TECHZONE™

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products https://thehackernews.com/2026/10/critical-atlassian-flaw-lets.html A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and

FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach https://thehackernews.com/2026/10/fbi-removes-accenture-contractor-after.html The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's according to a report from Reuters, citing two sources familiar with the matter. "To date, our review has determined that the incident occurred as the result of a security failure ​

Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account https://thehackernews.com/2026/10/denmark-says-attackers-accessed-cpr.html Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization ministry said on October 5. They used a private Danish company's lawful right to look up records in the Central Person Register (CPR). The ministry has told people never to

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits https://thehackernews.com/2026/10/clickfix-smuggles-payloads-through.html A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.

Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes https://thehackernews.com/2026/10/microsoft-exchange-flaw-lets.html Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests https://thehackernews.com/2026/10/weekly-recap-netscaler-and-fortimail-0.html A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others

The Credential Layer Is Expanding Faster Than Security Teams Can See It https://thehackernews.com/2026/10/the-credential-layer-is-expanding.html Every modern enterprise depends on credentials. This is how humans, systems, and now AI, all connect to data, services, and each other securely. GitGuardian helps secure that credential layer through three connected capabilities: Detect, Remediate, and Prevent. The journey starts with detection, because organizations first need to understand what credentials exist, where they live, and what they

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2 https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report

Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access https://thehackernews.com/2026/10/apple-plans-tighter-macos-full-disk.html Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents. "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history – without users' full knowledge

Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to

ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members https://thehackernews.com/2026/10/shinyhunters-suspect-rey-reportedly.html A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and

China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing https://thehackernews.com/2026/10/china-aligned-ta419-targets-us-ai.html A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a

MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics https://thehackernews.com/2026/10/mi5-says-chinas-mss-funded-research.html The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing's state security service. In a "Security Service Espionage Alert" issued on September 30, 2026, MI5 said the "primary purpose of the China General Technology Research Institute (CGTRI) 中国通用技术研究院 is to fund research that

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the

The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations https://thehackernews.com/2026/10/the-state-of-cybersecurity-in-2026key.html Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. This report examines how core areas of

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools https://thehackernews.com/2026/10/android-17-advanced-protection-locks.html Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes https://thehackernews.com/2026/10/critical-fortimail-zero-day-flaw.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system. "An improper

Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers https://thehackernews.com/2026/10/police-arrest-16-year-old-suspected-of.html Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site. Investigators identified him as KillSec's suspected

ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories https://thehackernews.com/2026/10/threatsday-ai-powered-zero-day-chain.html This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick. They can