AI agents are taking on the work that once defined SOC analysts: alert triage, threat hunting, investigations, and response.

What's next for security teams?

A new role is emerging: the Threat Operator, directing AI-driven defense while humans retain control of critical decisions.

Here's how the SOC is changing ↓ https://thehackernews.com/2026/10/the-rise-of-threat-operator-how-ai-will.html

>> 40,000+ secrets exposed.
>> 42 GitHub repos hijacked.
>> AI bots hunting credentials.
>> Token theft without extra permissions.
>> 68GB of government data stolen.

And that's just the start.

This week's #ThreatsDay Bulletin covers 30 new cybersecurity stories worth your attention.

Full roundup - https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html

⚡ AI-powered attacks are moving faster. Is your security team ready?

More alerts ≠ better security.

Join our expert webinar to learn how to:

→ Spot real attack paths
→ Cut through security noise
→ Detect and respond faster

Build practical AI threat readiness.

Register FREE ⬇
https://thehackernews.com/2026/08/learn-how-to-build-security-operations.html

🚨 BREAKING: Binance suffers a security breach affecting $6.3 billion in assets, with nearly $3 billion frozen on-chain.

Attackers submitted unauthorized withdrawals, with a compromised DevOps engineer's laptop suspected as the entry point.

Details ↓ https://thehackernews.com/2026/10/binance-suffers-security-breach.html

🚨 CISA adds two actively exploited Cisco and GitLab flaws to its KEV catalog.

• GitLab: CVSS 10.0 RCE flaw targeted in an attempted attack on Alpine Linux
• Cisco: Firewall flaw can trigger device reloads and DoS

Federal agencies must patch by November 1.

Details ↓ https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

🚨 Hackers are actively exploiting a highly critical flaw in Drupal Commerce Core.

CVE-2026-118539 allows attackers to bypass access controls, potentially causing financial losses for vendors.

Drupal confirms in-the-wild exploitation but has not disclosed the attack details or scale.

Read more: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html

🚨 Official Claude Code VS Code extension compromised in a supply chain attack.

Attackers injected a malicious loader into v2.1.313 to install a persistent SSH backdoor, add their SSH key, and send host data.

Up to 5,000 users installed the malicious version.

Read: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

‼️ A Syrian hacker behind the 2013 AP Twitter hijack that triggered a temporary $136 billion stock market drop has been sentenced to 42 months in prison.

The Syrian Electronic Army operative also hacked about 47 organizations, including media outlets and government targets.

Full story ➜ https://thehackernews.com/2026/10/syrian-hacker-behind-fake-tweet-that.html

🚨 703.56 million attacks blocked in one month after security remediation.

Check Point reports a 99.5% remediation success rate across measured environments, with 21 million attacks blocked within 24 hours of remediation.

How validated security changes delivered these results ↓ https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html

‼️ WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implant designed to transmit users' recovery phrases.

Trezor is now urging everyone who bought a wallet supplied by CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.

Details: https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html

No Mythos access? You can now hunt for first and third-party exploitable vulnerabilities in your applications using Chainguard Harness.

Chainguard Harness builds your app from source in an isolated environment, then lets Mythos 5.1 hunt through a live instance for exploitable vulnerabilities. Each finding is reproducible, delivered with a recommended fix, and vetted by a Chainguard engineer.

Join the Chainguard Harness waitlist: https://thn.news/cve-malware-solution

🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours.

Attackers are repeatedly probing upgrade paths, trying to catch a brief window during core updates that could allow unauthenticated code execution.

Details ↓ https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html

‼️ New TeamViewer vulnerability (CVE-2026-111585) flips the script... the machine you connect to can attack YOUR computer.

No click needed beyond accepting the session. Researcher got code running on a stock Windows viewer — default settings, defenses on.

Here's how the attack works ↓ https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html

🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide.

CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.

AI agents ran parallel attack paths under human direction.

Full story: https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html

🚨 8,226 DDoS attacks every hour.

Cloudflare blocked 18.2 million network-layer DDoS attacks in Q3 2026, up 38% from Q2.

Short-burst attacks surged 208%, while DNS amplification jumped 215%.

Who's being targeted ↓ https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html

🚨 OpenAI fixed a ChatGPT flaw that allowed malicious shared links to execute attacker code in users' logged-in sessions and steal private chat content.

Researchers demonstrated the attack.

Here's how → https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html

🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensive agentic techniques.

An attacker gained access to internal systems and tools, exposing customer names, email addresses, user IDs, and organization roles.

Full story: https://thehackernews.com/2026/10/chainalysis-confirms-intrusion-into.html

‼️ FBI confirms North Korea's TraderTraitor hackers were behind the record $6.43 billion Binance crypto heist.

$2.85 billion in stolen assets has been frozen as investigators track the laundering of funds through Ethereum.

Full story: https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html

🚨 New NetamLoader malware targets a government-only Windows 10 build in Asia.

The attack abuses legitimate Patch My PC components, hijacks .NET execution, bypasses AMSI, and loads encrypted payloads.

Kaspersky identified one victim. The attackers remain unknown.

How the attack works - https://thehackernews.com/2026/11/netamloader-malware-targets-government.html

🚨 $2.7 MILLION stolen from Polymarket traders in under an hour.

The attackers didn't need to steal private keys. They hijacked a third-party DebugBear script and abused signed-in sessions to drain funds and trading positions.

726 wallets affected. $3.9M in refunds.

Here's how it happened: https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html