🚨 Attackers are exploiting two AhsayCBS flaws to deploy web shells and XMRig miners disguised as Microsoft Edge (edge.exe).

Huntress says even the latest version, 10.3.4, remains vulnerable.

Read about it here → https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html

‼️ Researchers have published a working exploit for an AnyDesk Linux flaw that can execute commands as root before connection approval.

Called AnyPwn, the exploit targets version 8.0.2 via direct TCP port 7070. The flaw was fixed in 8.0.3.

Details → https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html

⚡ Anthropic launches OSS Scanner, a free AI-powered vulnerability scanning service for open-source projects.

Selected projects can opt in for periodic security scans, with fully AI-generated vulnerability reports that require no human review.

Read → https://thehackernews.com/2026/10/anthropic-launches-free-ai.html

🛑 TP-Link now faces lawsuits in 5 U.S. states.

The latest four allege misleading router security claims and overstated separation from China. TP-Link denies the allegations.

21 state AGs have also raised concerns with the FCC over new router approvals.

Read → https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html

🚨 DarkSword's new P7 iOS variant goes beyond data theft.

Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds.

Details: https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html

‼️ BREAKING - FBI announces a third ShinyHunters-linked arrest made public since its jobs portal breach.

The suspect is reportedly a Canadian detained in Pennsylvania, believed to have been directly involved in the hack.

Details: https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html

🚨 More than 500 GitHub accounts committed credential-stealing Actions workflows to tens of thousands of repositories.

Disguised as security audits, the malicious workflows harvest AWS keys, API tokens, and secrets from Git history.

Read: https://thehackernews.com/2026/10/credential-stealing-github-actions.html

🛑 During internal tests, Claude Mythos Preview exploited injection flaws to run commands on a university server. Claude Haiku 4.5 sent a false homicide tip to Philadelphia police.

Anthropic is cutting live internet access for all internal evaluations.

Read: https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html

Nearly 1,000 of roughly 1,280 third-party products embedding AI were not behind SSO in environments studied for a 2026 report.

The blind spot: AI agents can enter through existing enterprise software without a separate security review.

Here's what security teams need to know → https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html

🚨 51 Claude Code agents. 429 WordPress admin panels accessed. 32 web shells deployed in just 61 seconds.

SOCRadar links the campaign to CyberXero, which also stole over 628,000 records from four Ukrainian organizations.

Read: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html

⚠️ No login required. CVSS 10.0. Active exploitation.

Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.

Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.

Read - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html

🚨 SonicWall released patches. Two days later, exploitation attempts began.

A critical pre-auth SSRF flaw in SMA 1000 (CVE-2026-102255, CVSS 10.0) has drawn 135 exploitation attempts from just two U.S. IP addresses.

https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html

‼️ Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet.

Amid reports of stolen funds, it paused reseller sales and warned buyers from the past 90 days: don't set up unused devices; consider moving assets from initialized ones.

https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

Your employees’ personal AI agents can access work apps without showing up in your managed-agent console.

OAuth grants, saved passwords, and API tokens give them ways in, often without an IT ticket.

How can security teams control agents they can't see?

Read → https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html

Building AI agents isn't the hard part anymore. Securing and governing them is. 🔐

At Aktonomy Fall '26, hear from CISOs and security leaders on AI agent identity, governance, and security controls, with practical insights for securing AI in production.

📅 October 27 · 8:30 AM PT · 🌐 Virtual

20+ speakers · 8+ hours of insights

👇 Register now and save your spot: https://thn.news/aktonomy-fall-2026

Even the “secure” padlock had trust issues this week.

→ Helpdesk 0-days
→ Rogue HTTPS certs
→ ShinyHunters arrest
→ iPhone keychain theft
→ Atlassian exploits
→ AI-fooling malware
→ 3 new malware loaders
→ Exposed GPU servers
→ Ransomware surge
→ AI disinfo operations
→ Dark web hijacks

This week's cybersecurity recap ↓ https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html

⚠️ Some low-cost Android phones are infected before you even turn them on.

Bitdefender's Midnight Mimosa malware ships in firmware, silently installs apps & deploys payloads for ad fraud and residential proxies. A normal uninstall won't remove it.

Read: https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html

278.9 million+ medium- or critical-level SaaS alerts. In one year.

That's part of what Kaseya monitored in 2025. For MSPs, more security tools can mean more alerts, not better detection.

Why consolidation alone isn't enough, and how AI-assisted triage helps cut through the noise.

Read → https://thehackernews.com/expert-insights/2026/10/the-alert-fatigue-trap-why.html

‼️ A CVSS 10.0 flaw in GitLab could have let unauthenticated users execute code on the server under certain conditions.

GitLab has patched the CI/CD vulnerability (CVE-2026-97229) affecting CE and EE.

Fixed versions: 19.2.8, 19.3.5, and 19.4.2.

Read: https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html

🛑 Two critical MarkLogic Server flaws could let accounts with forest-management or manage-user privileges gain persistent admin control.

Progress disclosed 31 flaws, 5 critical. Fixes shipped Sept. 10 in 11.3.7 and 12.1.0. Exploitation status unknown.

https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html