Get more time to revisit course labs after training ends, and a clearer shot at your next GIAC credential with any SANS CDI 2026 course by 11/15.

No promo code, no exclusions.
Dec 14-19 in D.C. and online.

Full details: https://thn.news/sans-initiative

⚠️ An OpenAI research model spent test ETH from a third-party wallet without permission to deploy a smart contract.

It derived wallet keys from public seed phrases after failing to get free tokens.

One of 7 new misalignment incidents.

Read - https://thehackernews.com/2026/10/openai-research-model-spent-3rd-party.html

“Mitigated” doesn't always mean the threat is gone.

In 2025 SOC data, live memory scans found ~2,600 infected machines. 51% had already been marked mitigated by EDR.

AI decision models can speed up alert triage. But confident verdicts still need forensic evidence.

Read → https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html

🚨 UAT-11985 is targeting Taiwan research affiliates with fake event invitations and tampered QR codes.

The lures lead to spoofed Google sign-in pages designed to intercept passwords and MFA codes in real time using AitM phishing.

Read - https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html

‼️ NEW - Attackers tampered with AOMEI Backupper’s update servers in 5–10-minute bursts, delivering a backdoor to PCs checking for updates.

Organizations across 11 countries were affected. AOMEI says its servers are fixed, but infected machines remain compromised.

Read - https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html

‼️ A 37-year-old BSD bug can still help gain root on OpenBSD 7.9.

Researchers released a local exploit PoC chaining the shared-memory overflow with a kernel use-after-free, bypassing KARL, SMAP and SMEP.

Read - https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html

‼️ ALERT: Attackers used a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 customer and partner tenants.

The credential enabled Microsoft Graph access using existing app permissions, potentially exposing emails, files, and Teams data.

Read - https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html

🚨 A malicious npm package is still available after 979 downloads.

Part of the MALFEX campaign, imgdecode hides a Windows DLL that can fetch encrypted shellcode from GitHub and inject it into dllhost.exe when loaded from a Windows console.

Read: https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html

🚨 ConnectWise has suspended Cloud Backup and disabled 7 app identities after attackers compromised Microsoft 365 tenants.

Backups and restores are unavailable. Previously issued access tokens may remain valid.

Read: https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html

‼️ OpenCode confirms a security breach that may have exposed users' OpenAI, Anthropic, and Google API keys.

1.4% of Console users affected. Some report unauthorized AI usage charges.

OpenCode urges affected users to revoke their keys.

Read - https://thehackernews.com/2026/10/opencode-console-breach-may-have.html

🚨 An unpatched Broadcom Wi-Fi flaw lets attackers within radio range execute code as ROOT on affected routers, without a Wi-Fi password or pairing.

Researcher demonstrated password extraction and a remote shell. Potentially impacting millions of routers.

Read - https://thehackernews.com/2026/10/unpatched-broadcom-wi-fi-flaw-lets.html

⚠️ A fake Web3 accelerator is targeting crypto developers with investment offers and free AI tools that deliver malware through npm packages.

The packages deploy a Windows stealer and macOS backdoor, redirect AI agent requests to attacker-controlled services, and generate fake security audit findings.

Read - https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html

AI is testing the limits of post-quantum cryptography.

An Anthropic AI model found an attack that halved HAWK's effective security in just 60 hours, prompting its withdrawal from NIST consideration.

Itan Barmes of QIZ Security explains why cryptographic agility now matters more than ever.

Read: https://thehackernews.com/expert-insights/2026/10/security-rests-on-hard-math-problems.html

OOgly Search's AI had a few recipe suggestions. The user had questions. Legal had a meltdown. 🍕💀

AI: Put glue on your pizza.
User: Excuse me?

AI: Should I recommend eating rocks instead?
User: PLEASE STOP HELPING.

OOgly Search's AI Risk Score just dropped to 375 📉
Monitor AI risk like you monitor your credit score.

Your AI probably isn't recommending glue on pizza. But what risks are hiding in plain sight? 👀

Check your AI Risk Score at https://thn.news/ai-risk-insight

UMAI | AI Risk, Measured

OOgly Search is fictional. The AI incidents that inspired this parody aren't. The score is illustrative, not an actual assessment.

🚨 GhostAction attackers planted a credential stealer disguised as a font file in 94 compromised GitHub repositories.

The malware runs when affected projects are opened in VS Code, steals developer credentials, and adds persistence.

Read - https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html

What happens when customer emails become instructions for internal AI agents?

Salesforce Agentforce's standard workflows can create that path without misconfiguration.

The bigger problem: enterprises often lack visibility into their agents, permissions, and exposure.

Here's what needs to change: https://thehackernews.com/2026/10/from-email-to-case-to-boardroom-how.html

⚡ Cloud breach shuts down backups. AI agents go rogue. $100M stolen via wallet backdoors.

Also this week:
→ 98 zero-days exposed
→ 1B phishing messages
→ Remote support flaw exploited
→ 700+ supermarkets hit
→ Malicious developer packages

The full ThreatsDay recap ↓ https://thehackernews.com/2026/10/weekly-recap-98-zero-days-rogue-ai.html

‼️ ALERT - Popular WordPress plugin "Rank Math PRO" delivered malware through official downloads and updates for nearly 11 hours on October 15–16.

Websites that installed and activated affected builds should be treated as compromised.

The malware can recreate hidden backdoors whenever a site is visited.

Upgrading alone is NOT enough.

Details → https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html

🛑 Hackers are exploiting four patched Plex Media Server flaws chained as Plex2Shell to deploy cryptocurrency miners and a Linux proxy backdoor.

Attacks began just one day after exploit details went public. Plex users should update to version 1.43.3.10861 or later.

Read - https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html

⚠️ Researchers uncovered ROMULUS, a ClickFix malware delivery platform with admin panels found on six servers.

It delivers trojanized Stardock installers and LegionLoader, including an 842 MiB executable padded to evade some file-size scanning limits.

Read - https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html