PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches Vulnerability / Web SecurityPHP has warned of another way an attacker could run code on a web serv... 2026-10-23 11:25:43 | 阅读: 76 | 收藏 | The Hacker News - thehackernews.com php 2026 emergency 109619 php2shell

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack Malware / Cyber EspionageThe Russian state-sponsored hacking group Sandworm teamed up with anoth... 2026-10-23 11:11:23 | 阅读: 29 | 收藏 | The Hacker News - thehackernews.com eset sandworm yggdrasil 0099 c2

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Vulnerability / Web SecurityPillow, the most widely used image library for Python, can be made to... 2026-10-23 09:36:0 | 阅读: 32 | 收藏 | The Hacker News - thehackernews.com pillow eps memory tiff maintainers

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Vulnerability / Web SecurityMalicious Brotli data can make an application on an official build of... 2026-10-23 08:40:43 | 阅读: 27 | 收藏 | The Hacker News - thehackernews.com brotli imperva memory continuing reproduced

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a... 2026-10-23 08:35:45 | 阅读: 51 | 收藏 | The Hacker News - thehackernews.com x402 typescript v12 facilitator client

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shel... 2026-10-23 07:40:45 | 阅读: 27 | 收藏 | The Hacker News - thehackernews.com php php2shell 2026 aslr memory

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks Vulnerability / Enterprise SecurityAttackers are exploiting a zero-day SQL injection flaw in Arist... 2026-10-22 19:5:17 | 阅读: 21 | 收藏 | The Hacker News - thehackernews.com vco arista velocloud 2026

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate bu... 2026-10-22 18:12:43 | 阅读: 24 | 收藏 | The Hacker News - thehackernews.com emudhra chrome g1 incommon mozilla

ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More But those big headlines are only half the story. Stolen passwords, exposed databases, broken login c... 2026-10-22 17:45:44 | 阅读: 26 | 收藏 | The Hacker News - thehackernews.com security 2026 attacker repository remote

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported... 2026-10-22 17:1:53 | 阅读: 24 | 收藏 | The Hacker News - thehackernews.com zdi ksmbd 33549 rdma neither

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations Data Privacy / RegulatorySocial media giant Meta was ordered to pay 25 billion in penalties by a N... 2026-10-22 16:12:31 | 阅读: 20 | 收藏 | The Hacker News - thehackernews.com cambridge analytica facebook lawsuit filed

INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown Cybercrime / Law EnforcementINTERPOL on Thursday announced that a coordinated law enforcement acti... 2026-10-22 13:38:22 | 阅读: 32 | 收藏 | The Hacker News - thehackernews.com arrest criminal interpol serengeti nigeria

The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat Enterprise Security / Artificial IntelligenceRight now, there is probably an AI agent running on a... 2026-10-22 11:45:0 | 阅读: 28 | 收藏 | The Hacker News - thehackernews.com bitdefender governed security webinar insider

Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related t... 2026-10-22 11:15:42 | 阅读: 26 | 收藏 | The Hacker News - thehackernews.com railway victim attackers malicious gcp

OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL Vulnerability / Artificial IntelligenceA flaw in the OpenCode AI coding agent allowed a maliciou... 2026-10-22 10:44:5 | 阅读: 28 | 收藏 | The Hacker News - thehackernews.com opencode mcp windows anomaly developer

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security contro... 2026-10-22 08:28:48 | 阅读: 43 | 收藏 | The Hacker News - thehackernews.com litellm attacker github python malicious

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions Vulnerability / Web SecurityNode.js released security updates on October 21 for its three supporte... 2026-10-22 07:47:22 | 阅读: 27 | 收藏 | The Hacker News - thehackernews.com 2026 brotli attacker bypass security

New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Vulnerability / Web SecurityA remote attacker who has not logged in can crash many HTTP/3 web serv... 2026-10-22 06:38:31 | 阅读: 46 | 收藏 | The Hacker News - thehackernews.com foxio lsquic bun attacker stacks

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly dis... 2026-10-22 06:34:10 | 阅读: 41 | 收藏 | The Hacker News - thehackernews.com php 2026 security php2shell

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the... 2026-10-22 04:21:26 | 阅读: 43 | 收藏 | The Hacker News - thehackernews.com microsoft 0940 connectwise cloud artex