Intelligence Feed
showing 75 items
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
The Hacker News · Cybersecurity · src 8 · Mon, 12 Oct 2026 14:32:14 +0530 · HIGH 100
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.
The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
The Hacker News · Cybersecurity · src 8 · Mon, 12 Oct 2026 16:06:56 +0530 · HIGH 100
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.
The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 16:30:00 +0530 · HIGH 100
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.
TL;DR
During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own.
One login request let the user choose where the one-time passcode went.
The attack was the easy part. Proving it
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 18:00:42 +0530 · HIGH 100
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability.
The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 12:37:05 +0530 · HIGH 100
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.
Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.
The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 17:16:49 +0530 · HIGH 100
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation.
The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.
"A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 17:37:20 +0530 · HIGH 100
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.
An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 17:58:13 +0530 · HIGH 100
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.
The fixes are in
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
The Hacker News · Cybersecurity · src 8 · Fri, 16 Oct 2026 00:19:33 +0530 · HIGH 100
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories.
The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
The Hacker News · Cybersecurity · src 8 · Fri, 16 Oct 2026 01:54:36 +0530 · HIGH 100
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it.
The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The Hacker News · Cybersecurity · src 8 · Fri, 16 Oct 2026 12:25:55 +0530 · HIGH 100
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.
The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
BleepingComputer · Cybersecurity · src 9 · Wed, 14 Oct 2026 18:56:47 -0400 · HIGH 100
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 16:25:04 -0400 · HIGH 100
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
BeyondTrust patches zero-day exploited in attacks since August
BleepingComputer · Cybersecurity · src 9 · Fri, 16 Oct 2026 02:18:08 -0400 · HIGH 100
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
FBI Arrests Executive at Ransomware Negotiation Firm
Krebs on Security · Cybersecurity · src 10 · Sat, 10 Oct 2026 00:17:42 +0000 · HIGH 95
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity.
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Krebs on Security · Cybersecurity · src 10 · Thu, 27 Aug 2026 11:04:15 +0000 · HIGH 90
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.
In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were arrested in connection with a "sophisticated cybercrime syndica
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 12:13:08 +0530 · HIGH 88
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.
The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.
In a report published earlier
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 18:28:05 +0530 · HIGH 88
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.
There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.
A fourth lets an attacker forge a TLS session that could
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
The Hacker News · Cybersecurity · src 8 · Fri, 16 Oct 2026 10:29:36 +0530 · HIGH 88
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.
The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
The Hacker News · Cybersecurity · src 8 · Mon, 12 Oct 2026 20:46:26 +0530 · HIGH 83
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it.
But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 13:16:57 +0530 · HIGH 83
A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine.
The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 17:27:06 +0530 · HIGH 78
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next.
With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 10:04:43 +0530 · HIGH 78
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation.
These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 16:49:02 +0530 · HIGH 78
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.
Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 07:29:25 +0530 · HIGH 75
A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations.
Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 23:33:18 +0530 · HIGH 73
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it.
The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12.
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 23:08:31 +0530 · HIGH 73
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10.
A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 00:08:56 +0530 · HIGH 73
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday.
The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 23:03:11 +0530 · HIGH 68
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity.
Volexity, which reported the flaws to Ivanti,
FBI Probes Service Selling 153M+ Drivers Licenses
Krebs on Security · Cybersecurity · src 10 · Tue, 01 Sep 2026 22:40:28 +0000 · HIGH 65
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that
Data Broker Radaris Loses Domains in Privacy Fight
Krebs on Security · Cybersecurity · src 10 · Wed, 16 Sep 2026 18:14:22 +0000 · HIGH 65
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face
Police arrests 95 suspects in international CSAM crackdown action
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 07:55:38 -0400 · HIGH 64
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. [...]
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 14:14:01 +0530 · MEDIUM 48
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.
Affected
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 22:58:50 +0530 · MEDIUM 48
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 21:30:26 +0530 · MEDIUM 48
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).
The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Krebs on Security · Cybersecurity · src 10 · Mon, 28 Sep 2026 15:08:57 +0000 · MEDIUM 40
Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p.
U.K. Sanctions Cryptomus for RU Money Laundering
Krebs on Security · Cybersecurity · src 10 · Wed, 14 Oct 2026 14:22:49 +0000 · MEDIUM 40
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.
Is AI pentesting as good as a human pentester?
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 10:01:11 -0400 · MEDIUM 27
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. [...]
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The Hacker News · Cybersecurity · src 8 · Mon, 12 Oct 2026 17:25:00 +0530 · MEDIUM 26
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up.
Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
The Hacker News · Cybersecurity · src 8 · Fri, 16 Oct 2026 12:23:09 +0530 · MEDIUM 26
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15.
The agents went beyond their assigned tasks, and none of the organizations detected the unauthorized access. After internal reviews, the AI companies whose models were being tested
Microsoft Plugs Nearly 1,000 Security Holes
Krebs on Security · Cybersecurity · src 10 · Tue, 08 Sep 2026 21:44:22 +0000 · LOW 10
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fix
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
Krebs on Security · Cybersecurity · src 10 · Fri, 25 Sep 2026 21:44:40 +0000 · LOW 10
A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
Krebs on Security · Cybersecurity · src 10 · Wed, 07 Oct 2026 13:48:45 +0000 · LOW 10
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey," was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace compa
Microsoft Patches More Than 1,400 Security Flaws
Krebs on Security · Cybersecurity · src 10 · Tue, 13 Oct 2026 23:24:53 +0000 · LOW 10
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
Ledger asks sellers across Asia to halt sales after supply-chain attack
BleepingComputer · Cybersecurity · src 9 · Wed, 14 Oct 2026 13:46:50 -0400 · LOW 9
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
BleepingComputer · Cybersecurity · src 9 · Wed, 14 Oct 2026 15:41:43 -0400 · LOW 9
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]
UK Legal Aid Agency: Hackers stole records dating back to 1978
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 04:06:47 -0400 · LOW 9
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. [...]
Microsoft fixes bug causing Windows black screens, Explorer crashes
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 05:10:20 -0400 · LOW 9
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. [...]
Microsoft: Windows Server 2022 reached end of mainstream support
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 09:18:36 -0400 · LOW 9
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. [...]
Fake Arch Linux packages push malware with root privileges
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 13:12:31 -0400 · LOW 9
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 14:20:59 -0400 · LOW 9
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
Android gets AI defenses against messaging scams, fake calls
BleepingComputer · Cybersecurity · src 9 · Thu, 15 Oct 2026 15:48:43 -0400 · LOW 9
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
BAE Systems cyberattack disrupts US federal court operations
BleepingComputer · Cybersecurity · src 9 · Fri, 16 Oct 2026 03:37:35 -0400 · LOW 9
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
Microsoft: October Windows update may break Smart App Control
BleepingComputer · Cybersecurity · src 9 · Fri, 16 Oct 2026 04:44:22 -0400 · LOW 9
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
The Hacker News · Cybersecurity · src 8 · Mon, 12 Oct 2026 16:51:48 +0530 · LOW 8
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.
On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 11:30:11 +0530 · LOW 8
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.
The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.
The preinstalled
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 14:13:37 +0530 · LOW 8
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution.
"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 14:18:41 +0530 · LOW 8
Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said.
The attackers reached them through the controller that runs all of a store's fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires
Product Walkthrough: Bitdefender AI Visibility and Control
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 16:00:00 +0530 · LOW 8
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed.
A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list.
Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 16:39:10 +0530 · LOW 8
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner.
LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.
The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 18:42:32 +0530 · LOW 8
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers.
The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 21:48:18 +0530 · LOW 8
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials.
"Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
The Hacker News · Cybersecurity · src 8 · Tue, 13 Oct 2026 23:50:57 +0530 · LOW 8
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.
The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 11:22:28 +0530 · LOW 8
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over.
The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature.
The work was done in a lab as a proof of
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 16:38:22 +0530 · LOW 8
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.
Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 17:20:00 +0530 · LOW 8
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake.
The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before the weekend because a deal closes
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 17:43:36 +0530 · LOW 8
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine.
The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 22:04:31 +0530 · LOW 8
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme.
The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
The Hacker News · Cybersecurity · src 8 · Wed, 14 Oct 2026 22:39:15 +0530 · LOW 8
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System.
"Since January 2026, the threat actors behind these kits have been responsible for
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 14:15:10 +0530 · LOW 8
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.
The spike, according to GitGuardian, was observed on October 8 and 9, 2026.
"This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 16:12:16 +0530 · LOW 8
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls.
To that end, the Department of Telecommunications has issued a circular urging service
Why AI Confidence Is Not Validation
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 16:34:35 +0530 · LOW 8
AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap compounds and rarely stays contained to a workstation: an
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 17:16:59 +0530 · LOW 8
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.
The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets.
Similar attacks
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 19:41:36 +0530 · LOW 8
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777.
Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
The Hacker News · Cybersecurity · src 8 · Thu, 15 Oct 2026 21:31:57 +0530 · LOW 8
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday.
The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background.
The Citizen