News · The Hacker News

• 
  The Hacker News 2 h ago

  Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

  Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on
• 
  The Hacker News 2 h ago

  Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

  A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,
• 
  The Hacker News 3 h ago

  PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

  Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root
• 
  The Hacker News 6 h ago

  Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

  Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers

  CVE-2026-101767
• 
  The Hacker News 7 h ago

  Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

  A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine
• 
  The Hacker News 7 h ago

  Wazuh and AI for Enhanced SOC Workflows

  Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate
• 
  The Hacker News 8 h ago

  Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass

  Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.

  CVE-2026-104351
• 
  The Hacker News 8 h ago

  American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

  Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind. ANY.RUN's analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations
• 
  The Hacker News 11 h ago

  Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

  An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of
• 
  The Hacker News 11 h ago

  FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

  The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions
• 
  The Hacker News 12 h ago

  Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach

  Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading,
• 
  The Hacker News 12 h ago

  Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers

  Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background process carries out with root privileges. To use them, an attacker must
• 
  The Hacker News 13 h ago

  ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

  The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address

  CVE-2026-35273
• 
  The Hacker News 13 h ago

  Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in

  CVE-2026-111497
• 
  The Hacker News Tue 27 Oct

  CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

  Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published
• 
  The Hacker News Tue 27 Oct

  GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

  The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
• 
  The Hacker News Tue 27 Oct

  Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

  Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in

  CVE-2026-86950
• 
  The Hacker News Tue 27 Oct

  Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

  Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,

  CVE-2026-80097
• 
  The Hacker News Tue 27 Oct

  Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

  An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve
• 
  The Hacker News Tue 27 Oct

  AI-Generated Fake Login Pages Are Making Account Takeovers Easier

  Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain
• 
  The Hacker News Tue 27 Oct

  Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

  The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up
• 
  The Hacker News Tue 27 Oct

  Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

  A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those
• 
  The Hacker News Tue 27 Oct

  OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections

  OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past
• 
  The Hacker News Tue 27 Oct

  Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

  The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP)
• 
  The Hacker News Tue 27 Oct

  CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory

  CVE-2026-109618
• 
  The Hacker News Mon 26 Oct

  Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

  An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you
• 
  The Hacker News Mon 26 Oct

  PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

  PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but

  CVE-2026-111497
• 
  The Hacker News Mon 26 Oct

  Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

  Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT
• 
  The Hacker News Mon 26 Oct

  ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

  This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain
• 
  The Hacker News Mon 26 Oct

  Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

  Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on
• 
  The Hacker News Mon 26 Oct

  Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

  Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion
• 
  The Hacker News Mon 26 Oct

  uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

  A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor
• 
  The Hacker News Mon 26 Oct

  Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

  Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across
• 
  The Hacker News Mon 26 Oct

  Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

  An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
• 
  The Hacker News Mon 26 Oct

  Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

  A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file
• 
  The Hacker News Sun 25 Oct

  Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

  A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were
• 
  The Hacker News Sun 25 Oct

  PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

  In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application," a spokesperson for the company told The Hacker News via
• 
  The Hacker News Sun 25 Oct

  OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

  OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no
• 
  The Hacker News Sat 24 Oct

  Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

  A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory,

  CVE-2026-111497
• 
  The Hacker News Sat 24 Oct

  Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

  LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
• 
  The Hacker News Sat 24 Oct

  Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads

  Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
• 
  The Hacker News Sat 24 Oct

  Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

  Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
• 
  The Hacker News Sat 24 Oct

  CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating

  CVE-2026-110447
• 
  The Hacker News Fri 23 Oct

  BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

  Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
• 
  The Hacker News Fri 23 Oct

  Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

  Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
• 
  The Hacker News Fri 23 Oct

  Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

  Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
• 
  The Hacker News Fri 23 Oct

  Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

  Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
• 
  The Hacker News Fri 23 Oct

  PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

  PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

  CVE-2026-115560
• 
  The Hacker News Fri 23 Oct

  Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

  The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of
• 
  The Hacker News Fri 23 Oct

  Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

  Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

  CVE-2026-112900

Older