The Hacker News

⚠️ Researchers ran attacker-chosen code inside Windows 11's SmartScreen VBS enclave, designed to resist even SYSTEM-level compromise.

A 4-byte write & timing bug enabled the lab PoC. Local access required. CVE-2026-83498 was patched in September.

Read: https://thehackernews.com/2026/10/four-byte-write-and-timing-bug-let.html

🚨 Microsoft just broke its Patch Tuesday record: 1,413 vulnerabilities patched in one release.

One Windows Shell flaw (CVE-2026-96951) is already being exploited in attacks and can bypass Mark of the Web defenses.

Read: https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html

‼️ BREAKING - An OpenAI engineering lead has been arrested for allegedly planting a covert audio recorder in an executive conference room where highly confidential company matters are discussed.

The device was found hidden behind a TV, wrapped in toilet paper.

Read: https://thehackernews.com/2026/10/openai-employee-arrested-for-allegedly.html

⚠️ UPDATE: A tampered Ledger can leak your 24-word recovery phrase over LTE.

Ledger says a hidden implant reads setup screens and transmits the phrase via eSIM—without modifying the Secure Element or OS.

Affected users and losses remain unknown. Genuine Check may miss it.

Read: https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

🛑 Anthropic warns small AI models may be months away from self-replicating on IoT devices, potentially forming botnets that are hard to shut down.

In tests, GLM-5.2 propagated Llama 3.1-8B to all 8 nodes in 4 of 5 trials.

Read: https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html

⚠️ Docker Hub's critical GhostPat flaw let users publish images under someone else's name through account conversion.

The bug lasted over two years. Docker fixed it and found no evidence of exploitation.

Read: https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html

‼️ Three zero-days. Root commands. No login.

An attacker exploited the flaws in a fully patched Ivanti Connect Secure VPN and stole stored credentials.

Ivanti confirms exploitation in the wild. Two flaws patched; a fix for the third is pending.

Read: https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html

🛑 New CVSS 10.0 flaw disclosed in SAP Cloud SDK for Python (CVE-2026-89111).

It allows attackers to steal OAuth2 client IDs and secrets by manipulating tenant subdomains.

🛠️ Fix: Ensure you're running v0.55.1 or newer (latest is 0.58.4).

Details: https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html

⚡ GitHub tightens npm security after 1,500+ packages were found vulnerable to hijacking without stolen credentials.

Attackers could claim a freed GitHub repo name tied to a trusted-publisher binding that had never published.

Unvalidated bindings now expire after 48 hours.

Learn more: https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html

🚨 Norway’s privacy watchdog has issued its largest-ever fine, €8.6 million, against Xandr for relaying Grindr users’ data revealing sexual orientation to advertisers without required consent.

The violations predate Microsoft’s acquisition.

Read: https://thehackernews.com/2026/10/xandr-fined-record-86-million-for.html

⚡ What if the login is legitimate, but the identity is compromised?

AI-driven attacks can escalate privileges before defenders react. Learn how to control access beyond login in this live webinar.

Register Now - https://thehackernews.com/2026/10/webinar-how-to-stop-ai-driven-privilege.html

Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale.

This new report brings together 10 cybersecurity companies to explore what comes next, spanning identity security, endpoint and connected device security, exposure management, telemetry, human risk intelligence, email and domain protection, and AI-native security operations.

Read the full report: https://thn.news/security-threats-news

Featuring:

Keeper Security
Cribl
Automox
Nisos
Surf AI
Adaptive Security
Red Sift
Asimily
SentinelOne
CrowdStrike

‼️ No PIN. No owner interaction. Root access.

A 3-flaw chain in LG webOS can give attackers on the same local network root access to certain smart TVs.

Demonstrated on two models.

Read: https://thehackernews.com/2026/10/lg-smart-tvs-vulnerable-to-pre-auth.html

Your software inventory may be missing the AI tools running across your organization.

Bitdefender GravityZone AI Visibility and Control identifies shadow AI, coding assistants, local models, MCP servers, and agent skills across Windows endpoints, with risk scores and visibility into what connected tools can access.

Here's how it works: https://thehackernews.com/2026/10/product-walkthrough-bitdefender-ai.html

‼️ Attackers forced fridges into defrost at hundreds of French supermarkets. Some reached 50°C, and stores threw out food.

» Danfoss refrigeration controllers compromised.
» Intermarché, Carrefour and other French chains hit.
» Initial access method remains unknown.

Details → https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html

🛑 Two critical MarkLogic Server flaws could let accounts with forest-management or manage-user privileges gain persistent admin control.

Progress disclosed 31 flaws, 5 critical. Fixes shipped Sept. 10 in 11.3.7 and 12.1.0. Exploitation status unknown.

https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html

‼️ A CVSS 10.0 flaw in GitLab could have let unauthenticated users execute code on the server under certain conditions.

GitLab has patched the CI/CD vulnerability (CVE-2026-97229) affecting CE and EE.

Fixed versions: 19.2.8, 19.3.5, and 19.4.2.

Read: https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html

278.9 million+ medium- or critical-level SaaS alerts. In one year.

That's part of what Kaseya monitored in 2025. For MSPs, more security tools can mean more alerts, not better detection.

Why consolidation alone isn't enough, and how AI-assisted triage helps cut through the noise.

Read → https://thehackernews.com/expert-insights/2026/10/the-alert-fatigue-trap-why.html

⚠️ Some low-cost Android phones are infected before you even turn them on.

Bitdefender's Midnight Mimosa malware ships in firmware, silently installs apps & deploys payloads for ad fraud and residential proxies. A normal uninstall won't remove it.

Read: https://thehackernews.com/2026/10/low-cost-android-phones-ship-with.html

Even the “secure” padlock had trust issues this week.

→ Helpdesk 0-days
→ Rogue HTTPS certs
→ ShinyHunters arrest
→ iPhone keychain theft
→ Atlassian exploits
→ AI-fooling malware
→ 3 new malware loaders
→ Exposed GPU servers
→ Ransomware surge
→ AI disinfo operations
→ Dark web hijacks

This week's cybersecurity recap ↓ https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html