What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
The Hacker News · News ·
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Google Chrome adds warnings to stop malicious commands.
The Hacker News reports Google is rolling out safeguards in Chrome to secure users against ClickFix attacks. ClickFix tricks users into copying malicious code into their operating system. This bypasses conventional security controls when Enhanced Protection is enabled.
Recommended by the publisher: The Hacker News says Google is rolling out improved safeguards.
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Bronze Sandcastle targets Asia and Africa.
The Hacker News reports Bronze Sandcastle targets organizations in Asia and Africa, Sophos says it uses Sandboxie DLL sideloading, Bronze Sandcastle has been active since mid-2025, according to Sophos security researcher Gabor Szappanos.
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
PHP2Shell flaws concern PHP users.
The Hacker News reports a security firm says a suggested workaround is not enough on its own. PHP rates the flaws 9.2 out of 10. A fix will be released at 14:00 UTC on October 21. The security firm previously suggested a setting as a workaround.
Recommended by the publisher: Install the fix when available.
The Harness Is the Hard Part of Agentic Pentesting
The Hacker News reports AI pentesting harness is crucial.
The Hacker News says the harness makes attacks safe and worthwhile. The model writes attacks, but the harness is where engineering sits. This concerns AppSec teams.
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers hijacked 300 Tor exit relays.
The Hacker News reports attackers took control of over 300 Tor exit relays to intercept SSH connections. Affected users are those who made SSH logins through Tor between October 1 and 5. The attackers redirected connections to steal login passwords. The Hacker News says this happened early October.
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Attackers abuse legitimate infrastructure to deliver malware.
Cisco Talos reports that attackers are using legitimate platforms to deliver malware, including collaboration and productivity tools. Talos tracked over 25 distinct platforms being abused in the past year. The attackers are embedding malicious content into order notifications from trusted retailers like Staples and Dell.
Recommended by the publisher: Talos recommends validating order notification content and correlating it with account history and payment state to prevent attacks.
The Hacker News reports PHP's security team found two critical vulnerabilities rated 9.2 on the CVSS v4.0 scale. watchTowr says they allow remote code execution. The flaws affect PHP branches 8.2 through 8.5. No exploitation has been reported so far.
Recommended by the publisher: PHP will ship a security release at 14:00 UTC today.
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Attackers abuse UpdraftCentral keys to backdoor WordPress sites.
The Hacker News reports that unknown threat actors breached TeamUpdraft's website and gained access to customers' connection keys. The keys are used for UpdraftCentral, UpdraftVault, and UpdraftClone. This affects WordPress sites using these plugins.
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
US bans DeepSeek from federal systems.
The Hacker News reports US federal civilian agencies must remove DeepSeek products. They may no longer buy products from the Chinese AI developer. Homeland Security issued the order.
Recommended by the publisher: Agencies must remove DeepSeek products and stop new purchases.
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
State Bank of India confirms data leak of 3,897 customer records.
The Hacker News reports that State Bank of India found 3,897 customer records on the dark web. The records contain personal information. The bank does not know the source of the leak. The bank disclosed this in a stock-exchange filing.
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
CISA orders federal agencies to patch vulnerabilities.
CISA added four vulnerabilities to its KEV catalog, including Plex2Shell, according to The Hacker News. The vulnerabilities impact Plex Media Server. The Hacker News reports a CVSS score of 5.3 for one vulnerability.
Recommended by the publisher: Federal agencies are ordered to patch the vulnerabilities.
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
Hackers hid backdoor in VMware Tools.
The Hacker News reports a Belarus-aligned group spent nearly two years in a Russian healthcare organization's network. Solar attributes the activity to Partisan Zmiy. The group hid the Vasilek backdoor in VMware Tools. The Hacker News says the group has been active since at least 2020.
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
eMudhra CA keys are compromised, affecting browsers and software.
The Hacker News reports that eight eMudhra intermediate CA certificates' private keys are compromised, according to Mozilla and Google's Chrome Root Program. This affects browsers and software that accept these certificates. Anyone with these keys can issue a certificate for any website. A researcher reported the issue.
Recommended by the publisher: Emergency fixes are being triggered across browsers and software.
The Hacker News reports a critical Fortinet FortiSIEM flaw, CVE-2026-106173, allows arbitrary code execution. The vulnerability is a path traversal flaw. An unauthenticated attacker can execute unauthorized code. The CVSS score is 9.4.
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks flaw exploited by Qilin and INC ransomware.
The Hacker News reports that Palo Alto Networks disclosed exploitation of CVE-2026-0257, an authentication bypass flaw, by ransomware actors. The flaw affects PAN-OS and Prisma Access. It was patched in May 2026. The Hacker News says the flaw could be exploited to set up unauthorized VPN connections.
There's only so much code: the rise in vulnerability numbers
Cisco Talos reports a surge in vulnerability numbers due to AI models.
Cisco Talos says AI models are rapidly discovering vulnerabilities in legacy libraries, overwhelming open-source maintainers. The number of CVEs has surged 105% year-over-year. Only 3 of September's 975 Microsoft advisories saw in-the-wild exploitation. Cisco Talos notes that most AI-discovered bugs are not practically exploited.
Recommended by the publisher: Cisco Talos recommends building robust defense-in-depth and prioritizing high-exploitability flaws.