Fake ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus ad platforms are being used as phishing lures.

The sites open fake browser login windows to capture credentials and MFA codes, while operators attempt real-time sign-ins.

Read: https://thehackernews.com/2026/10/fake-chatgpt-gemini-and-claude-ad.html

🚨 100+ compromised websites are serving fake Cloudflare verification pages to Windows users arriving from search results.

Following the ClickFix prompt installs an MSI that delivers LunexStealer, which steals browser cookies, history, and credentials.

Read the full story - https://thehackernews.com/2026/10/100-compromised-websites-use-fake.html

Anthropic is giving vetted cyber teams broader access to Claude with reduced safeguards.

The move comes as Project Glasswing reports at least 129,000 verified vulnerabilities, including 33,000+ rated critical or high severity.

Read - https://thehackernews.com/2026/10/anthropic-expands-claude-access-for.html

Agentic pentesting can prove real attack paths. But can it validate fast enough, across enough of the enterprise?

Picus breaks down the speed and coverage gaps, and why continuous validation needs more than pentesting alone.

Read more: https://thehackernews.com/2026/10/what-is-agentic-pentesting-what-it.html

‼️ Two hours.

That’s how quickly exploitation attempts followed public details for Atlassian CVE-2026-21589.

The flaw lets unauthenticated attackers access specific webroot files when exact paths are known. Fixes are available.

Read - https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html

A hacker is looking at your network right now. Do you see what he sees?

Jaime Woodruff does. He's an ethical hacker who's broken into real environments — and on October 14, he's going live to show MSPs and IT pros exactly how attackers get in.

But that's just the beginning.

The Kaseya Cybersecurity Summit packs two hours of content you can actually use:
✅ Live ransomware demo from an ethical hacker
✅ Real attack replays showing where defenses failed
✅ Compliance decoded: FIPS 140-3, NIS2, cyber insurance
✅ Resilience strategies for when prevention falls short

Free. Virtual. October 14 | 10:30 AM – 12:45 PM ET.

🔥 Seats are filling fast — don't get locked out.
👉 Register now: https://thn.news/cybersecurity-summit

🛑 FBI and Secret Service warn FortiBleed remains active against internet-facing Fortinet firewalls and SSL VPN gateways.

Attackers are still scanning exposed firewalls using previously compromised credentials. The campaign had amassed 86,644+ working device credentials across 194 countries as of June 19.

Read: https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html

79% of CISOs now rank human risk as their biggest cyber vulnerability. 78% see GenAI as a security risk.

What changed in 2026, and where security priorities are shifting:

Read the full analysis: https://thehackernews.com/2026/10/the-sixth-voice-of-ciso-data-shows.html

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian at The Validation Summit ’26.

Hosted by Picus Security, this two-hour digital summit focuses on how to build a security program that keeps pace with attackers using AI.

You’ll hear why patching and periodic tests leave gaps, how a validation program can address them, and what security leaders are changing in their own teams.

Then watch a live demo follow a new vulnerability from disclosure through remediation. See how to check exposure before a working exploit exists, test what your controls stop, and prove the fix worked.

October 14, 1 PM ET | October 15, 11 AM BST. Choose the broadcast that suits you.

Save your seat: https://thn.news/validation-summit

⚠️ PoeLLM has infected 3,400+ servers in a crypto-mining campaign targeting exposed AI/LLM infrastructure.

The malware hides its C2 address inside a GitHub-hosted poem and repurposes some compromised hosts to scan for more vulnerable systems.

Read more: https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html

‼️ UNPATCHED >> A single network message can trigger code execution on an LMCache multiprocess server without authentication when the server is bound to a routable address.

CVE-2026-105192 affects LMCache 0.3.9 through 0.5.5, plus 0.5.6 release candidates.

Details → https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html

⚠️ SonicWall has patched a CVSS 10.0 WorkPlace SSRF that requires no login.

CVE-2026-102255 can reach internal functions before authentication. SonicWall says it has no evidence of exploitation.

Read - https://thehackernews.com/2026/10/sonicwall-patches-cvss-100-pre.html

🚨 Malicious npm packages are abusing lifecycle hooks to deliver Windows malware.

Eight packages tied to the MALFEX campaign logged 40,767 downloads and can deploy Overlord RAT and a Node.js stealer.

Read - https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html

‼️ Attackers hijacked the .gh, .sl and .as ccTLD registries, changed authoritative DNS, and obtained at least 12 unauthorized TLS certificates for Google and YouTube domains.

Google says its systems were not breached. All 12 certificates were revoked.

Read - https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html

🛑 Removing the npm package may not remove the malware.

Compromised tensorlake v0.5.144 shipped a Shai-Hulud worm designed to steal GitHub/AWS credentials, persist on hosts, and republish infected packages.

It's off npm. Installed it? Remove it and rotate credentials.

Read - https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html

🚨 $8,200 paid to ransomware attackers. $150,000 billed to the victim.

DOJ charges MonsterCloud’s owner with fraud, alleging he secretly paid attackers for decryptors while claiming to use proprietary recovery tools.

Over $19 million in client charges.

Read - https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html

‼️ U.S. offers up to $10 MILLION for tips on a Chinese national charged in the HAFNIUM Microsoft Exchange hacks.

Zhang Yu remains at large. Prosecutors accuse him of coordinating hacking operations linked to China's intelligence service.

Read- https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html

🚨 16 malicious Firefox extensions posed as Rabby and OKX wallets to steal recovery phrases and private keys.

Their code intercepted wallet secrets during import and attempted to send them to attacker-controlled Cloudflare Workers.

All 16 have been removed.

Read - https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html

A phishing scanner may never see the page attackers want victims to open.

Meet Wazza.

It uses browser checks, short-lived session tokens, and multi-stage redirects to conceal an Adobe-themed Device Code phishing lure.

ANYRUN exposes the attack chain: https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html

September’s attacks showed how quickly cyber risk can move beyond the SOC. ⚠️

🇺🇸 51% of CSuite sandbox sessions came from the US
🔐 M365 sessions + endpoints compromised in one attack chain
🧩 Trusted platforms like Adobe, DocuSign & Microsoft 365 abused
💳 114 malicious domains powered IronToll’s real-time payment phishing

The outcome for enterprises: wider incident scope, harder containment, greater fraud exposure, and higher response costs. 📈

👉 See what September’s attacks reveal about enterprise risk — and close the gaps now: https://thn.news/cyber-attacks-sept2026