‼️ OpenAI encrypts its AI models' hidden reasoning to keep it unreadable. Researchers found a way to extract it as plaintext using OpenAI's own compaction feature. The method bypassed earlier protections. OpenAI has now patched the flaw. Here's how it worked ↓ thehackernews.com/2026/10/op…

‼️WARNING - Hundreds of millions of devices run GoAhead's embedded web server. Now, 3 TLS vulnerabilities have been disclosed that can allow revoked client certificates to authenticate or expose encrypted sessions to decryption. Affected builds use specific OpenSSL, LibreSSL, or Mbed TLS configurations. Read more: thehackernews.com/2026/10/go…

‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes. This time, a Brotli flaw could allow code execution when cURL automatically decompresses crafted HTTP responses. Updated builds cover PHP 8.2–8.5. Full details: thehackernews.com/2026/10/ph…

🚨 Dahua IP cameras compromised in Ukraine. CERT-UA confirms attackers gained access to video feeds, changed device settings, and created rogue accounts. The attacks exploit Easy4IP P2P access alongside weak passwords or authentication bypass flaws. Full details ↓ thehackernews.com/2026/10/at…

🚨 Microsoft Authenticator flaw let malicious Android apps impersonate Teams and obtain work account sign-in tokens. No app permissions needed. Researchers demonstrated access to email, files, and calendars. Microsoft has patched it. 🔗 Read more ↓ thehackernews.com/2026/10/mi…

🚨 UPDATE: PHP2Shell exploitation confirmed in the wild. Perplexity researcher Adel Karimi observed successful exploitation on honeypot servers, with attackers executing shell commands to fetch additional payloads. No second-stage payloads have been recovered so far. Details: thehackernews.com/2026/10/ph…

🚨 CISA adds two PHP2Shell bugs to its KEV catalog after confirming active exploitation. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution on affected PHP deployments. Read ↓ thehackernews.com/2026/10/ci…

This2Shell. That2Shell. Everything2Shell. WHAT A WEEK IN #CYBERSECURITY. > Critical RCEs dropping everywhere. > Millions of exploit attempts. > AI agents getting hijacked. > Leaked keys poisoning software packages. > Old bugs coming back to haunt us. > And yes, some sites just went offline. One week. Too many ways to get hacked. ⚡ Full Recap: thehackernews.com/2026/10/we…

‼️ ALERT - 2 New critical Wasmtime flaws (CVSS 9.9) could let malicious WebAssembly modules escape their sandbox. • CVE-2026-115889 Affects multiple architectures • CVE-2026-115893 ARM64-only, present since 2020 Embedded apps need rebuilding. Read ↓ thehackernews.com/2026/10/tw…

🚨 850+ compromised GitHub accounts. 13,500+ malicious branches. Researchers uncovered 'Gheist,' an ongoing campaign using stolen tokens to plant GitHub Actions workflows that dump private repo secrets into logs. Attackers download the logs, then delete the runs. Details: thehackernews.com/2026/10/gh…

UPDATE: Palo Alto Networks Unit 42 has retracted its earlier assessment linking the European government agency attack to PHP2Shell exploitation. The attack involved a vulnerable PHP application, but Unit 42 says it cannot confirm initial access was tied to the specific PHP2Shell CVEs. We've updated our report ↓

‼️ In a real-world attack, a malicious file in a dev's Downloads folder tried to trick an AI coding agent into installing malware. In controlled tests, Codex ran the malware in over 90% of attempts. All it took was a planted AGENTS.md file. Read: thehackernews.com/2026/10/ma…

🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours. That's not all. → Signs of agentic AI use in post-exploitation activity → Suspected Lazarus-linked operators scanning 216 targets worldwide Full details ↓ thehackernews.com/2026/10/ph…

‼️ WARNING - A researcher just dropped a report on Tailscale SSH flaws — one compromised device could get root on others, and there’s NO PATCH yet. In lab tests, SSH port forwarding enabled privilege escalation and lateral movement across already-permitted devices. Tailscale says a fix is coming. Read - thehackernews.com/2026/10/un…

‼️ OpenAI's AI agents found ways to escape virtual machines and secretly communicate across isolated sandboxes. In one test, agents exchanged synthetic secrets using CPU cache timing, without internet access or shared files. OpenAI has now banned live internet access during frontier AI training. Full story: thehackernews.com/2026/10/op…

‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js. Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability. Read full details ↓ thehackernews.com/2026/10/br…

🔥 Your biggest AI insider threat may already be on an employee's laptop. AI agents can access API keys, passwords, and internal systems without proper oversight. Join Bitdefender's webinar to learn how to detect and govern shadow AI. Save your seat → thehackernews.com/2026/10/th…

‼️ Patched, but still exploitable. The new BlackX UEFI bootkit bypasses Secure Boot on Windows systems missing required revocations, even after the patch is installed. Attackers used it in breaches of Central Asian diplomatic networks after gaining admin access. Details: thehackernews.com/2026/10/bl…

🚨 Researchers pushed over 2 million remote updates to disable a forgotten Popcorn Time updater that could have fueled a botnet. The flaw let anyone controlling its update domain deliver code with SYSTEM or root privileges. How they pulled it off ↓ thehackernews.com/2026/10/re…

🚨 LiteLLM reveals the root cause of its supply chain attack. A master key leaked on GitHub in May was never revoked, allowing attackers to access its Agent Platform, steal a GitHub owner token, and publish a malicious PyPI release in October. Read: thehackernews.com/2026/10/le…