‼️ Attackers forced fridges into defrost at hundreds of French supermarkets. Some reached 50°C, and stores threw out food.

» Danfoss refrigeration controllers compromised.
» Intermarché, Carrefour and other French chains hit.
» Initial access method remains unknown.

Details → https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html

Your software inventory may be missing the AI tools running across your organization.

Bitdefender GravityZone AI Visibility and Control identifies shadow AI, coding assistants, local models, MCP servers, and agent skills across Windows endpoints, with risk scores and visibility into what connected tools can access.

Here's how it works: https://thehackernews.com/2026/10/product-walkthrough-bitdefender-ai.html

‼️ No PIN. No owner interaction. Root access.

A 3-flaw chain in LG webOS can give attackers on the same local network root access to certain smart TVs.

Demonstrated on two models.

Read: https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html

Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale.

This new report brings together 10 cybersecurity companies to explore what comes next, spanning identity security, endpoint and connected device security, exposure management, telemetry, human risk intelligence, email and domain protection, and AI-native security operations.

Read the full report: https://thn.news/security-threats-news

Featuring:

Keeper Security
Cribl
Automox
Nisos
Surf AI
Adaptive Security
Red Sift
Asimily
SentinelOne
CrowdStrike

⚡ What if the login is legitimate, but the identity is compromised?

AI-driven attacks can escalate privileges before defenders react. Learn how to control access beyond login in this live webinar.

Register Now - https://thehackernews.com/2026/10/webinar-how-to-stop-ai-driven-privilege.html

🚨 Norway’s privacy watchdog has issued its largest-ever fine, €8.6 million, against Xandr for relaying Grindr users’ data revealing sexual orientation to advertisers without required consent.

The violations predate Microsoft’s acquisition.

Read: https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html

⚡ GitHub tightens npm security after 1,500+ packages were found vulnerable to hijacking without stolen credentials.

Attackers could claim a freed GitHub repo name tied to a trusted-publisher binding that had never published.

Unvalidated bindings now expire after 48 hours.

Learn more: https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html

🛑 New CVSS 10.0 flaw disclosed in SAP Cloud SDK for Python (CVE-2026-89111).

It allows attackers to steal OAuth2 client IDs and secrets by manipulating tenant subdomains.

🛠️ Fix: Ensure you're running v0.55.1 or newer (latest is 0.58.4).

Details: https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html

‼️ Three zero-days. Root commands. No login.

An attacker exploited the flaws in a fully patched Ivanti Connect Secure VPN and stole stored credentials.

Ivanti confirms exploitation in the wild. Two flaws patched; a fix for the third is pending.

Read: https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html

⚠️ Docker Hub's critical GhostPat flaw let users publish images under someone else's name through account conversion.

The bug lasted over two years. Docker fixed it and found no evidence of exploitation.

Read: https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html

🛑 Anthropic warns small AI models may be months away from self-replicating on IoT devices, potentially forming botnets that are hard to shut down.

In tests, GLM-5.2 propagated Llama 3.1-8B to all 8 nodes in 4 of 5 trials.

Read: https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html

⚠️ UPDATE: A tampered Ledger can leak your 24-word recovery phrase over LTE.

Ledger says a hidden implant reads setup screens and transmits the phrase via eSIM—without modifying the Secure Element or OS.

Affected users and losses remain unknown. Genuine Check may miss it.

Read: https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

‼️ BREAKING - An OpenAI engineering lead has been arrested for allegedly planting a covert audio recorder in an executive conference room where highly confidential company matters are discussed.

The device was found hidden behind a TV, wrapped in toilet paper.

Read: https://thehackernews.com/2026/10/openai-employee-arrested-for-allegedly.html

🚨 Microsoft just broke its Patch Tuesday record: 1,413 vulnerabilities patched in one release.

One Windows Shell flaw (CVE-2026-96951) is already being exploited in attacks and can bypass Mark of the Web defenses.

Read: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html

⚠️ Researchers ran attacker-chosen code inside Windows 11's SmartScreen VBS enclave, designed to resist even SYSTEM-level compromise.

A 4-byte write & timing bug enabled the lab PoC. Local access required. CVE-2026-83498 was patched in September.

Read: https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html

🛑 A Linux kernel flaw can let an untrusted VM hijack its host's QEMU process in specific setups.

Dubbed Vghost (CVE-2026-74580), the AI-assisted discovery also enables local root escalation for users with vhost device access.

Read: https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html

53% of 14.86 million cloud security detections in Tamnoon's dataset remain open. Critical findings take 150 days to close on average.

Tamnoon CEO Marina Segal explains why its new Cloud Remediation Index also tracks automated fixes the engine refused to make.

Read → https://thehackernews.com/expert-insights/2026/10/tamnoon-ceo-marina-segal-on-self.html

A major insurer’s login API let users redirect one-time codes to unregistered email addresses.

During an authorized test, Reflectiz’s AI agent sent the code to its own inbox and logged in.

The flaw could allow account access with the required customer identifiers

Read → https://thehackernews.com/2026/10/an-ai-agent-found-critical-otp-bypass.html

🚨 Hirudo Android banking trojan targets the banking apps themselves.

Fake update prompts trick users into installing tampered replacements that can falsify built-in security checks, including Play Integrity.

Read: https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html

With 42% of organizations allowing AI agents to act autonomously, GRC leaders face unprecedented oversight gaps. When decision-making accelerates without central visibility, risk escalates rapidly across business operations.

The 2026 agentic enterprise report delivers actionable insights to help risk leaders unify oversight, establish clear boundaries, and transform agentic AI into a strategic advantage without sacrificing control.

Key topics covered include:
✅ Balancing AI decision-making authority with central visibility
✅ Mitigating systemic risks across autonomous agentic workflows
✅ Actionable benchmarks and proactive control strategies

Get the report - https://thn.news/agentic-enterprise-authority