What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
The Hacker News · News ·
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
eMudhra CA keys are compromised, affecting browsers and software.
The Hacker News reports that eight eMudhra intermediate CA certificates' private keys are compromised, according to Mozilla and Google's Chrome Root Program. This affects browsers and software that accept these certificates. Anyone with these keys can issue a certificate for any website. A researcher reported the issue.
Recommended by the publisher: Emergency fixes are being triggered across browsers and software.
The Hacker News reports a critical Fortinet FortiSIEM flaw, CVE-2026-106173, allows arbitrary code execution. The vulnerability is a path traversal flaw. An unauthenticated attacker can execute unauthorized code. The CVSS score is 9.4.
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks flaw exploited by Qilin and INC ransomware.
The Hacker News reports that Palo Alto Networks disclosed exploitation of CVE-2026-0257, an authentication bypass flaw, by ransomware actors. The flaw affects PAN-OS and Prisma Access. It was patched in May 2026. The Hacker News says the flaw could be exploited to set up unauthorized VPN connections.
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
Hackers used AI agents to breach company websites.
The Hacker News reports a Chinese-speaking criminal used autonomous AI agents to target over 1,200 sites. The agents reached websites of over 100 companies, including Deere and an appliance company. The operators left their control panels open on the internet. A security researcher observed the activity.
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
Pegasus spyware infected Serbian rector's iPhone.
The Citizen Lab says the iPhone of Vladan Đokić was infected with Pegasus spyware in 2026. The infection used a zero-click exploit. This happened six days before Serbia's parliamentary election. Đokić is a prominent supporter of Serbia's student protest movement.
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
WhatsApp hid instructions for its chatbot.
The Hacker News reports WhatsApp's help pages had hidden instructions for its support chatbot. The instructions told the chatbot not to recommend a data protection authority to users. This is despite WhatsApp's privacy policy allowing complaints to such authorities. The text was removed by October 18.
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go updates block eight CA keys.
The Hacker News reports Go 1.27.3 and Go 1.26.10 reject certificates from eight CA keys. The Go team says these keys belong to one certificate authority. Programs built on the new release will refuse connections to affected sites.
Recommended by the publisher: Update to Go 1.27.3 or Go 1.26.10.
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
APT28 breaches NATO shipbuilder.
The Hacker News reports APT28 targeted a NATO naval shipbuilder. Symantec attributes this to the Swallowtail activity cluster. APT28 used a HOOKEDGE backdoor.
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise resets credentials after security incident.
The Hacker News reports ConnectWise had unauthorized access to Cloud Backup application identities. The company has strengthened administrative-access protections and reset accounts. ConnectWise has replaced application credentials.
Recommended by the publisher: The company has taken remediation measures.
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
OVHcloud's CLI releases were hijacked to distribute malware.
The Hacker News reports an attacker used a hijacked GitHub account to replace OVHcloud's CLI tool downloads. The new files steal secrets from any machine that runs them. They were live on GitHub for up to 94 minutes. OVHcloud says the attacker replaced five existing releases.
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens fixes exploited DLL sideloading flaw.
The Hacker News reports a high-severity vulnerability in Siemens Software Center is tracked as CVE-2026-110936. According to the company, it could allow an attacker to execute malicious code. The vulnerability has been exploited in ClickFix attacks.
Recommended by the publisher: Siemens has addressed the vulnerability.
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge
Ex-OpenAI engineer detained for alleged spying.
The Hacker News reports a US court detained Abdulrahman Alfozan, a former OpenAI engineer, for allegedly planting a recording device. He is accused of stealing sensitive secrets. Prosecutors say he was in frequent communications with Saudi royal contacts via WhatsApp. The US government requested his detention.
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
ROMULUS platform delivers LegionLoader malware.
Forescout Research - Vedere Labs says ROMULUS is a malware delivery service. It uses ClickFix-style lures on bogus landing pages to trick users. Unsuspecting users run malicious commands and infect their own systems. The Hacker News reports this.
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Hackers exploit Plex Media Server flaws.
The Hacker News reports that threat actors exploit Plex Media Server vulnerabilities to deploy crypto miners and proxy software. The vulnerabilities are called Plex2Shell. A researcher reported the exploitation activity.
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Rank Math PRO was hijacked to deliver malware.
Rank Math says copies downloaded between October 15 and 16 contained malware. Affected sites should be treated as compromised. The malware delivers a self-restoring backdoor. Rank Math reported this in a security notice.
Recommended by the publisher: Treat affected sites as compromised.
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
GhostAction attackers planted malware in 94 GitHub repositories.
The Hacker News reports that GhostAction attackers expanded their supply chain attack, according to OpenSourceMalware. They injected malicious GitHub Actions workflows and delivered stealer malware disguised as a font file. The attackers are refining their methods. This affects open-source developers and 94 GitHub repositories.
Recommended by the publisher: No recommended action is mentioned.
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
The Hacker News reports Salesforce features can be chained to break governance.
The Hacker News says Salesforce Agentforce and Email-to-Case can be linked. This is a standard feature. The Hacker News reports it can break governance.
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
Fake Web3 accelerator spreads malware via npm packages.
The Hacker News reports a fake Web3 accelerator pushes information stealers and backdoors to Windows and macOS systems. Elastic says the tools deliver malware and backdoors. The malware is spread using malicious npm packages.