thehackernews.comLatest posts from the site’s own blog

Found via its RSS feed · checked 17 Oct 2026Feed ↗

Checking for new posts…

17 Oct 2026MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addonthehackernews.com blogCybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded…Read ↗
17 Oct 2026Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenantsthehackernews.com blogCybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud…Read ↗
16 Oct 2026Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bugthehackernews.com blogA local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address…Read ↗
16 Oct 2026Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoorthehackernews.com blogAttackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of…Read ↗
16 Oct 2026UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishingthehackernews.com blogCybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct…Read ↗
16 Oct 2026OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contractthehackernews.com blogOpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an…Read ↗
16 Oct 2026AI Decision Models and Their Impact on AI SOC Platformsthehackernews.com blogIn the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive…Read ↗
16 Oct 2026China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Serversthehackernews.com blogThe China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a…Read ↗
16 Oct 2026CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testingthehackernews.com blogAI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15.…Read ↗
16 Oct 2026PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessionsthehackernews.com blogA suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack…Read ↗
15 Oct 2026Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memorythehackernews.com blogA newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud…Read ↗
15 Oct 2026ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 Morethehackernews.com blogSomeone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets…Read ↗
15 Oct 2026Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Adsthehackernews.com blogCandiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user…Read ↗
15 Oct 2026Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacksthehackernews.com blogThe threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from…Read ↗
15 Oct 2026Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scamsthehackernews.com blogA long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed…Read ↗
15 Oct 2026NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checksthehackernews.com blogNGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind…Read ↗
15 Oct 2026Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processingthehackernews.com blogNext.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One…Read ↗
15 Oct 2026Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modulesthehackernews.com blogDrupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An…Read ↗
15 Oct 2026Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Earlythehackernews.com blogAttackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns…Read ↗
15 Oct 2026Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitationthehackernews.com blogPalo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score…Read ↗

Titles and short excerpts from the site's public feed; each post opens on thehackernews.com.