Company
The Hacker News (thehackernews.com) is a widely read cybersecurity news outlet covering data breaches, vulnerabilities, malware, and threat intelligence.
Calif published a working exploit that gets root on OpenBSD 7.9 past KARL, SMAP and SMEP by chaining two flaws patched on September 14 and 30. Neither flaw has a CVE, and The Hacker News reports no evidence of attacks.
Reality
Cisco Talos tracks UAT-11985, an APT sending Taiwan research affiliates fake event invites that lead to a Google login proxy capturing MFA codes. The proxy relays entries to Google in real time, so a code typed into the fake page reaches the attacker first.
Reality
Glow counts more than 13,000 internal images in 900-plus public GitHub repos tied to developers at 300-plus organizations. Its report ties the uploads to coding agents that needed somewhere to show reviewers a screenshot a private repo could not render.
Reality
Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect and Prisma Access authentication bypass disclosed in May. ReliaQuest says access through a victim's own VPN can look like remote work until credential theft or ransomware deployment is underway.
Reality
Researcher cereblab's mitmproxy capture shows xAI's Grok Build CLI 0.2.93 sending about 5.10 GiB to storage and 192 KB to the model. The prompt said not to read files, so teams should audit what their agent CLIs transmit.
Reality
Infoblox ties the Help TDS traffic distribution system, active since at least 2017, to a Russian-language affiliate program called Hotejka. The Hacker News reports the scams run on more than 20,000 Cloudflare Pages domains and aim to put remote desktop tools on victims' machines.
Reality
ANY.RUN tied 1,258 public sandbox analyses to fake AI-brand campaigns between April and October 2026. The vendor says repeat cases strain MSSP analyst capacity, though the article does not report analyst hours.
Reality
India's telecom department has ordered carriers to show callers' registered names on incoming 4G and newer calls from November 1, 2026. The name comes from the originating carrier's subscriber records, so the display is only as reliable as those records.
Reality
Reflectiz's AI pentest agent logged into a major insurer's production site by sending its one-time code to an inbox it controlled. The server never checked the address against the account, so the code proved nothing about who held it.
Reality
SAP rated CVE-2026-89111, an OAuth2 credential leak in its Cloud SDK for Python, CVSS 10.0 in an October 13 advisory. The Hacker News found that six later releases, 0.53.0 through 0.55.0, skip the August fix in the Destination module.
Reality
Doyensec ran its own code inside the Windows VBS enclave behind SmartScreen's phishing protection by chaining a four-byte write with a timing bug. Microsoft patched CVE-2026-83498 on September 8, 2026 and says it has not been exploited.
Reality
Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.
Reality
UAC-0099's ASHVEIN malware carries a nuclear-weapons prompt meant to make an LLM analyst refuse the script, a dev.to post says. The post tests no model, but any pipeline that sends a whole script to an LLM in one prompt can check itself for the flaw.
Reality
GoBalance signs onion descriptors with half of a 64-byte Tor key, so anyone can recover a site's master key from one public descriptor. Because the address is the public key, a patch cannot recall a leaked key, and exposed sites have to move to new .onion addresses.
Reality
Glow says AI coding agents asked for review screenshots put over 13,000 internal images from 300-plus organizations into public GitHub repositories. Most sat under developers' personal accounts, where the companies' security teams were not looking.
Perspective Coverage
5 publishersReality
LibreOffice 26.2.5 and 26.8.0 fix a flaw that lets a spreadsheet run Java code on open with no warning; Apache OpenOffice's fix waits on 4.1.17. The attack needs Java enabled, so OpenOffice users can block it now by turning Java off.
Reality
ANY.RUN tied 351 sandbox analyses to CSuite, a phishing operation that steals Microsoft 365 sessions or installs ScreenConnect or Action1 for remote access. Resetting credentials leaves the remote-access half of an intrusion in place.
Reality
CVE-2026-94545 lets attacker-supplied text in an Open Graph image reach Next.js dependencies. Vercel shipped the fix on September 22 in 16.3.6; a day later, npm audit still passed affected builds.
Reality
Expel's teardown of a loader first compiled around 28 July 2026 puts the whole delivery chain outside email, and says its module hashes change with every infection.
Reality
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Reality
Security · August 30, 2026 · One report1 publisher
Security · August 28, 2026 · Confirmed4 publishers
Security · September 2, 2026 · Confirmed2 publishers
Security · September 12, 2026 · One report1 publisher
Security · September 17, 2026 · Confirmed2 publishers
Security · September 21, 2026 · Confirmed2 publishers