What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
The Hacker News · News ·
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Volexity reported three zero-day flaws in Ivanti Connect Secure to Ivanti. An attacker chained these flaws to run commands as root. Ivanti has released fixes for two flaws. A fix for the third flaw is pending.
Recommended by the publisher: Ivanti told customers on affected versions to act immediately.
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
SAP's Cloud SDK for Python has a critical flaw.
The Hacker News reports SAP disclosed a flaw in its Cloud SDK for Python, affecting multi-tenant applications on SAP Business Technology Platform. An attacker must control the tenant subdomain to exploit it. The flaw can send OAuth2 client credentials to an attacker's server.
Recommended by the publisher: The Hacker News reports no recommended action.
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires unvalidated npm configurations.
The Hacker News reports GitHub took this step after researchers found a flaw, GitHub says this affects npm packages, an attacker could push new versions without credentials.
Recommended by the publisher: GitHub says configurations become validated after first successful publish.
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
Xandr fined €8.6 million for relaying Grindr user data.
The Norwegian Data Protection Authority fined Xandr, a Microsoft unit, for illegally relaying Grindr users' sensitive data. The data revealed users' sexual orientation. The authority argues the case merited a high fine due to the breach's serious nature. The Hacker News reports this as the largest issued penalty by the watchdog.
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
Attackers use AI for privilege escalation.
The Hacker News reports attackers can move through systems faster than security teams. A compromised account can become the starting point for further attacks. Attackers exploit vulnerabilities with AI.
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
LG smart TVs are vulnerable to root takeover.
The Hacker News reports three vulnerabilities in LG's webOS can be chained to give an attacker root access. The chain was tested on two TV models. LG issued a fix according to SSD Secure Disclosure.
Recommended by the publisher: LG has issued a fix.
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
Attackers hijacked Danfoss controllers in French supermarkets.
The Hacker News reports attackers took control of fridges and freezers at hundreds of French supermarkets, warming them up to 50°C. The attackers reached them through Danfoss controllers that maintenance firms can manage remotely. Several retail chains were affected, including Les Mousquetaires.
Recommended by the publisher: The Hacker News reports no recommended action.
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
MarkLogic Server flaws could give managers admin control.
Progress Software says two flaws in MarkLogic Server could let delegated managers take admin control. The company published 31 flaws on October 12. Five of them are critical. Fixes have been available since September 10.
Recommended by the publisher: The company released fixes in MarkLogic 11.3.7 and MarkLogic 12.1.0.
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab patches code execution flaw.
The Hacker News reports GitLab Community Edition and Enterprise Edition are impacted. An unauthenticated user could execute arbitrary code on the server. This occurs via a specially crafted regular expression in a CI/CD.
Recommended by the publisher: GitLab has released patches for the flaw.
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Low-cost Android phones ship with preinstalled malware.
The Hacker News reports that low-cost Android smartphones have preinstalled malware, Bitdefender calls it Midnight Mimosa, it targets MediaTek platforms, allowing bad actors to install apps and turn devices into proxies. The malware is baked into the device firmware. Several brands are affected.
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Attackers exploited a newly disclosed flaw within hours.
The Hacker News reports attackers quickly tested a new security flaw. A secure connection did not always mean a safe destination. People offering to fix ransomware had questions to answer.
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
Amazon blocks Meta's Muse AI agent.
The Hacker News reports Amazon blocks Meta's Muse because it doesn't identify itself as a bot. Instinct raises privacy concerns. Personal AI agents cause issues.
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
SonicWall SMA 1000 flaw targeted in 135 exploitation attempts.
The Hacker News reports that threat actors exploited a SonicWall SMA 1000 flaw. The vulnerability is tracked as CVE-2026-102255. It allows a remote attacker to issue requests. The Hacker News says the flaw was exploited within days of public disclosure.
Recommended by the publisher: The Hacker News reports no recommended actions.
Patchstack reports a CVSS 10.0 vulnerability in the Bricksforge plugin for WordPress is being exploited. The flaw, CVE-2026-85097, allows unauthenticated attackers to execute arbitrary PHP code. This results in remote code execution on vulnerable websites.
Recommended by the publisher: Patchstack recommends updating the plugin.
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Campaign stole Ukrainian records.
The Hacker News reports a campaign targeted WordPress sites and Ukrainian entities. The campaign used Cobalt Strike and Claude Code. It stole over 628,000 records.
The Hacker News reports iVerify found P7 DarkSword iOS exploit kit. It reduces its on-device footprint and adds crypto-wallet theft. iVerify says it enables two-way communication with the attacker's infrastructure.
Recommended by the publisher: The Hacker News reports no recommended actions.