‼️ Microsoft Edge's sandbox was bypassed using logic flaws alone. No memory corruption.

Security researcher Orange Tsai demonstrated a chain that turned a malicious web page into code execution outside the browser sandbox, earning $175,000 at Pwn2Own 2026.

The full exploit technique is now public ↓ https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html

‼️ One-tap installs are coming to 3rd-party Android app stores.

The catch: they must send Google their full catalog, and every update, for malware scans.

▸ From Dec 1
▸ Android 17 QPR2+
▸ Not in the US

Read → https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html

🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day exploitation campaigns.

Dubbed "Silent Train," it concealed attacks on enterprise management systems and supported strategic access to U.S. networks.

Read: https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html

🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces.

The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending.

Read ↓ https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html

🚨 China-linked hackers exploited a VMware ESX zero-day to conceal activity from audit logs.

CrowdStrike links the attacks to Warp Panda, which targeted the U.S. legal sector.

CISA has now added CVE-2026-41709 to its KEV catalog.

Details: https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

‼️ ALERT - Hackers exploited a critical Cisco SD-WAN flaw (CVSS 10.0) to plant "KeyDrift" malware designed to steal encryption keys protecting traffic between sites.

The malware also provides backdoor access, with infrastructure links to a network used by Volt Typhoon.

Full details ↓ https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html

‼️ Alpine Linux's GitLab server was targeted in a CVSS 10.0 RCE exploit attempt.

Twist? Alpine had already upgraded GitLab, but the flaw remained exploitable because Ruby was still unpatched.

Alpine rebuilt the server & reset all passwords.

Details: https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html

⚡ GitHub introduces a new npm package firewall to block malicious packages before installation.

Now in public preview for Enterprise Cloud, it checks malware advisories, vulnerabilities, risky install scripts, and package age before allowing downloads.

How it works ↓ https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html

🚨 Cisco patches actively exploited ASA and FTD firewall flaw.

CVE-2026-76418 (CVSS 8.6) can let unauthenticated attackers remotely crash affected firewalls, causing denial of service.

No successful VPN login required.

Details + affected versions ↓ https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html

⚠️ 26,400 working cloud and AI credentials exposed in public Gitee repositories.

A scan of 7.25 million repos found valid Alibaba Cloud, DeepSeek, OpenAI, and other API keys.

Some date back years. Their revocation remains unconfirmed.

Full findings: https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html

‼️ One answered Telegram call was enough to run attacker code on Android, researchers say.

All an attacker needed was a regular Telegram account. No link or file to open.

Fixed in Telegram for Android 12.10.4.

Details ↓ https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html

Multi-factor authentication is great for security, until it takes 3 apps and 5 steps just to log in 🥲

You know it too well: if MFA feels like a complicated quest, your team will avoid it. It’s human nature, after all.

Luckily, the Authenticator is built into NordPass, so your team can generate, autofill, and share 2FA passcodes from day one without downloading another app. If a shared company account is protected by 2FA, the codes travel with the credentials, so no one is locked out waiting for someone else to read a code off their screen.

Take advantage of NordPass Business Black Friday deal and save up to 20% with code BF20OFF at checkout for up to 30 seats. More than 30? Contact sales and save more than 20%.

Start authenticating with NordPass now 👉 https://thn.news/claude-max

🚨 Google unveils Gemini 4 Carbon, its latest AI model with advanced cybersecurity capabilities.

It leads benchmarks for:
• Finding vulnerabilities: 88.2%
• Exploit development: 54.8%
• Patching flaws: 71%

Details ↓ https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html

‼️ Linux kernel TCP flaw rated 9.8 CVSS.

Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP.

Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions.

Details: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

AI agents are taking on the work that once defined SOC analysts: alert triage, threat hunting, investigations, and response.

What's next for security teams?

A new role is emerging: the Threat Operator, directing AI-driven defense while humans retain control of critical decisions.

Here's how the SOC is changing ↓ https://thehackernews.com/2026/10/the-rise-of-threat-operator-how-ai-will.html

>> 40,000+ secrets exposed.
>> 42 GitHub repos hijacked.
>> AI bots hunting credentials.
>> Token theft without extra permissions.
>> 68GB of government data stolen.

And that's just the start.

This week's #ThreatsDay Bulletin covers 30 new cybersecurity stories worth your attention.

Full roundup - https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html

⚡ AI-powered attacks are moving faster. Is your security team ready?

More alerts ≠ better security.

Join our expert webinar to learn how to:

→ Spot real attack paths
→ Cut through security noise
→ Detect and respond faster

Build practical AI threat readiness.

Register FREE ⬇
https://thehackernews.com/2026/08/learn-how-to-build-security-operations.html

🚨 BREAKING: Binance suffers a security breach affecting $6.3 billion in assets, with nearly $3 billion frozen on-chain.

Attackers submitted unauthorized withdrawals, with a compromised DevOps engineer's laptop suspected as the entry point.

Details ↓ https://thehackernews.com/2026/10/binance-suffers-security-breach.html

🚨 CISA adds two actively exploited Cisco and GitLab flaws to its KEV catalog.

• GitLab: CVSS 10.0 RCE flaw targeted in an attempted attack on Alpine Linux
• Cisco: Firewall flaw can trigger device reloads and DoS

Federal agencies must patch by November 1.

Details ↓ https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

🚨 Hackers are actively exploiting a highly critical flaw in Drupal Commerce Core.

CVE-2026-118539 allows attackers to bypass access controls, potentially causing financial losses for vendors.

Drupal confirms in-the-wild exploitation but has not disclosed the attack details or scale.

Read more: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html