⚡ Google just paused product bug bounty rewards for some of its biggest open-source projects.

It says automated submissions surged, and the vast majority were invalid.

Go, Angular, Flutter, Bazel, and Protocol Buffers are among the affected projects. Supply chain rewards continue.

Read: https://thehackernews.com/2026/10/google-pauses-oss-product-bug-bounty.html

Nearly half of IT and security pros say they lack full visibility into employee AI use.

Cristian Iordache of Bitdefender explains how GravityZone maps 700+ AI tools and helps teams allow, review, restrict, or block risky activity.

What AI security teams are missing: https://thehackernews.com/expert-insights/2026/10/your-employees-are-adopting-ai-faster.html

MCP marketplaces have a trust problem.

OX Security analyzed 15,465 publicly indexed MCP servers across 5 registries and found no marketplace vetting.

Among the findings:
• 2.3% of hosts no longer resolve
• 6 use expired domains anyone could re-register
• 15.6% resolve outside the US

The risk is not MCP itself. It is trusting servers without verifying who runs them or where your data goes.

Read - https://thehackernews.com/2026/10/welcome-to-jungle-what-we-found-inside.html

⚠️ Wikimedia says OpenAI agents tried to compromise Etherpad, modified wiki tooling for proxy use, and sent millions of automated requests.

It found no evidence its systems or data were compromised.

Read - https://thehackernews.com/2026/10/wikimedia-says-openai-agents-tried-to.html

Can you keep up with SaaS sprawl?

As applications multiply, so do users, permissions, access policies, and the places IT needs visibility. Without a centralized approach, secure access can become fragmented across an ever-growing application environment.

Explore zero-trust network access (ZTNA) with NordLayer.

Learn more ▶️ https://thn.news/developer-secrets-webinar

‼️ Opening a malicious spreadsheet can make LibreOffice or OpenOffice run attacker-controlled code without a macro warning.

The attack requires Java to be enabled. LibreOffice has patched the flaw; OpenOffice 4.1.16 remains affected.

PoC demonstrated, details here - https://thehackernews.com/2026/10/libreoffice-and-openoffice-flaws-let.html

Get an inside look at Georgetown's Cybersecurity Master's program. Register for the virtual sample class on October 15.

Sign up → https://thn.news/sample-class-risk

⚠️ Linux backdoors are hiding behind trusted email security names.

Rapid7 found BPFDoor, BPF Rekoobe, and AVERAT targeting systems in South Korea and Taiwan, impersonating products and processes to blend in. AVERAT even uses SMTP for C2.

Read: https://thehackernews.com/2026/10/linux-backdoors-impersonate-email.html

Fake ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus ad platforms are being used as phishing lures.

The sites open fake browser login windows to capture credentials and MFA codes, while operators attempt real-time sign-ins.

Read: https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html

🚨 100+ compromised websites are serving fake Cloudflare verification pages to Windows users arriving from search results.

Following the ClickFix prompt installs an MSI that delivers LunexStealer, which steals browser cookies, history, and credentials.

Read the full story - https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html

Anthropic is giving vetted cyber teams broader access to Claude with reduced safeguards.

The move comes as Project Glasswing reports at least 129,000 verified vulnerabilities, including 33,000+ rated critical or high severity.

Read - https://thehackernews.com/2026/10/anthropic-expands-claude-access-for.html

Agentic pentesting can prove real attack paths. But can it validate fast enough, across enough of the enterprise?

Picus breaks down the speed and coverage gaps, and why continuous validation needs more than pentesting alone.

Read more: https://thehackernews.com/2026/10/what-is-agentic-pentesting-what-it.html

‼️ Two hours.

That’s how quickly exploitation attempts followed public details for Atlassian CVE-2026-21589.

The flaw lets unauthenticated attackers access specific webroot files when exact paths are known. Fixes are available.

Read - https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html

A hacker is looking at your network right now. Do you see what he sees?

Jaime Woodruff does. He's an ethical hacker who's broken into real environments — and on October 14, he's going live to show MSPs and IT pros exactly how attackers get in.

But that's just the beginning.

The Kaseya Cybersecurity Summit packs two hours of content you can actually use:
✅ Live ransomware demo from an ethical hacker
✅ Real attack replays showing where defenses failed
✅ Compliance decoded: FIPS 140-3, NIS2, cyber insurance
✅ Resilience strategies for when prevention falls short

Free. Virtual. October 14 | 10:30 AM – 12:45 PM ET.

🔥 Seats are filling fast — don't get locked out.
👉 Register now: https://thn.news/cybersecurity-summit

🛑 FBI and Secret Service warn FortiBleed remains active against internet-facing Fortinet firewalls and SSL VPN gateways.

Attackers are still scanning exposed firewalls using previously compromised credentials. The campaign had amassed 86,644+ working device credentials across 194 countries as of June 19.

Read: https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html

79% of CISOs now rank human risk as their biggest cyber vulnerability. 78% see GenAI as a security risk.

What changed in 2026, and where security priorities are shifting:

Read the full analysis: https://thehackernews.com/2026/10/the-sixth-voice-of-ciso-data-shows.html

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian at The Validation Summit ’26.

Hosted by Picus Security, this two-hour digital summit focuses on how to build a security program that keeps pace with attackers using AI.

You’ll hear why patching and periodic tests leave gaps, how a validation program can address them, and what security leaders are changing in their own teams.

Then watch a live demo follow a new vulnerability from disclosure through remediation. See how to check exposure before a working exploit exists, test what your controls stop, and prove the fix worked.

October 14, 1 PM ET | October 15, 11 AM BST. Choose the broadcast that suits you.

Save your seat: https://thn.news/validation-summit

⚠️ PoeLLM has infected 3,400+ servers in a crypto-mining campaign targeting exposed AI/LLM infrastructure.

The malware hides its C2 address inside a GitHub-hosted poem and repurposes some compromised hosts to scan for more vulnerable systems.

Read more: https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html

‼️ UNPATCHED >> A single network message can trigger code execution on an LMCache multiprocess server without authentication when the server is bound to a routable address.

CVE-2026-105192 affects LMCache 0.3.9 through 0.5.5, plus 0.5.6 release candidates.

Details → https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html

⚠️ SonicWall has patched a CVSS 10.0 WorkPlace SSRF that requires no login.

CVE-2026-102255 can reach internal functions before authentication. SonicWall says it has no evidence of exploitation.

Read - https://thehackernews.com/2026/10/sonicwall-patches-cvss-100-pre.html