🛑 Railway reports a security incident involving systems storing customer environment variables.

An unauthorized party may have accessed encrypted secrets and, in some cases, decrypted contents.

Railway has invalidated API tokens and urges users to rotate credentials.

Details → https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html

⚡ INTERPOL arrests 1,462 suspects and disrupts 10,909 malicious networks in a major cybercrime crackdown.

21 countries. Over $105 million recovered. More than $385 million in losses linked to criminal activity.

Inside Operation Serengeti III ↓ https://thehackernews.com/2026/10/interpol-arrests-1462-suspects-disrupts.html

🔥 Your biggest AI insider threat may already be on an employee's laptop.

AI agents can access API keys, passwords, and internal systems without proper oversight.

Join Bitdefender's webinar to learn how to detect and govern shadow AI.

Save your seat → https://thehackernews.com/2026/10/the-ai-agent-nobody-owns-watch-expert.html

‼️ Meta ordered to pay $25 BILLION.

A New Mexico court found more than 43 million violations tied to Facebook's misleading data privacy promises.


The ruling stems from a lawsuit linked to the Cambridge Analytica scandal.

Full story ↓ https://thehackernews.com/2026/10/meta-ordered-to-pay-25-billion-after.html

‼️ ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's KSMBD SMB server were disclosed on public kernel mailing lists before fixes were ready.

One can be triggered WITHOUT authentication.

Neither has a mainline kernel fix.

Details here ↓ https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

🚨 eMudhra is exiting the global SSL/TLS certificate business.

The decision comes just 5 days after a researcher exposed 8 easily guessable CA private keys.

Chrome and Firefox are withdrawing trust in its ECC root, leaving roughly 30,000 certificates needing replacement.

Here's what to do ↓ https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html

‼️ Critical VeloCloud SQL injection flaw exploited in the wild.

Tracked as CVE-2026-114625 (CVSS 9.9), the flaw lets even read-only users escalate to full operator privileges.

Arista confirms active attacks.

What admins need to know ↓ https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html

‼️ PHP2Shell exploit attempts hit millions as attackers try to deploy Mirai malware. Exposed attacker servers reveal RCE tooling.

No successful compromises confirmed so far.

Inside the payloads, exploit tools, and failed attempts → https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html

🛑 ALERT - Node2Shell RCE exploit works on an official Node.js build.

Researchers demonstrated how crafted Brotli data can trigger code execution through vulnerable Node.js applications, without modifying the runtime.

Here's how the exploit works: https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html

🚨 A malicious API could drain an AI agent's token balance via an x402 SDK flaw.

V12 rated 3 bugs critical:
— No default spending cap
— Solana approvals passed as payments
— Logins signed for other sites

All patched. No advisory, so npm audit & PyPI miss them.

Read more ↓ https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html

🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library.

CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript.

What you need to know ↓ https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html

🚨 Russian state-sponsored Sandworm wiped a Ukrainian logistics firm after UAC-0099 handed over access.

The intrusion involved a new backdoor, MythicRatatoskr, controlled through the Yggdrasil mesh network.

Inside the two-group operation ↓ https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html

‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.

New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.

Full details → https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

Former-employee data with no end date is still in scope for breaches, legal requests, and audits.

Live demo: defensible deletion in Google Workspace, from approval to Vault export to verified deletion.

Free · Oct 29 · 2 pm ET → https://thn.news/cost-saving-webinar

🚨 Exposed infrastructure reveals how ransomware affiliates used AI to hack networks and steal data.

8,257 messages. 133 AI sessions. 62 organizations targeted.

Operators exploited Fortinet, SimpleHelp, and cPanel flaws.

Inside the operation ↓ https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html

‼️ FOUR critical GitLab RCE flaws traced back to just THREE bugs in Ruby's regex engine.

Ruby has now fixed them, but this isn't just a GitLab issue.

Other Ruby apps that compile attacker-controlled regex patterns are also affected.

Details ➜ https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html

🚨 Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t.

Over 70,000 exposed credentials identified. Fortinet and Palo Alto devices targeted. Persistent access established. Data exfiltrated.

Inside the attack chain and suspected ransomware links: https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html

‼️ Patched, but still exploitable.

The new BlackX UEFI bootkit bypasses Secure Boot on Windows systems missing required revocations, even after the patch is installed.

Attackers used it in breaches of Central Asian diplomatic networks after gaining admin access.

Details: https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html

🚨 UPDATE: Railway says hackers targeted AI API keys to carry out model distillation attacks.

Up to 100,000 workspaces may have been exposed.

Attackers allegedly used uncensored AI models and massive compute resources to breach its infrastructure.

What we know: https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html

🚨 Two critical flaws. Both actively exploited.

CISA confirms attacks targeting Collabora Online and Arista VeloCloud.

• Collabora flaw exploited to plant web shells on Nextcloud servers
• Third exploited VeloCloud flaw since July
Federal patch deadline: October 26.

Read more ↓ https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html