What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
CERT-UA reports Dahua IP cameras hijacked in Ukraine.
CERT-UA warns of unauthorized access to Dahua video surveillance systems. Attackers can access video streams and change device configurations. The State Special Communications Service of Ukraine reports cases of compromise.
Read the original at thehackernews.com · Machine-written brief
CISA confirms exploitation of PHP2Shell flaws.
CISA reports active exploitation of PHP2Shell flaws, including CVE-2026-109618, allowing remote code execution. The vulnerabilities are rated 9.2 on the CVSS scoring system. They affect PHP2Shell deployments. CISA added them to its Known Exploited Vulnerabilities catalog.
Recommended by the publisher: The Hacker News does not recommend any action.
Read the original at thehackernews.com · Machine-written brief
Sansec reports 953 online stores infected with JavaScript malware.
Sansec says the malware targets mostly Magento stores, adding code to serve malicious JavaScript. The campaign has been active since July 2025. Sansec reports this as a long-running campaign.
Read the original at thehackernews.com · Machine-written brief
PHP fixes Brotli code execution flaw in Windows packages.
The Hacker News reports PHP rebuilt its Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when it decompresses HTTP responses automatically.
Recommended by the publisher: The Hacker News does not recommend any action.
Read the original at thehackernews.com · Machine-written brief
Attackers use Microsoft Teams to deploy malware and ransomware.
The Hacker News reports attackers use Microsoft Teams' external chat feature to conduct scams or deliver malware. A consistent pattern of attacker behavior has emerged across incidents. The same throwaway tenants and IT themes are used.
Read the original at thehackernews.com · Machine-written brief
Hackers find critical bugs everywhere.
The Hacker News reports critical bugs are showing up everywhere, letting attackers run code remotely. Hackers are scanning for targets and some flaws are already being used in attacks. Security teams have more urgent patches than they can keep up with. A leaked key led to a software supply-chain issue.
Recommended by the publisher: Security teams should patch urgently.
Read the original at thehackernews.com · Machine-written brief
Wasmtime flaws could let malicious modules escape sandboxes.
The Hacker News reports Wasmtime has two critical flaws. An attacker needs a vulnerable build to compile a malicious module. One flaw affects only ARM64 systems. Fixed versions were released.
Recommended by the publisher: Update to a fixed version.
Read the original at thehackernews.com · Machine-written brief
SOC teams see intrusions.
The Hacker News reports SOC teams often first see the shape of an intrusion. Network data connects individual alerts into one timeline. It feeds defensive systems that tie events together.
Read the original at thehackernews.com · Machine-written brief
uCreator Android spyware steals Telegram 2FA passwords and clones WeChat accounts.
The Hacker News reports that uCreator Android spyware takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps. It affects users who install tampered app copies outside official stores. The kit's Telegram part matches Baohuo, a backdoor.
Read the original at thehackernews.com · Machine-written brief
Huntress reports 79 organizations compromised.
Huntress observed an adversary-in-the-middle campaign targeting Microsoft 365, capturing sign-in sessions and replaying stolen tokens. The campaign affected 79 organizations between July 14 and September 22, 2026. Huntress detected 497 successful sign-in events. The attackers compromised 97 accounts.
Read the original at thehackernews.com · Machine-written brief
Gheist steals secrets from GitHub repositories.
Wiz says Gheist uses stolen tokens to plant workflows, The Hacker News reports. The workflows print secrets into GitHub Actions logs. The attacks succeeded in private repositories and GitHub Enterprise environments.
Read the original at thehackernews.com · Machine-written brief
Forever Security found a malicious file trying to trick an AI coding agent.
Forever Security says a malicious instruction file in a Downloads folder tried to make an AI coding agent install a known-malicious npm package. The company caught the attempt on a customer's machine and stopped it. The file's origin is unknown. Forever Security reports this incident in a recent report.
Read the original at thehackernews.com · Machine-written brief
Tailscale SSH flaws let a hacked device reach root on other servers.
The Hacker News reports a security researcher found Tailscale SSH flaws. A hacked device on a Tailscale network can gain root access to other servers. The attack requires Tailscale SSH set up to allow port forwarding and an already compromised device.
Read the original at thehackernews.com · Machine-written brief
Attackers hit a European government entity using PHP2Shell.
The Hacker News reports attackers used PHP2Shell vulnerabilities to access a government entity. The attackers accessed password hashes and multi-factor authentication within two hours. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
Read the original at thehackernews.com · Machine-written brief
Brotli decoder flaw affects Bun, Python and others.
The Hacker News reports a memory-corruption flaw in Google's Brotli decoder affects Bun, Python and Envoy proxies. The flaw, tracked as CVE-2026-111497, allows crafted compressed data to corrupt a program's memory. This potentially allows remote code execution.
Read the original at thehackernews.com · Machine-written brief
LiteLLM's master key leak affects GitHub users.
The Hacker News reports that LiteLLM's master key was accidentally published to a public GitHub repository. This allowed a threat actor to push a malicious version of a Python package. The key was leaked in late May 2026.
Recommended by the publisher: No action recommended.
Read the original at thehackernews.com · Machine-written brief
Google updates policy on AI Search data use.
The Hacker News reports Google's updated policy states AI features may use Gmail and Photos data for targeted ads. Users who allow Google services to access other services' data are affected. Google claims this is due to its personalized AI features.
Read the original at thehackernews.com · Machine-written brief
Eye Security updates disable Popcorn Time updater.
Eye Security reports it pushed updates to disable a background updater of Time4Popcorn, an abandoned Popcorn Time copy, which it says could allow takeover. The updater could fuel a botnet. Eye Security updated over 2 million computers. The firm claims the updater is a security risk.
Recommended by the publisher: No action recommended.
Read the original at thehackernews.com · Machine-written brief
CISA flags two critical flaws in Collabora Online and Arista VeloCloud.
CISA reports two vulnerabilities in Collabora Online and Arista VeloCloud are being actively exploited. The flaws are listed as CVE-2026-110447 with a CVSS score of 9.2. CISA cites reports of active exploitation in the wild.
Recommended by the publisher: The Hacker News does not recommend any action.
Read the original at thehackernews.com · Machine-written brief