🚨 Keystone to destroy 18,835 hardware wallets after hackers stole its device verification key.

The stolen key could let counterfeit wallets pass as genuine. The breach also affected 25,964 buyer records.

What to do ↓ https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html

⚠️ A Gemini agent in a security test reportedly accessed 3 real companies, one by guessing a password.

Anthropic says a fake “discounted Claude” reseller stole buyers’ credentials. Same weak point: a credential someone can guess, find, or steal.

Read: https://thn.news/ai-security-risks

🚨 Microsoft Authenticator flaw let malicious Android apps impersonate Teams and obtain work account sign-in tokens.

No app permissions needed. Researchers demonstrated access to email, files, and calendars.

Microsoft has patched it.

🔗 Read more ↓ https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html

⚠️ Fake login pages aren't just stealing passwords anymore.

AI makes phishing pages easier to clone and personalize. Some attacks go further, stealing MFA codes or hijacking authenticated sessions to access corporate accounts.

How these attacks work and what stops them ↓ https://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html

🚨 Apple patches a possibly exploited CoreGraphics flaw on older iPhones and iPads.

CVE-2026-86950 could allow arbitrary code execution. Apple says it may have been used in targeted attacks against specific individuals.

The fix is now available in iOS 18.7.11 and iPadOS 18.7.11.

Details → https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html

‼️ WARNING - Hundreds of millions of devices run GoAhead's embedded web server.

Now, 3 TLS vulnerabilities have been disclosed that can allow revoked client certificates to authenticate or expose encrypted sessions to decryption.

Affected builds use specific OpenSSL, LibreSSL, or Mbed TLS configurations.

Read more: https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html

AI made developers faster, so who is paying for the cleanup that follows?

ActiveState asked 307 enterprise leaders what AI is doing to their workload, and 94% said it has increased the amount of software that needs remediation or cleanup. The new report shows where that cost lands and how moving open source software controls upstream reduces it.

Download the Report - https://thn.news/ai-security-bill

🚨 44 AI agents coordinating cyberattacks.

CyberStrikeAI is being used to automate attacks targeting Japanese organizations, from reconnaissance and exploitation to command-and-control.

At least 19 organizations were subjected to vulnerability validation.

Read: https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html

🚨 CISA adds two actively exploited flaws in Adobe Commerce/Magento and Google Brotli to its KEV catalog.

➜ PolyShell: Attackers breached hundreds of online stores and injected malicious loaders.

➜ Node2Shell: RCE exploit attempts detected in the wild.
Federal patch deadline: November 10.

Full details: https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html

‼️ The Oracle PeopleSoft zero-day exploited by ShinyHunters was actually THREE chained flaws.

New technical analysis reveals how an SSRF flaw bypasses internal access controls, enabling unauthenticated remote code execution.

All three were patched under one CVE: CVE-2026-35273.

Details → https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html

‼️ Tailscale finally issued patches for SSH flaws that could turn one hacked device into root access on other servers.

The Tailworm research demonstrated rapid lateral movement across policy-permitted devices, without stolen passwords or user interaction.

⚠️ Headscale remains UNPATCHED.

Read - https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html

🚨 Rooted Android doesn't mean compromised. Unrooted doesn't mean secure.

So why rely on root detection alone?

Guardsquare breaks down how heuristic and hardware-backed checks help assess mobile security threats.

Here's what you need to know - https://thehackernews.com/videos/2026/10/why-root-and-jailbreak-detection-alone.html

🚨 Japan's GMO is offering up to $1 MILLION for tips that help catch hackers behind a breach of its FX trading cloud service.

The attackers demanded $50 million. GMO refused to pay.

Customer data was stolen, and unauthorized FX trades have been linked to leaked credentials.

Full story: https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html

🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.

Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.

Patch now → 22.23.4 / 24.22.1 / 26.12.1

Read ↓ https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html#update-code-execution-on-x86-64-and-first-in-the-wild-traffic

🚨 FBI seizes Virtualine domain in international law enforcement operation.

The bulletproof hosting provider is accused of hosting illegal content despite repeated warnings and laundering criminal payments through Bitcoin.

Here's what the DoJ uncovered: https://thehackernews.com/2026/10/fbi-seizes-virtualine-domain-over.html

🛑 An unreleased Anthropic AI model chained security flaws into working exploits across Chrome, Safari, Android, Windows, and Linux.

One Chrome exploit escaped the browser sandbox and launched Calculator on a Mac just by loading a page.

Details on five chained exploits → https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html

🚨 Skyw4lker phishing campaign targets U.S. firms using Microsoft 365 device code phishing.

No password theft required.

Attackers use fake business documents and Google Sites to trick victims into authorizing access to their Microsoft 365 accounts.

How the attack works ↓ https://thehackernews.com/2026/10/american-organizations-under-attack.html

🚨 GhostAction supply-chain attacks are much bigger than initially reported.

→ 22,964 GitHub repositories targeted
→ 72,000+ malicious commits pushed
→ 1,792 accounts compromised
→ 5 payload families targeting CI/CD secrets, developer machines, and cloud credentials

Researchers warn stolen GitHub tokens are still being reused.

Read: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html

Most TPRM programs end at approval. But, the real risk starts after that.

Work doesn’t wait for the next audit. Employees invite collaborators, connect new integrations, turn on AI features. The vendor changes sub-processors and ships new products on its own schedule.

So what should “approved” actually mean, when the thing you approved keeps changing?

🎙️ Join Russell Spitler, CEO and co-founder of Nudge Security and guest Ed Amoroso of TAG Infosphere for a discussion around how third party risk has changed with modern work.

🗓️ Thursday, October 29 at 1pm CT

Register now 👇 https://thn.news/attack-surface-review

#infosec #tprm #grc #saas

‼️ Critical 16-year-old flaw in EDK II UEFI firmware could let attackers execute code before Secure Boot checks.

CVE-2026-97631 affects PXE network boot, requires local network access and target-specific exploitation.

No patched stable EDK II release yet.

Full details → https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html