‼️ ALERT - Hackers exploited a critical Cisco SD-WAN flaw (CVSS 10.0) to plant "KeyDrift" malware designed to steal encryption keys protecting traffic between sites.

The malware also provides backdoor access, with infrastructure links to a network used by Volt Typhoon.

Full details ↓ https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html

‼️ Alpine Linux's GitLab server was targeted in a CVSS 10.0 RCE exploit attempt.

Twist? Alpine had already upgraded GitLab, but the flaw remained exploitable because Ruby was still unpatched.

Alpine rebuilt the server & reset all passwords.

Details: https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html

⚡ GitHub introduces a new npm package firewall to block malicious packages before installation.

Now in public preview for Enterprise Cloud, it checks malware advisories, vulnerabilities, risky install scripts, and package age before allowing downloads.

How it works ↓ https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html

🚨 Cisco patches actively exploited ASA and FTD firewall flaw.

CVE-2026-76418 (CVSS 8.6) can let unauthenticated attackers remotely crash affected firewalls, causing denial of service.

No successful VPN login required.

Details + affected versions ↓ https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html

⚠️ 26,400 working cloud and AI credentials exposed in public Gitee repositories.

A scan of 7.25 million repos found valid Alibaba Cloud, DeepSeek, OpenAI, and other API keys.

Some date back years. Their revocation remains unconfirmed.

Full findings: https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html

‼️ One answered Telegram call was enough to run attacker code on Android, researchers say.

All an attacker needed was a regular Telegram account. No link or file to open.

Fixed in Telegram for Android 12.10.4.

Details ↓ https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html

Multi-factor authentication is great for security, until it takes 3 apps and 5 steps just to log in 🥲

You know it too well: if MFA feels like a complicated quest, your team will avoid it. It’s human nature, after all.

Luckily, the Authenticator is built into NordPass, so your team can generate, autofill, and share 2FA passcodes from day one without downloading another app. If a shared company account is protected by 2FA, the codes travel with the credentials, so no one is locked out waiting for someone else to read a code off their screen.

Take advantage of NordPass Business Black Friday deal and save up to 20% with code BF20OFF at checkout for up to 30 seats. More than 30? Contact sales and save more than 20%.

Start authenticating with NordPass now 👉 https://thn.news/claude-max

🚨 Google unveils Gemini 4 Carbon, its latest AI model with advanced cybersecurity capabilities.

It leads benchmarks for:
• Finding vulnerabilities: 88.2%
• Exploit development: 54.8%
• Patching flaws: 71%

Details ↓ https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html

‼️ Linux kernel TCP flaw rated 9.8 CVSS.

Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP.

Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions.

Details: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

AI agents are taking on the work that once defined SOC analysts: alert triage, threat hunting, investigations, and response.

What's next for security teams?

A new role is emerging: the Threat Operator, directing AI-driven defense while humans retain control of critical decisions.

Here's how the SOC is changing ↓ https://thehackernews.com/2026/10/the-rise-of-threat-operator-how-ai-will.html

>> 40,000+ secrets exposed.
>> 42 GitHub repos hijacked.
>> AI bots hunting credentials.
>> Token theft without extra permissions.
>> 68GB of government data stolen.

And that's just the start.

This week's #ThreatsDay Bulletin covers 30 new cybersecurity stories worth your attention.

Full roundup - https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html

⚡ AI-powered attacks are moving faster. Is your security team ready?

More alerts ≠ better security.

Join our expert webinar to learn how to:

→ Spot real attack paths
→ Cut through security noise
→ Detect and respond faster

Build practical AI threat readiness.

Register FREE ⬇
https://thehackernews.com/2026/08/learn-how-to-build-security-operations.html

🚨 BREAKING: Binance suffers a security breach affecting $6.3 billion in assets, with nearly $3 billion frozen on-chain.

Attackers submitted unauthorized withdrawals, with a compromised DevOps engineer's laptop suspected as the entry point.

Details ↓ https://thehackernews.com/2026/10/binance-suffers-security-breach.html

🚨 CISA adds two actively exploited Cisco and GitLab flaws to its KEV catalog.

• GitLab: CVSS 10.0 RCE flaw targeted in an attempted attack on Alpine Linux
• Cisco: Firewall flaw can trigger device reloads and DoS

Federal agencies must patch by November 1.

Details ↓ https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

🚨 Hackers are actively exploiting a highly critical flaw in Drupal Commerce Core.

CVE-2026-118539 allows attackers to bypass access controls, potentially causing financial losses for vendors.

Drupal confirms in-the-wild exploitation but has not disclosed the attack details or scale.

Read more: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html

🚨 Official Claude Code VS Code extension compromised in a supply chain attack.

Attackers injected a malicious loader into v2.1.313 to install a persistent SSH backdoor, add their SSH key, and send host data.

Up to 5,000 users installed the malicious version.

Read: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

‼️ A Syrian hacker behind the 2013 AP Twitter hijack that triggered a temporary $136 billion stock market drop has been sentenced to 42 months in prison.

The Syrian Electronic Army operative also hacked about 47 organizations, including media outlets and government targets.

Full story ➜ https://thehackernews.com/2026/10/syrian-hacker-behind-fake-tweet-that.html

🚨 703.56 million attacks blocked in one month after security remediation.

Check Point reports a 99.5% remediation success rate across measured environments, with 21 million attacks blocked within 24 hours of remediation.

How validated security changes delivered these results ↓ https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html

‼️ WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implant designed to transmit users' recovery phrases.

Trezor is now urging everyone who bought a wallet supplied by CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.

Details: https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html

No Mythos access? You can now hunt for first and third-party exploitable vulnerabilities in your applications using Chainguard Harness.

Chainguard Harness builds your app from source in an isolated environment, then lets Mythos 5.1 hunt through a live instance for exploitable vulnerabilities. Each finding is reproducible, delivered with a recommended fix, and vetted by a Chainguard engineer.

Join the Chainguard Harness waitlist: https://thn.news/cve-malware-solution