⚡ Over 1 billion phishing emails and texts. 75,000+ organizations targeted.

Microsoft and partners have disrupted 3 phishing kits linked to the actors behind the campaigns: CoGUI, Haozi and Iron Man System.

Read: https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html

‼️ Attackers planted PHP web shells on Nextcloud servers via Collabora's Built-in CODE app (CVE-2026-110447).

Catch >> Disabling the app does NOT close the flaw. Exploitation requires its local document server to be down.

Update to 26.4.303+ or remove it.

Read: https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html

‼️ WARNING - Cisco confirms active, in-the-wild exploitation of a new critical flaw (CVE-2026-76519 // CVSS 9.8) in Cisco Secure Email Gateway.

Unauthenticated attackers can achieve full root command execution simply by sending an email with a crafted attachment.

Details >> https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html

🚨 Palo Alto Networks patches actively exploited PAN-OS RCE flaw (CVE-2026-0322).

Authenticated attackers with network access to the management interface can run code as root.

Palo Alto reports "very limited" exploitation. CISA added it to KEV.

Read - https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.html

🚨 Ahsay has released new fixes for two AhsayCBS vulnerabilities exploited by attackers after earlier patches failed to fully address them.

Attackers used the flaws to install web shells and cryptocurrency miners.

Read: https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html

⚠️ 1,423 Langflow RCE exploit attempts hit Previdian honeypots from 27 IPs.

The bug lets authenticated users, even non-admins, run OS commands through MCP server configs. Fixed in 1.9.0.

Read: https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html

🛑 GhostAction attackers compromised about 1,900 GitHub accounts and targeted 30,000+ repositories with malicious GitHub Actions workflows designed to steal CI/CD secrets.

They attempted to extract 3,174 secrets. GitHub blocked later attack waves.

Read → https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html

⚡ India orders telecoms to show registered caller names for unsaved domestic numbers starting November 1, 2026.

The CNAP mandate targets 4G and newer networks, aiming to help identify unknown callers and tackle spam and fraudulent calls.

Read: https://thehackernews.com/2026/10/india-mandates-registered-caller-name.html

SANS introduces two separate AI frameworks for digital forensics and incident response.

One maps to SWGDE standards, the other to NIST CSF 2.0.

The core rule: AI can assist investigations, but humans must verify forensic findings and retain final authority.

Read → https://thehackernews.com/2026/10/why-ai-confidence-is-not-validation.html

IBM found that 1 in 5 organizations reported a breach tied to shadow AI. At the same time, sensitive data enters AI prompts every day, often without anyone flagging it. And without visibility into how AI is actually being used, proving compliant usage becomes guesswork.

To address these risks, NordLayer AI Scout gives security teams the visibility to detect AI usage, flag sensitive data before a prompt is sent, and support governance that works in practice, not just on paper.

Learn more 👉 https://thn.news/security-visibility-tools

🚨 Drupal has patched a critical Field UI RCE flaw (CVE-2026-108097) with at least one known exploit path requiring no login.

Core alone doesn't expose it. Contributed modules can make it reachable.

Read - https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html

‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS.

RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889).

🔗 Read - https://thehackernews.com/2026/10/nextjs-ships-out-of-band-patch-for-two.html

⚠️ Fake AI downloads are turning into malware traps.

ANYRUN linked 1,258 public sandbox analyses to fake AI campaigns (Apr–Oct 2026).

One fake Claude page copies a command to the clipboard, then tells users to run it in PowerShell to fetch a malicious HTA.

Read → https://thehackernews.com/2026/10/fake-ai-attacks-spread-across-us.html

‼️ NGINX patches 5 security flaws, including one present since 2005.

Three memory bugs could crash workers or possibly allow code execution in specific configurations. Two others affect TLS client-certificate checks and HTTP/3 requests.

Read - https://thehackernews.com/2026/10/nginx-fixes-5-flaws-including-possible.html

More than 10% of malware verdicts on Go and .NET packages had no match in public sources at the time of detection.

That’s from Chainguard’s beta, where the scanner returned malicious verdicts on 5,000+ packages.

Chainguard Libraries is expanding its ecosystem coverage to GO and .NET. The language ecosystems are now available in early access with multiple layers of security controls to defend against malware.

Learn more about protecting your Go and .NET dependencies from malware → https://thn.news/chainguard-go-dotnet

⚠️ 20,000+ Cloudflare Pages domains detected in a tech support scam operation.

Infoblox links the long-running Help TDS network to Hotejka, a suspected rebrand of ROI777.

The network redirects users to fake Windows security alerts designed to drive calls to scam support centers.

Read: https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html

🚨 Hackers are exploiting a WinRAR flaw to plant malware in government systems.

Silent Lynx used CVE-2025-8088 to drop PickleShell, a custom reverse shell, into the Windows Startup folder for execution at the next login.

Full story: https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html

‼️ NEW: Candiru spyware infected devices at Al Jazeera through ordinary online ads — no click, the ad only had to load.

The vendor that delivered it, Discover-Tech, was a Google-certified ad vendor.

Researchers call it the first proven case of spyware spread via targeted ads.

Read - https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html

⚡ Wait, wait... we're not done for the day yet!

27 MORE cybersecurity stories worth catching up on.

> VPN ransomware
> Adobe RCE
> NVIDIA escape bug
> DNS wallet theft
> self-healing backdoor
> Discord RAT
> jump-scare RAT
> AI key theft
> Meta GitHub breach
> browser theft
> Xen VM flaw
>WAF exploits
> SQL injection
+ more.

Your ThreatsDay Bulletin is here ↓ https://thehackernews.com/2026/10/threatsday-adobe-rce-dns-wallet-theft.html

‼️ A newly disclosed critical Linux kernel flaw, PwnEscape (CVE-2026-99999), lets code inside guest VMs read host memory and enabled VM escape with root access in lab tests.

Read - https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html

Vercel confirmed the memory leak in its live production sandboxes during its $1 million security challenge.

The flaw lies in Linux networking, not the hypervisor, with implications beyond Vercel.