 2026 | 10:36 am
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchs...
Posted on 12 October 2026 | 9:02 am
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPres...
Posted on 12 October 2026 | 7:26 am
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
"Compared wi...
Posted on 11 October 2026 | 4:24 am
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind ...
Posted on 10 October 2026 | 11:00 am