⚠️ Docker Hub's critical GhostPat flaw let users publish images under someone else's name through account conversion.

The bug lasted over two years. Docker fixed it and found no evidence of exploitation.

Read: https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html

🛑 Anthropic warns small AI models may be months away from self-replicating on IoT devices, potentially forming botnets that are hard to shut down.

In tests, GLM-5.2 propagated Llama 3.1-8B to all 8 nodes in 4 of 5 trials.

Read: https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html

⚠️ UPDATE: A tampered Ledger can leak your 24-word recovery phrase over LTE.

Ledger says a hidden implant reads setup screens and transmits the phrase via eSIM—without modifying the Secure Element or OS.

Affected users and losses remain unknown. Genuine Check may miss it.

Read: https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

‼️ BREAKING - An OpenAI engineering lead has been arrested for allegedly planting a covert audio recorder in an executive conference room where highly confidential company matters are discussed.

The device was found hidden behind a TV, wrapped in toilet paper.

Read: https://thehackernews.com/2026/10/openai-employee-arrested-for-allegedly.html

🚨 Microsoft just broke its Patch Tuesday record: 1,413 vulnerabilities patched in one release.

One Windows Shell flaw (CVE-2026-96951) is already being exploited in attacks and can bypass Mark of the Web defenses.

Read: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html

⚠️ Researchers ran attacker-chosen code inside Windows 11's SmartScreen VBS enclave, designed to resist even SYSTEM-level compromise.

A 4-byte write & timing bug enabled the lab PoC. Local access required. CVE-2026-83498 was patched in September.

Read: https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html

🛑 A Linux kernel flaw can let an untrusted VM hijack its host's QEMU process in specific setups.

Dubbed Vghost (CVE-2026-74580), the AI-assisted discovery also enables local root escalation for users with vhost device access.

Read: https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html

53% of 14.86 million cloud security detections in Tamnoon's dataset remain open. Critical findings take 150 days to close on average.

Tamnoon CEO Marina Segal explains why its new Cloud Remediation Index also tracks automated fixes the engine refused to make.

Read → https://thehackernews.com/expert-insights/2026/10/tamnoon-ceo-marina-segal-on-self.html

A major insurer’s login API let users redirect one-time codes to unregistered email addresses.

During an authorized test, Reflectiz’s AI agent sent the code to its own inbox and logged in.

The flaw could allow account access with the required customer identifiers

Read → https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html

🚨 Hirudo Android banking trojan targets the banking apps themselves.

Fake update prompts trick users into installing tampered replacements that can falsify built-in security checks, including Play Integrity.

Read: https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html

With 42% of organizations allowing AI agents to act autonomously, GRC leaders face unprecedented oversight gaps. When decision-making accelerates without central visibility, risk escalates rapidly across business operations.

The 2026 agentic enterprise report delivers actionable insights to help risk leaders unify oversight, establish clear boundaries, and transform agentic AI into a strategic advantage without sacrificing control.

Key topics covered include:
✅ Balancing AI decision-making authority with central visibility
✅ Mitigating systemic risks across autonomous agentic workflows
✅ Actionable benchmarks and proactive control strategies

Get the report - https://thn.news/agentic-enterprise-authority

‼️ Researchers used AI agents running OpenAI's public GPT-5.6 Sol to build a 3-bug Chrome exploit chain in 6 days.

Loading a web page could execute code on Windows, outside Chrome. Google fixed all three bugs and paid $250,000.

Details → https://thehackernews.com/2026/10/researchers-used-public-openai-model-to.html

🚨 curl patched a High-severity HTTP/2 upload flaw (CVE-2026-92392).

A malicious server can corrupt client memory; a PoC demonstrated code execution under strict conditions.

Read: https://thehackernews.com/2026/10/curl-patches-http2-upload-flaw-after.html

The AI for Security Virtual Summit

Join Figma, Perplexity, and Wiz to learn how to monitor rogue agents, automate triage, and secure code.

Defensive security is transitioning from manual, reactive operations to autonomous, machine-speed execution. The AI for Security Virtual Summit brings together pioneering practitioners and researchers who are moving past general AI chatbots to embed specialized security agents directly into their defensive pipelines.

Save your spot → https://thn.news/agentic-report-guide

⚠️ CISA urges immediate Ivanti Connect Secure updates as honeypots log 105 exploit attempts from 50 IPs.

The zero-day has also been exploited in real attacks to steal credentials. Honeypot payloads mainly test for code execution.

https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html

A call from your CFO could sound real and still be fake.

62% of cybersecurity leaders surveyed in 2025 reported a deepfake attack on their organization in the prior year.

Can your team stop a fake wire transfer, MFA reset, or admin access request?

Here's how to test it safely → https://thehackernews.com/2026/10/how-to-run-deepfake-readiness-drill.html

🚨 U.S. authorities dismantled over 40 laptop farms and charged 14 people in a North Korean IT worker fraud case.

The scheme affected 70+ U.S. companies and generated about $3 million. Employer laptops were hosted in U.S. homes to disguise overseas workers.

Read: https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html

⚡ Over 1 billion phishing emails and texts. 75,000+ organizations targeted.

Microsoft and partners have disrupted 3 phishing kits linked to the actors behind the campaigns: CoGUI, Haozi and Iron Man System.

Read: https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html

‼️ Attackers planted PHP web shells on Nextcloud servers via Collabora's Built-in CODE app (CVE-2026-110447).

Catch >> Disabling the app does NOT close the flaw. Exploitation requires its local document server to be down.

Update to 26.4.303+ or remove it.

Read: https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html

‼️ WARNING - Cisco confirms active, in-the-wild exploitation of a new critical flaw (CVE-2026-76519 // CVSS 9.8) in Cisco Secure Email Gateway.

Unauthenticated attackers can achieve full root command execution simply by sending an email with a crafted attachment.

Details >> https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html