⚡ AI can now discover vulnerabilities, generate working exploits, and chain attacks in minutes.

Your security team can't afford to respond at yesterday's speed.

Join this FREE webinar to learn how to build security operations that keep pace with AI-driven threats.

Save your seat now - https://thehacker.news/ai-threat-readiness

🚨 Ransomware groups are still exploiting a patched Palo Alto Networks flaw.

Qilin and INC are abusing CVE-2026-0257 to gain corporate network access and bypass MFA for VPN sessions.

In one case, attackers pivoted to VMware ESXi and dumped domain credentials.

Read - https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html

🚨 A public exploit PoC is out for a critical Fortinet FortiSIEM flaw (CVE-2026-106173, CVSS 9.4).

The flaw can enable unauthenticated remote code execution by chaining path traversal and NUL-byte injection to overwrite files.

Details: https://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.html

‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised.

Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes.

Full details - https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online.

Researchers report potential RCE.

CVE-2026-109618 and CVE-2026-109619.

Fixes scheduled for October 21, 14:00 UTC.

Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

⚠️ A nearly two-year breach of a Russian healthcare network went undetected until December 2025.

Belarus-aligned Cyber Partisans allegedly hid the Vasilek backdoor inside VMware Tools, using a disguised service to maintain access without destructive attacks.

Read - https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html

🛑 CISA orders federal agencies to patch 6 actively exploited flaws affecting Plex, Siemens, and SiteGuard.

Attackers are exploiting Plex2Shell flaws to deploy crypto miners and proxy malware. Siemens' flaw is being abused in ClickFix attacks.

Read - https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html

🚨 State Bank of India (SBI) confirms a data loss incident after identifying 3,897 customer records containing personal information in a dataset of roughly 375,000 records on the dark web.

Exposed details reportedly include names, phone numbers, dates of birth, addresses, and banking identifiers.

Read - https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html

⚡ The U.S. has ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying from the Chinese AI company.

The DHS order also covers third-party products and services built using DeepSeek implementations.

Details: https://thehackernews.com/2026/10/us-orders-deepseek-removed-from-federal.html

🚨 WordPress sites backdoored using valid UpdraftCentral keys.

Attackers pushed malicious plugins and created rogue admin accounts after TeamUpdraft disclosed a website breach.

99 distinct backdoor plugin names observed.

Details: https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html

🛑 Attackers hijacked over 300 Tor exit relays to intercept SSH connections and steal login passwords.

A researcher found 333 exits redirecting SSH traffic to 12 interception servers.

The Tor Project has since blocked the affected relays.

Here's how the attack worked: https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html

🚨 PHP2Shell: the one-line “fix” everyone shared overnight — session.upload_progress.enabled=0 — isn’t enough on its own, the firm that suggested it now says.

A PHP core developer put it bluntly: “the only mitigation is patching / upgrading PHP.”

No patch until 14:00 UTC today.

Here’s what actually cuts your risk before then → https://thehackernews.com/2026/10/php2shell-what-actually-protects-you.html

AI agents can find web app vulnerabilities. But can they prove the exploits without crossing security boundaries?

Pentera Apps pairs AI-driven pentesting with a deterministic harness that controls execution, logs actions, and generates replayable exploit scripts.

Here's how it works: https://thehackernews.com/2026/10/the-harness-is-hard-part-of-agentic.html

🚨 30+ real estate agents. Different senders. Unique property inquiries. One phishing objective.

Proofpoint reveals how an attacker used personalized conversations and video meeting invites, including a link abusing Google's redirect service, to disguise phishing attempts.

Here's how the campaign worked: https://thehackernews.com/2026/10/generative-ai-is-erasing-behavioral.html

🛑 China-aligned threat group Bronze Sandcastle is targeting organizations in Asia and Africa, abusing Sandboxie DLL sideloading to deploy encrypted backdoors.

Sophos reveals its attack methods, payloads, and infrastructure.

Read more → https://thehackernews.com/2026/10/china-aligned-bronze-sandcastle-abuses.html

🚨 A trusted Adobe link could be the first step to an enterprise breach.

GeorgeGinx PhaaS is targeting U.S. organizations with device code phishing, exploiting familiar services to deceive users. 👀

ANY.RUN TI Feeds equip SOCs and MSSPs with unique threat indicators to identify malicious infrastructure and strengthen detection.

📊 Nearly 1 in 3 unique malicious IOCs found in sandbox investigations were already covered by ANY.RUN TI Feeds.

👉 Explore TI Feeds and give your team a smarter way to stay ahead of emerging threats: https://thn.news/live-threat-feeds-tl

🔥 Google Chrome is rolling out new protections against #ClickFix attacks that trick users into running malicious commands.

These attacks bypass browser download protections. Chrome now detects suspicious copied commands and warns Enhanced Protection users before execution.

Read more: https://thehackernews.com/2026/10/google-chrome-adds-clickfix-warnings-to.html

‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge.

The flaws can enable unauthenticated code execution and expose server memory.

👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619)

Details ➜ https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html

Every security vendor is shipping AI agents. Few are asking what those agents are actually acting on. 🤔

An agent that remediates based on one tool’s partial view of an asset isn’t saving time. It’s automating mistakes at machine speed.

The secret weapon isn’t the AI. It’s the data underneath it.

That’s the bet Axonius is making with its AI Workforce: Virtual Workers that monitor, flag, and fix, all grounded in one reconciled view of every asset and exposure. Humans stay in the loop where it matters, and autonomy is earned, not assumed.

Is your AI working from ground truth, or a best guess? 👇

Learn more: https://thn.news/ai-threat-defense

⚠️ OpenAI's GPT-6 agents disabled security alerts and removed safety monitoring while carrying out routine coding tasks.

In one case, an agent falsely denied removing monitoring functionality.

OpenAI is now investigating why its agents weakened safeguards meant to oversee their behavior.

Read - https://thehackernews.com/2026/10/openais-gpt-6-agent-removed-safety.html