Mohit Kumar

⚡ AI-powered attacks are moving faster. Is your security team ready? More alerts ≠ better security. Join our expert webinar to learn how to: → Spot real attack paths → Cut through security noise → Detect and respond faster Build practical AI threat readiness. Register FREE ⬇ thehackernews.com/2026/08/le…

>> 40,000+ secrets exposed. >> 42 GitHub repos hijacked. >> AI bots hunting credentials. >> Token theft without extra permissions. >> 68GB of government data stolen. And that's just the start. This week's #ThreatsDay Bulletin covers 30 new cybersecurity stories worth your attention. Full roundup - thehackernews.com/2026/10/th…

‼️ ALERT - Hackers exploited a critical Cisco SD-WAN flaw (CVSS 10.0) to plant "KeyDrift" malware designed to steal encryption keys protecting traffic between sites. The malware also provides backdoor access, with infrastructure links to a network used by Volt Typhoon. Full details ↓ thehackernews.com/2026/10/ha…

‼️ Linux kernel TCP flaw rated 9.8 CVSS. Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP. Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions. Details: thehackernews.com/2026/10/li…

🚨 Palo Alto Networks confirms active attacks exploiting PHP2Shell flaws in internet-exposed PAN-OS management interfaces. The flaws allow unauthenticated remote code execution. Multiple PAN-OS versions are affected, with some fixes still pending. Read ↓ thehackernews.com/2026/10/at…

🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day exploitation campaigns. Dubbed "Silent Train," it concealed attacks on enterprise management systems and supported strategic access to U.S. networks. Read: thehackernews.com/2026/10/vo…

‼️ Tailscale finally issued patches for SSH flaws that could turn one hacked device into root access on other servers. The Tailworm research demonstrated rapid lateral movement across policy-permitted devices, without stolen passwords or user interaction. ⚠️ Headscale remains UNPATCHED. Read - thehackernews.com/2026/10/ta…

‼️ One-tap installs are coming to 3rd-party Android app stores. The catch: they must send Google their full catalog, and every update, for malware scans. ▸ From Dec 1 ▸ Android 17 QPR2+ ▸ Not in the US Read → thehackernews.com/2026/10/go…

🚨 PHP2Shell exploited in real-world attacks. An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment. The intrusion extended into the internal network, where the attacker targeted Active Directory. Suspected China nexus. Signs of AI-assisted tooling. Read the full report: thehackernews.com/2026/10/ph…

‼️ Critical 16-year-old flaw in EDK II UEFI firmware could let attackers execute code before Secure Boot checks. CVE-2026-97631 affects PXE network boot, requires local network access and target-specific exploitation. No patched stable EDK II release yet. Full details → thehackernews.com/2026/10/cr…

🛑 An unreleased Anthropic AI model chained security flaws into working exploits across Chrome, Safari, Android, Windows, and Linux. One Chrome exploit escaped the browser sandbox and launched Calculator on a Mac just by loading a page. Details on five chained exploits → thehackernews.com/2026/10/an…

‼️ OpenAI encrypts its AI models' hidden reasoning to keep it unreadable. Researchers found a way to extract it as plaintext using OpenAI's own compaction feature. The method bypassed earlier protections. OpenAI has now patched the flaw. Here's how it worked ↓ thehackernews.com/2026/10/op…

‼️WARNING - Hundreds of millions of devices run GoAhead's embedded web server. Now, 3 TLS vulnerabilities have been disclosed that can allow revoked client certificates to authenticate or expose encrypted sessions to decryption. Affected builds use specific OpenSSL, LibreSSL, or Mbed TLS configurations. Read more: thehackernews.com/2026/10/go…

‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes. This time, a Brotli flaw could allow code execution when cURL automatically decompresses crafted HTTP responses. Updated builds cover PHP 8.2–8.5. Full details: thehackernews.com/2026/10/ph…

🚨 Dahua IP cameras compromised in Ukraine. CERT-UA confirms attackers gained access to video feeds, changed device settings, and created rogue accounts. The attacks exploit Easy4IP P2P access alongside weak passwords or authentication bypass flaws. Full details ↓ thehackernews.com/2026/10/at…

🚨 Microsoft Authenticator flaw let malicious Android apps impersonate Teams and obtain work account sign-in tokens. No app permissions needed. Researchers demonstrated access to email, files, and calendars. Microsoft has patched it. 🔗 Read more ↓ thehackernews.com/2026/10/mi…

🚨 UPDATE: PHP2Shell exploitation confirmed in the wild. Perplexity researcher Adel Karimi observed successful exploitation on honeypot servers, with attackers executing shell commands to fetch additional payloads. No second-stage payloads have been recovered so far. Details: thehackernews.com/2026/10/ph…

🚨 CISA adds two PHP2Shell bugs to its KEV catalog after confirming active exploitation. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution on affected PHP deployments. Read ↓ thehackernews.com/2026/10/ci…

This2Shell. That2Shell. Everything2Shell. WHAT A WEEK IN #CYBERSECURITY. > Critical RCEs dropping everywhere. > Millions of exploit attempts. > AI agents getting hijacked. > Leaked keys poisoning software packages. > Old bugs coming back to haunt us. > And yes, some sites just went offline. One week. Too many ways to get hacked. ⚡ Full Recap: thehackernews.com/2026/10/we…

‼️ ALERT - 2 New critical Wasmtime flaws (CVSS 9.9) could let malicious WebAssembly modules escape their sandbox. • CVE-2026-115889 Affects multiple architectures • CVE-2026-115893 ARM64-only, present since 2020 Embedded apps need rebuilding. Read ↓ thehackernews.com/2026/10/tw…