What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
The Hacker News · News ·
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX fixes five vulnerabilities.
The Hacker News reports NGINX released versions 1.30.6 and 1.31.7 to fix five vulnerabilities, one of them present since May 2005. F5 says three memory bugs could crash a worker process or possibly let an attacker run code. A fourth bug lets an attacker forge a TLS session.
Recommended by the publisher: Update to versions 1.30.6 or 1.31.7.
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js fixes two critical RCE flaws.
The Hacker News reports Next.js released a security update fixing two critical flaws allowing unauthenticated remote code execution. One flaw is in React Server Components and the other in librsvg. The fixes address high-severity denial-of-service flaws as well.
Recommended by the publisher: The Hacker News says Next.js shipped an out-of-band patch.
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal patches critical Field UI flaw.
The Hacker News reports a critical flaw in Drupal's Field UI module allows code execution on the site's server. The Drupal Security Team says an attacker cannot reach the flaw through core alone. Several exploit paths exist through contributed modules, with at least one path needing no login. Fixes were shipped in Drupal 11.4.10, 11.3.19, and 10.6.19.
Recommended by the publisher: Update to Drupal 11.4.10, 11.3.19, or 10.6.19.
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers impersonate AI products.
The Hacker News reports attackers impersonate AI products to distribute malware and steal sessions. ANY.RUN linked 1,258 analyses to fake AI campaigns. US businesses are targeted.
Recommended by the publisher: MSSPs can stop incidents early.
Palo Alto Networks patches PAN-OS flaw under active exploitation.
The Hacker News reports a high-severity flaw in PAN-OS software is being actively exploited. The vulnerability, tracked as CVE-2026-0322, allows remote code execution in the management interface. Palo Alto Networks issued security updates for the flaw.
Recommended by the publisher: The Hacker News does not recommend any actions.
The Hacker News reports AI tools are used in digital forensics and incident response, their output is not reliably verified, this gap can spread beyond a workstation.
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
India mandates caller name display on 4G networks.
The Hacker News reports the Indian government directed telecom service providers to display callers' registered names for incoming calls from November 1, 2026, to tackle spam calls. This applies to 4G and newer networks. The Department of Telecommunications issued a circular to service providers. The goal is to help people identify unknown calls.
Recommended by the publisher: The Hacker News does not recommend any action.
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromises 1,900 GitHub accounts.
The Hacker News reports GhostAction targets over 30,000 repositories. GitGuardian observed the spike on October 8 and 9, 2026. It attempted to extract secrets from public repositories' CI.
The Hacker News reports that threat actors are exploiting a critical security flaw in Langflow, according to Previdian. The vulnerability is CVE-2026-105740 with a CVSS score of 9.9. Langflow is an open-source platform for building AI applications. The flaw allows for authenticated RCE.
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
AhsayCBS flaws exploited to deploy web shells.
The Hacker News reports AhsayCBS has two security flaws, CVE-2026-105133 and CVE-2026-105134, that can be chained to execute arbitrary commands. Ahsay Backup released security updates to address these flaws. The vulnerabilities were exploited to drop web shells and XMRig cryptocurrency miners.
Recommended by the publisher: Ahsay Backup released security updates to address these flaws.
The Hacker News reports attackers are exploiting a critical flaw in Cisco Secure Email Gateway. The attacker sends an email with a crafted attachment through the gateway and could run commands as root. Cisco said this in an advisory.
Recommended by the publisher: The Hacker News reports no recommended actions.
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Hackers backdoor Nextcloud servers through Collabora flaw.
The Hacker News reports attackers exploited a flaw in Collabora Online to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub. A web shell executes any command an attacker sends via a web request.
Recommended by the publisher: No recommended action is given.
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft disrupts 3 phishing kits.
The Hacker News reports Microsoft and partners disrupted CoGUI, Haozi, and Iron Man System kits. These kits sent over 1 billion scam messages since January 2026. The kits were linked to threat actors.
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
US charges 14 in North Korean IT worker fraud.
The Hacker News reports the US Department of Justice charged 14 people for their roles in an IT worker conspiracy affecting over 70 US companies. The indictment includes charges of wire fraud conspiracy. The DoJ seized about 187 computers as part of its efforts to disrupt North Korea's fraudulent scheme. The scheme involved US citizens and Chinese nationals.
Recommended by the publisher: No recommended action is given.
CISA reports an actively exploited vulnerability in Ivanti Connect Secure, tracked as CVE-2026-104935, which is an authentication bypass flaw. The Hacker News reports this affects ICS appliances and deployments. CISA assesses the vulnerability has a CVSS score of 8.6.
Recommended by the publisher: CISA urges organizations to update Ivanti Connect Secure appliances to the latest version.
The Hacker News reports a flaw in curl's HTTP/2 upload handling lets a malicious server corrupt the client's memory. The curl project fixed it in curl 8.23.0. A real attack likely ends in a crash. Taking over a client requires exact knowledge of its build and memory layout.
Recommended by the publisher: Update to curl 8.23.0.
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Cloned voices are used in payment fraud.
The Hacker News reports cloned voices are used in payment fraud, help desk resets, and access requests. A drill can test verification processes. Security teams can identify weaknesses.
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
XBOW built a Chrome full-chain exploit in six days.
The Hacker News reports XBOW chained three unknown Google Chrome bugs into a single attack. The attack runs code on a Windows computer when a user loads a web page. Google has confirmed and fixed the bugs. XBOW used OpenAI's GPT-5.6 Sol model to build the attack.
Recommended by the publisher: Google has fixed the bugs.
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
ThreatFabric found Hirudo Android trojan bypassing banking apps' security.
ThreatFabric says Hirudo replaces legitimate banking apps with patched versions to bypass security checks. The trojan targets Indonesian banking apps. ThreatFabric identified replacements for eight apps. ThreatFabric reported this finding.
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
AI agent finds OTP bypass in insurer's website.
The Hacker News reports an AI pentesting agent found a critical authentication bypass on a major insurer's production website. The bug allowed a user to choose where the one-time passcode went. The Hacker News says proving the bug was the hard part.
Recommended by the publisher: The Hacker News reports no recommended action.