🛑 Pegasus spyware infected the iPhone of a Serbian university rector who backs student protests.

Citizen Lab confirmed the 0-click infection just 6 days before Serbia's election. A senior prosecutor was also flagged for likely spyware targeting.

Read - https://thehackernews.com/2026/10/pegasus-spyware-infection-confirmed-on.html

‼️ Hackers used autonomous AI agents to breach company websites with minimal human input.

A Chinese-language campaign targeted over 1,200 sites, with confirmed compromises. Exposed AI control panels revealed the attacks and hundreds of leaked secrets.

Full story: https://thehackernews.com/2026/10/hackers-use-autonomous-ai-agents-to.html

⚡ AI can now discover vulnerabilities, generate working exploits, and chain attacks in minutes.

Your security team can't afford to respond at yesterday's speed.

Join this FREE webinar to learn how to build security operations that keep pace with AI-driven threats.

Save your seat now - https://thehacker.news/ai-threat-readiness

🚨 Ransomware groups are still exploiting a patched Palo Alto Networks flaw.

Qilin and INC are abusing CVE-2026-0257 to gain corporate network access and bypass MFA for VPN sessions.

In one case, attackers pivoted to VMware ESXi and dumped domain credentials.

Read - https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html

🚨 A public exploit PoC is out for a critical Fortinet FortiSIEM flaw (CVE-2026-106173, CVSS 9.4).

The flaw can enable unauthenticated remote code execution by chaining path traversal and NUL-byte injection to overwrite files.

Details: https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html

‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised.

Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes.

Full details - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

⚠️ A nearly two-year breach of a Russian healthcare network went undetected until December 2025.

Belarus-aligned Cyber Partisans allegedly hid the Vasilek backdoor inside VMware Tools, using a disguised service to maintain access without destructive attacks.

Read - https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html

🛑 CISA orders federal agencies to patch 6 actively exploited flaws affecting Plex, Siemens, and SiteGuard.

Attackers are exploiting Plex2Shell flaws to deploy crypto miners and proxy malware. Siemens' flaw is being abused in ClickFix attacks.

Read - https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html

🚨 State Bank of India (SBI) confirms a data loss incident after identifying 3,897 customer records containing personal information in a dataset of roughly 375,000 records on the dark web.

Exposed details reportedly include names, phone numbers, dates of birth, addresses, and banking identifiers.

Read - https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html

⚡ The U.S. has ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying from the Chinese AI company.

The DHS order also covers third-party products and services built using DeepSeek implementations.

Details: https://thehackernews.com/2026/10/us-orders-deepseek-removed-from-federal.html

🚨 WordPress sites backdoored using valid UpdraftCentral keys.

Attackers pushed malicious plugins and created rogue admin accounts after TeamUpdraft disclosed a website breach.

99 distinct backdoor plugin names observed.

Details: https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html

🛑 Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords.

A researcher found 333 exits redirecting SSH traffic to 12 interception servers.

The Tor Project has since blocked the affected relays.

Here's how the attack worked: https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html

🚨 PHP2Shell: the one-line “fix” everyone shared overnight — session.upload_progress.enabled=0 — isn’t enough on its own, the firm that suggested it now says.

A PHP core developer put it bluntly: “the only mitigation is patching / upgrading PHP.”

No patch until 14:00 UTC today.

Here’s what actually cuts your risk before then → https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html

AI agents can find web app vulnerabilities. But can they prove the exploits without crossing security boundaries?

Pentera Apps pairs AI-driven pentesting with a deterministic harness that controls execution, logs actions, and generates replayable exploit scripts.

Here's how it works: https://thehackernews.com/2026/10/the-harness-is-hard-part-of-agentic.html

🚨 30+ real estate agents. Different senders. Unique property inquiries. One phishing objective.

Proofpoint reveals how an attacker used personalized conversations and video meeting invites, including a link abusing Google's redirect service, to disguise phishing attempts.

Here's how the campaign worked: https://thehackernews.com/2026/10/generative-ai-is-erasing-behavioral.html

🛑 China-aligned threat group Bronze Sandcastle is targeting organizations in Asia and Africa, abusing Sandboxie DLL sideloading to deploy encrypted backdoors.

Sophos reveals its attack methods, payloads, and infrastructure.

Read more → https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html

🚨 A trusted Adobe link could be the first step to an enterprise breach.

GeorgeGinx PhaaS is targeting U.S. organizations with device code phishing, exploiting familiar services to deceive users. 👀

ANY.RUN TI Feeds equip SOCs and MSSPs with unique threat indicators to identify malicious infrastructure and strengthen detection.

📊 Nearly 1 in 3 unique malicious IOCs found in sandbox investigations were already covered by ANY.RUN TI Feeds.

👉 Explore TI Feeds and give your team a smarter way to stay ahead of emerging threats: https://thn.news/live-threat-feeds-tl

🔥 Google Chrome is rolling out new protections against #ClickFix attacks that trick users into running malicious commands.

These attacks bypass browser download protections. Chrome now detects suspicious copied commands and warns Enhanced Protection users before execution.

Read more: https://thehackernews.com/2026/10/google-chrome-adds-clickfix-warnings-to.html

‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge.

The flaws can enable unauthenticated code execution and expose server memory.

👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619)

Details ➜ https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html