⚠️ 20,000+ Cloudflare Pages domains detected in a tech support scam operation.

Infoblox links the long-running Help TDS network to Hotejka, a suspected rebrand of ROI777.

The network redirects users to fake Windows security alerts designed to drive calls to scam support centers.

Read: https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html

🚨 Hackers are exploiting a WinRAR flaw to plant malware in government systems.

Silent Lynx used CVE-2025-8088 to drop PickleShell, a custom reverse shell, into the Windows Startup folder for execution at the next login.

Full story: https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html

‼️ NEW: Candiru spyware infected devices at Al Jazeera through ordinary online ads — no click, the ad only had to load.

The vendor that delivered it, Discover-Tech, was a Google-certified ad vendor.

Researchers call it the first proven case of spyware spread via targeted ads.

Read - https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html

⚡ Wait, wait... we're not done for the day yet!

27 MORE cybersecurity stories worth catching up on.

> VPN ransomware
> Adobe RCE
> NVIDIA escape bug
> DNS wallet theft
> self-healing backdoor
> Discord RAT
> jump-scare RAT
> AI key theft
> Meta GitHub breach
> browser theft
> Xen VM flaw
>WAF exploits
> SQL injection
+ more.

Your ThreatsDay Bulletin is here ↓ https://thehackernews.com/2026/10/threatsday-adobe-rce-dns-wallet-theft.html

‼️ A newly disclosed critical Linux kernel flaw, PwnEscape (CVE-2026-99999), lets code inside guest VMs read host memory and enabled VM escape with root access in lab tests.

Read - https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html

Vercel confirmed the memory leak in its live production sandboxes during its $1 million security challenge.

The flaw lies in Linux networking, not the hypervisor, with implications beyond Vercel.

🛑 Malware hidden inside legitimate FortiOS processes can bypass security checks on specially tagged VPN sessions.

Attackers deployed the memory-resident PEERSTITCH implant by exploiting a FortiOS flaw after a FortiManager breach.

Read - https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html

🚨 China-linked hackers exploited a BeyondTrust Remote Support zero-day to gain root access, establish persistence, and reach internal systems.

The Armory Castle group deployed SAWFLY and BARECLAW following the compromise.

Read - https://thehackernews.com/2026/10/china-linked-hackers-exploited.html

‼️ AI agents escaped their assigned tasks and accessed REAL systems in India.

CERT-In confirms they read confidential business records and personal data using exposed credentials and excessive cloud permissions.

None of them noticed. The AI firms reported it themselves.

Read: https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html

Get more time to revisit course labs after training ends, and a clearer shot at your next GIAC credential with any SANS CDI 2026 course by 11/15.

No promo code, no exclusions.
Dec 14-19 in D.C. and online.

Full details: https://thn.news/sans-initiative

⚠️ An OpenAI research model spent test ETH from a third-party wallet without permission to deploy a smart contract.

It derived wallet keys from public seed phrases after failing to get free tokens.

One of 7 new misalignment incidents.

Read - https://thehackernews.com/2026/10/openai-research-model-spent-3rd-party.html

“Mitigated” doesn't always mean the threat is gone.

In 2025 SOC data, live memory scans found ~2,600 infected machines. 51% had already been marked mitigated by EDR.

AI decision models can speed up alert triage. But confident verdicts still need forensic evidence.

Read → https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html

🚨 UAT-11985 is targeting Taiwan research affiliates with fake event invitations and tampered QR codes.

The lures lead to spoofed Google sign-in pages designed to intercept passwords and MFA codes in real time using AitM phishing.

Read - https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html

‼️ NEW - Attackers tampered with AOMEI Backupper’s update servers in 5–10-minute bursts, delivering a backdoor to PCs checking for updates.

Organizations across 11 countries were affected. AOMEI says its servers are fixed, but infected machines remain compromised.

Read - https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html

‼️ A 37-year-old BSD bug can still help gain root on OpenBSD 7.9.

Researchers released a local exploit PoC chaining the shared-memory overflow with a kernel use-after-free, bypassing KARL, SMAP and SMEP.

Read - https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html

‼️ ALERT: Attackers used a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 customer and partner tenants.

The credential enabled Microsoft Graph access using existing app permissions, potentially exposing emails, files, and Teams data.

Read - https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html

🚨 A malicious npm package is still available after 979 downloads.

Part of the MALFEX campaign, imgdecode hides a Windows DLL that can fetch encrypted shellcode from GitHub and inject it into dllhost.exe when loaded from a Windows console.

Read: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html

🚨 ConnectWise has suspended Cloud Backup and disabled 7 app identities after attackers compromised Microsoft 365 tenants.

Backups and restores are unavailable. Previously issued access tokens may remain valid.

Read: https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html

‼️ OpenCode confirms a security breach that may have exposed users' OpenAI, Anthropic, and Google API keys.

1.4% of Console users affected. Some report unauthorized AI usage charges.

OpenCode urges affected users to revoke their keys.

Read - https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

🚨 An unpatched Broadcom Wi-Fi flaw lets attackers within radio range execute code as ROOT on affected routers, without a Wi-Fi password or pairing.

Researcher demonstrated password extraction and a remote shell. Potentially impacting millions of routers.

Read - https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html

⚠️ A fake Web3 accelerator is targeting crypto developers with investment offers and free AI tools that deliver malware through npm packages.

The packages deploy a Windows stealer and macOS backdoor, redirect AI agent requests to attacker-controlled services, and generate fake security audit findings.

Read - https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html