The Hacker News

⚠️ UPDATE: A tampered Ledger can leak your 24-word recovery phrase over LTE. Ledger says a hidden implant reads setup screens and transmits the phrase via eSIM—without modifying the Secure Element or OS. Affected users and losses remain unknown. Genuine Check may miss it. Read: https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

🛑 Anthropic warns small AI models may be months away from self-replicating on IoT devices, potentially forming botnets that are hard to shut down. In tests, GLM-5.2 propagated Llama 3.1-8B to all 8 nodes in 4 of 5 trials. Read: https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html

⚠️ Docker Hub's critical GhostPat flaw let users publish images under someone else's name through account conversion. The bug lasted over two years. Docker fixed it and found no evidence of exploitation. Read: https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html

‼️ Three zero-days. Root commands. No login. An attacker exploited the flaws in a fully patched Ivanti Connect Secure VPN and stole stored credentials. Ivanti confirms exploitation in the wild. Two flaws patched; a fix for the third is pending. Read: https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html

🛑 New CVSS 10.0 flaw disclosed in SAP Cloud SDK for Python (CVE-2026-89111). It allows attackers to steal OAuth2 client IDs and secrets by manipulating tenant subdomains. 🛠️ Fix: Ensure you're running v0.55.1 or newer (latest is 0.58.4). Details: https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html

⚡ GitHub tightens npm security after 1,500+ packages were found vulnerable to hijacking without stolen credentials. Attackers could claim a freed GitHub repo name tied to a trusted-publisher binding that had never published. Unvalidated bindings now expire after 48 hours. Learn more: https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html

🚨 Norway’s privacy watchdog has issued its largest-ever fine, €8.6 million, against Xandr for relaying Grindr users’ data revealing sexual orientation to advertisers without required consent. The violations predate Microsoft’s acquisition. Read: https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html

⚡ What if the login is legitimate, but the identity is compromised? AI-driven attacks can escalate privileges before defenders react. Learn how to control access beyond login in this live webinar. Register Now - https://thehackernews.com/2026/10/webinar-how-to-stop-ai-driven-privilege.html

Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. This new report brings together 10 cybersecurity companies to explore what comes next, spanning identity security, endpoint and connected device security, exposure management, telemetry, human risk intelligence, email and domain protection, and AI-native security operations. Read the full report: https://thn.news/security-threats-news Featuring: Keeper Security Cribl Automox Nisos Surf AI Adaptive Security Red Sift Asimily SentinelOne CrowdStrike

‼️ No PIN. No owner interaction. Root access. A 3-flaw chain in LG webOS can give attackers on the same local network root access to certain smart TVs. Demonstrated on two models. Read: https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html