The #1 trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.
The Internet
Joined October 2010
- Tweets45.8K
- Following2K
- Followers2.4M
- Likes8K
Pinned Tweet
‼️ ALERT - Someone tried to exploit #PHP2Shell 4 days before the vulnerabilities were publicly disclosed.
Amazon caught the October 17 attempt. More exploit attempts followed the patch release.
Who had the exploit details early, and how?
Full story ↓ thehackernews.com/2026/10/so…
According to IBM’s recent Cost of a Data Breach Report, 43% of breached organizations reported a shadow AI incident in 2026, up from 20% the year before.
With shadow AI spreading faster than anyone can track, it’s easy to miss when an employee builds an agent with too-broad access to company data, or a developer’s coding tool leaks production secrets.
With @NordLayer AI Scout, take control of your network: discover every AI tool in use, see what was asked, by whom, and where.
See what’s running in the gaps of your approved AI list 👉 thn.news/shadow-ai-tools
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.
Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.
What developers need to know: thehackernews.com/2026/10/op…
⚠️ LiteLLM’s release pipeline was hijacked.
Malicious v1.107.0 packages shipped a credential stealer and backdoor. Attackers later tested stolen AWS credentials.
LiteLLM suspects GitHub OAuth tokens were taken from logs on its exposed internal deployment.
Read ↓ thehackernews.com/2026/10/li…
🚨 Node.js patches 10 security flaws, including a high-severity Brotli decoder bug that could allow RCE when apps decompress attacker-controlled data.
Patches are out for versions 22.x, 24.x, and 26.x.
Update Now ↓ thehackernews.com/2026/10/no…
‼️ A single HTTP/3 connection can crash vulnerable web servers. No login required.
Newly disclosed QPACK flaws trigger up to 4,000× memory amplification in tests, exhausting server resources.
→ PoC is public
→ 7 implementations affected
→ Still unpatched: Bun, aioquic, h3
Full details ↓ thehackernews.com/2026/10/ne…
The Hacker News retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
The Hacker News retweeted
‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge.
The flaws can enable unauthenticated code execution and expose server memory.
👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619)
Details ➜ thehackernews.com/2026/10/ph…
🚨 China-linked hackers used ARTEX AI agents to abuse stolen ConnectWise app credentials and gain access to customer cloud environments.
Microsoft ties Storm-0940 to the ConnectWise Cloud Backup supply-chain compromise.
Details ↓ thehackernews.com/2026/10/ch…
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
🚨 LiteLLM 1.107.0 compromised in a supply chain attack.
Malicious PyPI packages and Docker images delivered a credential stealer and backdoor.
⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.
🔗 Full story: thehackernews.com/2026/10/li…
🚨 UPDATE: India has launched a special investigation into eMudhra after 8 intermediate CA private keys were found trivially recoverable.
CERT-In and Red Hat have issued fresh security alerts as the fallout extends beyond Chrome, Firefox, and Go.
Read - thehackernews.com/2026/10/ei…
The impact goes beyond browsers.
Red Hat warns that RHEL 6–10 and potentially affected container-based environments may continue trusting the compromised certificate hierarchy until their trust stores are updated.
Browser security updates alone may not protect every application.
eMudhra says 7 affected intermediates were never deployed, while the eighth issued no end-user certificates.
But a major question remains: How did such weak cryptographic keys go undetected for roughly 18 months?
Full story and latest developments: thehackernews.com/2026/10/ei…
⚠️ OpenAI's GPT-6 agents disabled security alerts and removed safety monitoring while carrying out routine coding tasks.
In one case, an agent falsely denied removing monitoring functionality.
OpenAI is now investigating why its agents weakened safeguards meant to oversee their behavior.
Read - thehackernews.com/2026/10/op…
Every security vendor is shipping AI agents. Few are asking what those agents are actually acting on. 🤔
An agent that remediates based on one tool’s partial view of an asset isn’t saving time. It’s automating mistakes at machine speed.
The secret weapon isn’t the AI. It’s the data underneath it.
That’s the bet @AxoniusInc is making with its AI Workforce: Virtual Workers that monitor, flag, and fix, all grounded in one reconciled view of every asset and exposure. Humans stay in the loop where it matters, and autonomy is earned, not assumed.
Is your AI working from ground truth, or a best guess? 👇
Learn more: thn.news/ai-threat-defense
‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge.
The flaws can enable unauthenticated code execution and expose server memory.
👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619)
Details ➜ thehackernews.com/2026/10/ph…
Disabling session.upload_progress blocks certain CVE-2026-109619 attack paths, but does NOT fully mitigate the flaw or protect against CVE-2026-109618.
Watch for unusual multipart requests, repeated HTTP 500 errors, oversized PHPSESSID cookies, and unexplained worker restarts.
Only patching provides a complete fix.
Read full details here: thehackernews.com/2026/10/ph…
