TECHZONE™

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.html Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money

An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part. https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it

AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the

Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code

OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room https://thehackernews.com/2026/10/openai-employee-arrested-for-allegedly.html A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements

[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls https://thehackernews.com/2026/10/webinar-how-to-stop-ai-driven-privilege.html The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled

What to do when a data breach notice doesn't say much https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/ Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.

Bring Your Own Agent: Your Employees' Assistants Are Already Logged In https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year

Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed