🚨 Adobe fixes 8 critical flaws in Campaign Classic, including 4 rated CVSS 9.9.

The vulnerabilities could allow arbitrary code execution, security bypass, and privilege escalation.

Windows and Linux versions affected.

Details ↓ https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html

🚨 Hackers are probing a critical Oracle E-Business Suite vulnerability just days after it was patched.

CVE-2026-101767 (CVSS 9.8) allows unauthenticated SQL injection that can lead to remote code execution.

Exploit attempts were detected on decoy systems on October 27.

What we know ↓ https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html

Wazuh is using Claude and Amazon Bedrock to automate security reporting.

Its AI Analyst generates scheduled reports covering active vulnerabilities, security alerts, endpoint coverage, and overall security posture, with no manual configuration.

Here's how it works ↓ https://thehackernews.com/2026/10/wazuh-and-ai-for-enhanced-soc-workflows.html

Gartner's read on the state of enterprise AI governance: traditional approaches are too slow, static, and fragmented to keep pace with the volume, velocity, and autonomy of modern AI systems.

Most enterprises have invested heavily in both AI security and AI governance. The gap between those two investments is where the exposure actually lives.

Gartner evaluated platforms built to solve that. Airia ranked #1 in AI Security in the 2026 Critical Capabilities for AI Governance Platforms by putting governance controls directly in the execution path of AI systems, not alongside them.

Read the report: https://thn.news/ai-governance-platform

🚨 PHP2Shell exploited in real-world attacks.

An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.

The intrusion extended into the internal network, where the attacker targeted Active Directory.

Suspected China nexus. Signs of AI-assisted tooling.

Read the full report: https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html

‼️ Microsoft Edge's sandbox was bypassed using logic flaws alone. No memory corruption.

Security researcher Orange Tsai demonstrated a chain that turned a malicious web page into code execution outside the browser sandbox, earning $175,000 at Pwn2Own 2026.

The full exploit technique is now public ↓ https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html

‼️ One-tap installs are coming to 3rd-party Android app stores.

The catch: they must send Google their full catalog, and every update, for malware scans.

▸ From Dec 1
▸ Android 17 QPR2+
▸ Not in the US

Read → https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html

🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day exploitation campaigns.

Dubbed "Silent Train," it concealed attacks on enterprise management systems and supported strategic access to U.S. networks.

Read: https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html

🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces.

The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending.

Read ↓ https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

🚨 China-linked hackers exploited a VMware ESX zero-day to conceal activity from audit logs.

CrowdStrike links the attacks to Warp Panda, which targeted the U.S. legal sector.

CISA has now added CVE-2026-41709 to its KEV catalog.

Details: https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

‼️ ALERT - Hackers exploited a critical Cisco SD-WAN flaw (CVSS 10.0) to plant "KeyDrift" malware designed to steal encryption keys protecting traffic between sites.

The malware also provides backdoor access, with infrastructure links to a network used by Volt Typhoon.

Full details ↓ https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html

‼️ Alpine Linux's GitLab server was targeted in a CVSS 10.0 RCE exploit attempt.

Twist? Alpine had already upgraded GitLab, but the flaw remained exploitable because Ruby was still unpatched.

Alpine rebuilt the server & reset all passwords.

Details: https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html

⚡ GitHub introduces a new npm package firewall to block malicious packages before installation.

Now in public preview for Enterprise Cloud, it checks malware advisories, vulnerabilities, risky install scripts, and package age before allowing downloads.

How it works ↓ https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html

🚨 Cisco patches actively exploited ASA and FTD firewall flaw.

CVE-2026-76418 (CVSS 8.6) can let unauthenticated attackers remotely crash affected firewalls, causing denial of service.

No successful VPN login required.

Details + affected versions ↓ https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html

⚠️ 26,400 working cloud and AI credentials exposed in public Gitee repositories.

A scan of 7.25 million repos found valid Alibaba Cloud, DeepSeek, OpenAI, and other API keys.

Some date back years. Their revocation remains unconfirmed.

Full findings: https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html

‼️ One answered Telegram call was enough to run attacker code on Android, researchers say.

All an attacker needed was a regular Telegram account. No link or file to open.

Fixed in Telegram for Android 12.10.4.

Details ↓ https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html

Multi-factor authentication is great for security, until it takes 3 apps and 5 steps just to log in 🥲

You know it too well: if MFA feels like a complicated quest, your team will avoid it. It’s human nature, after all.

Luckily, the Authenticator is built into NordPass, so your team can generate, autofill, and share 2FA passcodes from day one without downloading another app. If a shared company account is protected by 2FA, the codes travel with the credentials, so no one is locked out waiting for someone else to read a code off their screen.

Take advantage of NordPass Business Black Friday deal and save up to 20% with code BF20OFF at checkout for up to 30 seats. More than 30? Contact sales and save more than 20%.

Start authenticating with NordPass now 👉 https://thn.news/claude-max

🚨 Google unveils Gemini 4 Carbon, its latest AI model with advanced cybersecurity capabilities.

It leads benchmarks for:
• Finding vulnerabilities: 88.2%
• Exploit development: 54.8%
• Patching flaws: 71%

Details ↓ https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html

‼️ Linux kernel TCP flaw rated 9.8 CVSS.

Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP.

Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions.

Details: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

AI agents are taking on the work that once defined SOC analysts: alert triage, threat hunting, investigations, and response.

What's next for security teams?

A new role is emerging: the Threat Operator, directing AI-driven defense while humans retain control of critical decisions.

Here's how the SOC is changing ↓ https://thehackernews.com/2026/10/the-rise-of-threat-operator-how-ai-will.html