TECHZONE™

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception

Is the ad a scam? How to tell before you click https://www.welivesecurity.com/en/social-media/is-ad-scam-how-tell-before-click/ You can trust a social media platform and still get scammed by an ad running on it

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far.

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting  PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company

ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.html ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the

Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge https://thehackernews.com/2026/10/ex-openai-engineer-detained-in-spy.html A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the

⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More https://thehackernews.com/2026/10/weekly-recap-98-zero-days-rogue-ai.html The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software https://thehackernews.com/2026/10/from-email-to-case-to-boardroom-how.html In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together,

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys https://thehackernews.com/2026/10/opencode-console-breach-may-have.html An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without