The Hacker News
Most trusted, widely-read independent cybersecurity news source for everyone; supported by hackers and IT professionals — Send TIPs to admin@thehackernews.com
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and...
Posted on 24 October 2026 | 11:09 am
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allow...
Posted on 24 October 2026 | 11:03 am
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow th...
Posted on 24 October 2026 | 10:36 am
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch...
Posted on 24 October 2026 | 9:04 am
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Serve...
Posted on 24 October 2026 | 6:25 am
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called Blac...
Posted on 23 October 2026 | 6:50 pm
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs l...
Posted on 23 October 2026 | 5:54 pm
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen...
Posted on 23 October 2026 | 5:50 pm
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGat...
Posted on 23 October 2026 | 1:50 pm
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaw...
Posted on 23 October 2026 | 11:25 am
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukraini...
Posted on 23 October 2026 | 11:11 am
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it...
Posted on 23 October 2026 | 9:36 am
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demo...
Posted on 23 October 2026 | 8:40 am
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it,...
Posted on 23 October 2026 | 8:35 am
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a...
Posted on 23 October 2026 | 7:40 am
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your ...
Posted on 22 October 2026 | 7:05 pm
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN...
Posted on 22 October 2026 | 7:05 pm
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decis...
Posted on 22 October 2026 | 6:12 pm
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificate...
Posted on 22 October 2026 | 5:45 pm
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend ...
Posted on 22 October 2026 | 5:01 pm
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang...
Posted on 22 October 2026 | 4:12 pm
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 milli...
Posted on 22 October 2026 | 1:38 pm
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variab...
Posted on 22 October 2026 | 11:15 am
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the deve...
Posted on 22 October 2026 | 10:44 am
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python pa...
Posted on 22 October 2026 | 8:28 am
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a ...
Posted on 22 October 2026 | 7:47 am
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing workin...
Posted on 22 October 2026 | 6:38 am
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to ...
Posted on 22 October 2026 | 6:34 am
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWis...
Posted on 22 October 2026 | 4:21 am
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every ver...
Posted on 21 October 2026 | 6:57 pm
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoo...
Posted on 21 October 2026 | 6:01 pm
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while maki...
Posted on 21 October 2026 | 4:33 pm
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web ser...
Posted on 21 October 2026 | 2:00 pm
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection...
Posted on 21 October 2026 | 1:15 pm
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been...
Posted on 21 October 2026 | 12:05 pm
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and ...
Posted on 21 October 2026 | 11:53 am
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is n...
Posted on 21 October 2026 | 10:36 am
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. ...
Posted on 21 October 2026 | 10:32 am
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login pass...
Posted on 21 October 2026 | 10:30 am
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed ve...
Posted on 21 October 2026 | 9:05 am
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, U...
Posted on 21 October 2026 | 9:01 am
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or serv...
Posted on 21 October 2026 | 8:04 am
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark w...
Posted on 21 October 2026 | 7:44 am
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV)...
Posted on 21 October 2026 | 7:26 am
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.
According to a report published...
Posted on 21 October 2026 | 6:05 am
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program co...
Posted on 20 October 2026 | 5:09 pm
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM...
Posted on 20 October 2026 | 3:38 pm
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by...
Posted on 20 October 2026 | 3:32 pm
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher w...
Posted on 20 October 2026 | 2:07 pm
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with ...
Posted on 20 October 2026 | 12:59 pm