TECHZONE™

The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a

GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.

Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner. Trend Micro's Zero

Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions. "CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said. The vulnerability

FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical infrastructure. The list of seized

MATCHBOIL: New tricks, same old evil intentions https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/ ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026

FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8. The company, Integrity Technology Group, has been sanctioned by the U.S. and the UK. The hackers scanned websites for flaws using a tool containing more

ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence. The rest of the week isn't much more reassuring. Malicious code turned up in developer packages and extensions that

Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT/

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN. According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065). ASHVEIN,

ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration. "In this activity, the threat actor leveraged

Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe

16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys. "The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to

U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward is for information leading to his identification or location, the news outlet NTD reported this week, citing a notice

MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," Socket said

Inside a brand deal scam targeting YouTube creators https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/ A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account

The quest for simplicity: Why SMBs want advanced protection without the complexity https://www.welivesecurity.com/en/business-security/quest-simplicity-why-smbs-want-advanced-protection-without-complexity/ The cybersecurity market is often making it tougher for SMBs to keep threats at bay

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an encrypted

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have