163 000подписчиков сейчас
Публикации всего: 525
Even the “secure” padlock had trust issues this week.
→ Helpdesk 0-days
→ Rogue HTTPS certs
→ ShinyHunters arrest
→ iPhone keychain theft
→ Atlassian exploits
→ AI-fooling malware
→ 3 new malware loaders
→ Exposed GPU servers
→ Ransomware surge
→ AI disinfo operations
→ Dark web hijacks
This week's cybersecurity recap ↓ https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html
👍 4 🔥 3 😱 2
Перейти к публикации →
Building AI agents isn't the hard part anymore. Securing and governing them is. 🔐
At Aktonomy Fall '26, hear from CISOs and security leaders on AI agent identity, governance, and security controls, with practical insights for securing AI in production.
📅 October 27 · 8:30 AM PT · 🌐 Virtual
20+ speakers · 8+ hours of insights
👇 Register now and save your spot: https://thn.news/aktonomy-fall-2026
Your employees’ personal AI agents can access work apps without showing up in your managed-agent console.
OAuth grants, saved passwords, and API tokens give them ways in, often without an IT ticket.
How can security teams control agents they can't see?
Read → https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html
‼️ Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet.
Amid reports of stolen funds, it paused reseller sales and warned buyers from the past 90 days: don't set up unused devices; consider moving assets from initialized ones.
https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html
😁 10 👍 4
Перейти к публикации →
🚨 SonicWall released patches. Two days later, exploitation attempts began.
A critical pre-auth SSRF flaw in SMA 1000 (CVE-2026-102255, CVSS 10.0) has drawn 135 exploitation attempts from just two U.S. IP addresses.
https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html
👍 6 🔥 1
Перейти к публикации →
⚠️ No login required. CVSS 10.0. Active exploitation.
Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.
Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.
Read - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html
🔥 6 👍 4 😁 2 · всего 14
Перейти к публикации →
🚨 51 Claude Code agents. 429 WordPress admin panels accessed. 32 web shells deployed in just 61 seconds.
SOCRadar links the campaign to CyberXero, which also stole over 628,000 records from four Ukrainian organizations.
Read: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html
😱 7 🔥 5 👍 4 · всего 17
Перейти к публикации →
Nearly 1,000 of roughly 1,280 third-party products embedding AI were not behind SSO in environments studied for a 2026 report.
The blind spot: AI agents can enter through existing enterprise software without a separate security review.
Here's what security teams need to know → https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html
🔥 7 ⚡ 3 😁 2 · всего 14
Перейти к публикации →
🛑 During internal tests, Claude Mythos Preview exploited injection flaws to run commands on a university server. Claude Haiku 4.5 sent a false homicide tip to Philadelphia police.
Anthropic is cutting live internet access for all internal evaluations.
Read: https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html
👍 12 😁 11 🤯 6 · всего 35
Перейти к публикации →
🚨 More than 500 GitHub accounts committed credential-stealing Actions workflows to tens of thousands of repositories.
Disguised as security audits, the malicious workflows harvest AWS keys, API tokens, and secrets from Git history.
Read: https://thehackernews.com/2026/10/credential-stealing-github-actions.html
🔥 10 🤯 6 😱 5 · всего 23
Перейти к публикации →