‼️ ALERT - Popular WordPress plugin "Rank Math PRO" delivered malware through official downloads and updates for nearly 11 hours on October 15–16.

Websites that installed and activated affected builds should be treated as compromised.

The malware can recreate hidden backdoors whenever a site is visited.

Upgrading alone is NOT enough.

Details → https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html

🛑 Hackers are exploiting four patched Plex Media Server flaws chained as Plex2Shell to deploy cryptocurrency miners and a Linux proxy backdoor.

Attacks began just one day after exploit details went public. Plex users should update to version 1.43.3.10861 or later.

Read - https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html

⚠️ Researchers uncovered ROMULUS, a ClickFix malware delivery platform with admin panels found on six servers.

It delivers trojanized Stardock installers and LegionLoader, including an 842 MiB executable padded to evade some file-size scanning limits.

Read - https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html

‼️ A former OpenAI engineer has been ordered detained over an alleged hidden recording device in an executive conference room.

New court filings reveal he was in frequent contact with a Saudi royal family member who reportedly tried to recruit him.

More: https://thehackernews.com/2026/10/ex-openai-engineer-detained-in-spy.html

🚨 Siemens has patched a high-severity Software Center flaw exploited in ClickFix attacks.

Attackers abuse the trusted, digitally signed application to sideload malicious DLLs, with some campaigns deploying remote access trojans.

CVE-2026-110936 | Fixed in v4.0.9.8
Read - https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html

🚨 Attackers hijacked five OVHcloud CLI releases on GitHub, replacing legitimate downloads with malware designed to steal secrets from infected machines.

The malicious files were available for up to 94 minutes on October 19.

Users who downloaded or updated affected builds during that window should rotate exposed secrets.

Read more: https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html

Salesforce Agentforce flaws (dubbed SalesBleed) allowed malicious CRM leads to trigger data exfiltration and phishing across internal Slack threads.

Len Noe of BeyondTrust breaks down why AI agent permissions & message attribution are critical:

🔗 https://thehackernews.com/expert-insights/2026/10/the-least-trusted-author-sets-ai-agents.html

🚨 UPDATE: ConnectWise Cloud Backup remains offline after unauthorized access to application identities.

ConnectWise is resetting accounts and app credentials, while SaaS Security and Cloud Management remain suspended.

Partners must review their Microsoft 365 tenants for unauthorized activity.

Read - https://thehackernews.com/2026/10/connectwise-resets-credentials-as-cloud.html

🚨 Russian-linked APT28 targeted organizations in two NATO countries using the HOOKEDGE backdoor and a previously undocumented malware loader.

At a naval shipbuilder, attackers stole credentials, established a persistent SSH tunnel into the internal network, and deployed the new loader.

Details: https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html

‼️ BREAKING: Go has issued an URGENT security update blocking 8 certificate authority keys over undisclosed security concerns.

It will reject certificate chains using these keys, potentially breaking connections for rebuilt applications.

The filter cannot be disabled.

Here's what we know: https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html

🛑 WhatsApp hid instructions telling its AI support chatbot not to recommend contacting privacy regulators, even to users unable to delete their accounts.

Other instructions restricted GDPR references when users mentioned legal action.

Read → https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html

⚠️ AI agents and apps are spreading across organizations faster than security teams can govern them.

The risks: excessive permissions, data exposure, unintended actions, and zero ownership.

Why policies & sandboxes aren't enough and what to do instead: https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html

Policies tell your team what not to share. NordLayer AI Scout actually enforces it.

Every prompt is scanned before it leaves the device, so sensitive data stays in your company.

If credentials, production secrets, or client data show up in a prompt, the rule you set is applied automatically:

— Log it without interrupting the employee
— Pause the prompt and let the employee block, redact, or proceed with it
— Hide sensitive text automatically, then send the prompt
— Stop the prompt from being sent, no override

From written policy to real-time enforcement, without slowing your team down.

Learn more 🠖 https://thn.news/sans-ai-resources

🛑 Pegasus spyware infected the iPhone of a Serbian university rector who backs student protests.

Citizen Lab confirmed the 0-click infection just 6 days before Serbia's election. A senior prosecutor was also flagged for likely spyware targeting.

Read - https://thehackernews.com/2026/10/pegasus-spyware-infection-confirmed-on.html

‼️ Hackers used autonomous AI agents to breach company websites with minimal human input.

A Chinese-language campaign targeted over 1,200 sites, with confirmed compromises. Exposed AI control panels revealed the attacks and hundreds of leaked secrets.

Full story: https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html

⚡ AI can now discover vulnerabilities, generate working exploits, and chain attacks in minutes.

Your security team can't afford to respond at yesterday's speed.

Join this FREE webinar to learn how to build security operations that keep pace with AI-driven threats.

Save your seat now - https://thehacker.news/ai-threat-readiness

🚨 Ransomware groups are still exploiting a patched Palo Alto Networks flaw.

Qilin and INC are abusing CVE-2026-0257 to gain corporate network access and bypass MFA for VPN sessions.

In one case, attackers pivoted to VMware ESXi and dumped domain credentials.

Read - https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html

🚨 A public exploit PoC is out for a critical Fortinet FortiSIEM flaw (CVE-2026-106173, CVSS 9.4).

The flaw can enable unauthenticated remote code execution by chaining path traversal and NUL-byte injection to overwrite files.

Details: https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html

‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised.

Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes.

Full details - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html