‼️ Tailscale finally issued patches for SSH flaws that could turn one hacked device into root access on other servers.

The Tailworm research demonstrated rapid lateral movement across policy-permitted devices, without stolen passwords or user interaction.

⚠️ Headscale remains UNPATCHED.

Read - https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html

🚨 Rooted Android doesn't mean compromised. Unrooted doesn't mean secure.

So why rely on root detection alone?

Guardsquare breaks down how heuristic and hardware-backed checks help assess mobile security threats.

Here's what you need to know - https://thehackernews.com/videos/2026/10/why-root-and-jailbreak-detection-alone.html

🚨 Japan's GMO is offering up to $1 MILLION for tips that help catch hackers behind a breach of its FX trading cloud service.

The attackers demanded $50 million. GMO refused to pay.

Customer data was stolen, and unauthorized FX trades have been linked to leaked credentials.

Full story: https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html

🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.

Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.

Patch now → 22.23.4 / 24.22.1 / 26.12.1

Read ↓ https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html#update-code-execution-on-x86-64-and-first-in-the-wild-traffic

🚨 FBI seizes Virtualine domain in international law enforcement operation.

The bulletproof hosting provider is accused of hosting illegal content despite repeated warnings and laundering criminal payments through Bitcoin.

Here's what the DoJ uncovered: https://thehackernews.com/2026/10/fbi-seizes-virtualine-domain-over.html

🛑 An unreleased Anthropic AI model chained security flaws into working exploits across Chrome, Safari, Android, Windows, and Linux.

One Chrome exploit escaped the browser sandbox and launched Calculator on a Mac just by loading a page.

Details on five chained exploits → https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html

🚨 Skyw4lker phishing campaign targets U.S. firms using Microsoft 365 device code phishing.

No password theft required.

Attackers use fake business documents and Google Sites to trick victims into authorizing access to their Microsoft 365 accounts.

How the attack works ↓ https://thehackernews.com/2026/10/american-organizations-under-attack.html

🚨 GhostAction supply-chain attacks are much bigger than initially reported.

→ 22,964 GitHub repositories targeted
→ 72,000+ malicious commits pushed
→ 1,792 accounts compromised
→ 5 payload families targeting CI/CD secrets, developer machines, and cloud credentials

Researchers warn stolen GitHub tokens are still being reused.

Read: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html

Most TPRM programs end at approval. But, the real risk starts after that.

Work doesn’t wait for the next audit. Employees invite collaborators, connect new integrations, turn on AI features. The vendor changes sub-processors and ships new products on its own schedule.

So what should “approved” actually mean, when the thing you approved keeps changing?

🎙️ Join Russell Spitler, CEO and co-founder of Nudge Security and guest Ed Amoroso of TAG Infosphere for a discussion around how third party risk has changed with modern work.

🗓️ Thursday, October 29 at 1pm CT

Register now 👇 https://thn.news/attack-surface-review

#infosec #tprm #grc #saas

‼️ Critical 16-year-old flaw in EDK II UEFI firmware could let attackers execute code before Secure Boot checks.

CVE-2026-97631 affects PXE network boot, requires local network access and target-specific exploitation.

No patched stable EDK II release yet.

Full details → https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html

🚨 Adobe fixes 8 critical flaws in Campaign Classic, including 4 rated CVSS 9.9.

The vulnerabilities could allow arbitrary code execution, security bypass, and privilege escalation.

Windows and Linux versions affected.

Details ↓ https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html

🚨 Hackers are probing a critical Oracle E-Business Suite vulnerability just days after it was patched.

CVE-2026-101767 (CVSS 9.8) allows unauthenticated SQL injection that can lead to remote code execution.

Exploit attempts were detected on decoy systems on October 27.

What we know ↓ https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

Wazuh is using Claude and Amazon Bedrock to automate security reporting.

Its AI Analyst generates scheduled reports covering active vulnerabilities, security alerts, endpoint coverage, and overall security posture, with no manual configuration.

Here's how it works ↓ https://thehackernews.com/2026/10/wazuh-and-ai-for-enhanced-soc-workflows.html

Gartner's read on the state of enterprise AI governance: traditional approaches are too slow, static, and fragmented to keep pace with the volume, velocity, and autonomy of modern AI systems.

Most enterprises have invested heavily in both AI security and AI governance. The gap between those two investments is where the exposure actually lives.

Gartner evaluated platforms built to solve that. Airia ranked #1 in AI Security in the 2026 Critical Capabilities for AI Governance Platforms by putting governance controls directly in the execution path of AI systems, not alongside them.

Read the report: https://thn.news/ai-governance-platform

🚨 PHP2Shell exploited in real-world attacks.

An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.

The intrusion extended into the internal network, where the attacker targeted Active Directory.

Suspected China nexus. Signs of AI-assisted tooling.

Read the full report: https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html

‼️ Microsoft Edge's sandbox was bypassed using logic flaws alone. No memory corruption.

Security researcher Orange Tsai demonstrated a chain that turned a malicious web page into code execution outside the browser sandbox, earning $175,000 at Pwn2Own 2026.

The full exploit technique is now public ↓ https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html

‼️ One-tap installs are coming to 3rd-party Android app stores.

The catch: they must send Google their full catalog, and every update, for malware scans.

▸ From Dec 1
▸ Android 17 QPR2+
▸ Not in the US

Read → https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html

🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day exploitation campaigns.

Dubbed "Silent Train," it concealed attacks on enterprise management systems and supported strategic access to U.S. networks.

Read: https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html

🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces.

The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending.

Read ↓ https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

🚨 China-linked hackers exploited a VMware ESX zero-day to conceal activity from audit logs.

CrowdStrike links the attacks to Warp Panda, which targeted the U.S. legal sector.

CISA has now added CVE-2026-41709 to its KEV catalog.

Details: https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html