🚨 More than 500 GitHub accounts committed credential-stealing Actions workflows to tens of thousands of repositories.

Disguised as security audits, the malicious workflows harvest AWS keys, API tokens, and secrets from Git history.

Read: https://thehackernews.com/2026/10/credential-stealing-github-actions.html

🛑 During internal tests, Claude Mythos Preview exploited injection flaws to run commands on a university server. Claude Haiku 4.5 sent a false homicide tip to Philadelphia police.

Anthropic is cutting live internet access for all internal evaluations.

Read: https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html

Nearly 1,000 of roughly 1,280 third-party products embedding AI were not behind SSO in environments studied for a 2026 report.

The blind spot: AI agents can enter through existing enterprise software without a separate security review.

Here's what security teams need to know → https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html

🚨 51 Claude Code agents. 429 WordPress admin panels accessed. 32 web shells deployed in just 61 seconds.

SOCRadar links the campaign to CyberXero, which also stole over 628,000 records from four Ukrainian organizations.

Read: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html

⚠️ No login required. CVSS 10.0. Active exploitation.

Attackers are exploiting a Bricksforge WordPress flaw (CVE-2026-85097) that enables arbitrary PHP code execution through crafted file-upload metadata.

Patchstack observed attack activity from 63 IPs. Update to version 4.0.1.

Read - https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html

🚨 SonicWall released patches. Two days later, exploitation attempts began.

A critical pre-auth SSRF flaw in SMA 1000 (CVE-2026-102255, CVSS 10.0) has drawn 135 exploitation attempts from just two U.S. IP addresses.

https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html

‼️ Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet.

Amid reports of stolen funds, it paused reseller sales and warned buyers from the past 90 days: don't set up unused devices; consider moving assets from initialized ones.

https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

Your employees’ personal AI agents can access work apps without showing up in your managed-agent console.

OAuth grants, saved passwords, and API tokens give them ways in, often without an IT ticket.

How can security teams control agents they can't see?

Read → https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html

Building AI agents isn't the hard part anymore. Securing and governing them is. 🔐

At Aktonomy Fall '26, hear from CISOs and security leaders on AI agent identity, governance, and security controls, with practical insights for securing AI in production.

📅 October 27 · 8:30 AM PT · 🌐 Virtual

20+ speakers · 8+ hours of insights

👇 Register now and save your spot: https://thn.news/aktonomy-fall-2026

Even the “secure” padlock had trust issues this week.

→ Helpdesk 0-days
→ Rogue HTTPS certs
→ ShinyHunters arrest
→ iPhone keychain theft
→ Atlassian exploits
→ AI-fooling malware
→ 3 new malware loaders
→ Exposed GPU servers
→ Ransomware surge
→ AI disinfo operations
→ Dark web hijacks

This week's cybersecurity recap ↓ https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html

⚠️ Some low-cost Android phones are infected before you even turn them on.

Bitdefender's Midnight Mimosa malware ships in firmware, silently installs apps & deploys payloads for ad fraud and residential proxies. A normal uninstall won't remove it.

Read: https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html

278.9 million+ medium- or critical-level SaaS alerts. In one year.

That's part of what Kaseya monitored in 2025. For MSPs, more security tools can mean more alerts, not better detection.

Why consolidation alone isn't enough, and how AI-assisted triage helps cut through the noise.

Read → https://thehackernews.com/expert-insights/2026/10/the-alert-fatigue-trap-why.html

‼️ A CVSS 10.0 flaw in GitLab could have let unauthenticated users execute code on the server under certain conditions.

GitLab has patched the CI/CD vulnerability (CVE-2026-97229) affecting CE and EE.

Fixed versions: 19.2.8, 19.3.5, and 19.4.2.

Read: https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html

🛑 Two critical MarkLogic Server flaws could let accounts with forest-management or manage-user privileges gain persistent admin control.

Progress disclosed 31 flaws, 5 critical. Fixes shipped Sept. 10 in 11.3.7 and 12.1.0. Exploitation status unknown.

https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html

‼️ Attackers forced fridges into defrost at hundreds of French supermarkets. Some reached 50°C, and stores threw out food.

» Danfoss refrigeration controllers compromised.
» Intermarché, Carrefour and other French chains hit.
» Initial access method remains unknown.

Details → https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html

Your software inventory may be missing the AI tools running across your organization.

Bitdefender GravityZone AI Visibility and Control identifies shadow AI, coding assistants, local models, MCP servers, and agent skills across Windows endpoints, with risk scores and visibility into what connected tools can access.

Here's how it works: https://thehackernews.com/2026/10/product-walkthrough-bitdefender-ai.html

‼️ No PIN. No owner interaction. Root access.

A 3-flaw chain in LG webOS can give attackers on the same local network root access to certain smart TVs.

Demonstrated on two models.

Read: https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html

Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale.

This new report brings together 10 cybersecurity companies to explore what comes next, spanning identity security, endpoint and connected device security, exposure management, telemetry, human risk intelligence, email and domain protection, and AI-native security operations.

Read the full report: https://thn.news/security-threats-news

Featuring:

Keeper Security
Cribl
Automox
Nisos
Surf AI
Adaptive Security
Red Sift
Asimily
SentinelOne
CrowdStrike

⚡ What if the login is legitimate, but the identity is compromised?

AI-driven attacks can escalate privileges before defenders react. Learn how to control access beyond login in this live webinar.

Register Now - https://thehackernews.com/2026/10/webinar-how-to-stop-ai-driven-privilege.html

🚨 Norway’s privacy watchdog has issued its largest-ever fine, €8.6 million, against Xandr for relaying Grindr users’ data revealing sexual orientation to advertisers without required consent.

The violations predate Microsoft’s acquisition.

Read: https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html