TECHZONE™

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements

[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls https://thehackernews.com/2026/10/webinar-how-to-stop-ai-driven-privilege.html The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled

What to do when a data breach notice doesn't say much https://www.welivesecurity.com/en/how-to/what-to-do-when-a-data-breach-notice-tells-you-almost-nothing/ Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.

Bring Your Own Agent: Your Employees' Assistants Are Already Logged In https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year

Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest

Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites. The AI company said it identified four broad categories of unintended model actions during evaluations and internal use of Claude - Claude Mythos

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories https://thehackernews.com/2026/10/credential-stealing-github-actions.html Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity

FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public. The

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name

TP-Link Sued by Four More U.S. States Over Router Security and China Ties https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with  Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court. TP-Link Systems is based in

Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security

Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects https://thehackernews.com/2026/10/anthropic-launches-free-ai.html Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI). "It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost."

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow