The Hacker Newshttps://thehackernews.comMost trusted, widely-read independent cybersecurity news source for everyone; supported by hackers and IT professionals — Send TIPs to admin@thehackernews.comen-usFri, 25 Sep 2026 02:00:43 +0530hourly1Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissionshttps://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.htmlhttps://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.htmlThu, 24 Sep 2026 23:40:18 +0530info@thehackernews.com (The Hacker News)ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Storieshttps://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.htmlhttps://thehackernews.com/2026/09/threatsday-ai-search-poisoning-ai.htmlThu, 24 Sep 2026 23:22:43 +0530info@thehackernews.com (The Hacker News)Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Contenthttps://thehackernews.com/2026/09/placeholder-third-partycom-referenced.htmlhttps://thehackernews.com/2026/09/placeholder-third-partycom-referenced.htmlThu, 24 Sep 2026 20:57:32 +0530info@thehackernews.com (The Hacker News)Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealerhttps://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.htmlhttps://thehackernews.com/2026/09/hacked-ukrainian-sites-serve-fake.htmlThu, 24 Sep 2026 19:59:06 +0530info@thehackernews.com (The Hacker News)Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Callshttps://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.htmlhttps://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.htmlThu, 24 Sep 2026 17:35:27 +0530info@thehackernews.com (The Hacker News)Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignorehttps://thehackernews.com/2026/09/secrets-sprawl-is-identity-problem-that.htmlhttps://thehackernews.com/2026/09/secrets-sprawl-is-identity-problem-that.htmlThu, 24 Sep 2026 16:30:00 +0530info@thehackernews.com (The Hacker News)17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.htmlhttps://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.htmlThu, 24 Sep 2026 14:44:21 +0530info@thehackernews.com (The Hacker News)OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Fileshttps://thehackernews.com/2026/09/openai-agent-bypassed-australian.htmlhttps://thehackernews.com/2026/09/openai-agent-bypassed-australian.htmlThu, 24 Sep 2026 12:37:25 +0530info@thehackernews.com (The Hacker News)TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwordshttps://thehackernews.com/2026/09/teamfiltration-compromises-seven.htmlhttps://thehackernews.com/2026/09/teamfiltration-compromises-seven.htmlThu, 24 Sep 2026 12:02:03 +0530info@thehackernews.com (The Hacker News)Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosurehttps://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.htmlhttps://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.htmlThu, 24 Sep 2026 11:06:18 +0530info@thehackernews.com (The Hacker News)Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registryhttps://thehackernews.com/2026/09/attackers-use-malicious-terraform.htmlhttps://thehackernews.com/2026/09/attackers-use-malicious-terraform.htmlWed, 23 Sep 2026 23:36:30 +0530info@thehackernews.com (The Hacker News)A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as Youhttps://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.htmlhttps://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.htmlWed, 23 Sep 2026 22:23:10 +0530info@thehackernews.com (The Hacker News)MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Keyhttps://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.htmlhttps://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.htmlWed, 23 Sep 2026 21:36:41 +0530info@thehackernews.com (The Hacker News)This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Movehttps://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.htmlhttps://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.htmlWed, 23 Sep 2026 19:47:58 +0530info@thehackernews.com (The Hacker News)Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPIhttps://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.htmlhttps://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.htmlWed, 23 Sep 2026 19:22:46 +0530info@thehackernews.com (The Hacker News)New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Controlhttps://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.htmlhttps://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.htmlWed, 23 Sep 2026 17:46:00 +0530info@thehackernews.com (The Hacker News)545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agenthttps://thehackernews.com/2026/09/545-hackers-tested-it-first-now-xranges.htmlhttps://thehackernews.com/2026/09/545-hackers-tested-it-first-now-xranges.htmlWed, 23 Sep 2026 17:17:19 +0530info@thehackernews.com (The Hacker News)Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Testshttps://thehackernews.com/2026/09/anthropic-and-openai-models-still.htmlhttps://thehackernews.com/2026/09/anthropic-and-openai-models-still.htmlWed, 23 Sep 2026 17:17:13 +0530info@thehackernews.com (The Hacker News)Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escapehttps://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.htmlhttps://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.htmlWed, 23 Sep 2026 16:42:18 +0530info@thehackernews.com (The Hacker News)F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servershttps://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.htmlhttps://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.htmlWed, 23 Sep 2026 13:59:48 +0530info@thehackernews.com (The Hacker News)Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malwarehttps://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.htmlhttps://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.htmlWed, 23 Sep 2026 13:59:24 +0530info@thehackernews.com (The Hacker News)Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Inputhttps://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.htmlhttps://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.htmlWed, 23 Sep 2026 12:34:40 +0530info@thehackernews.com (The Hacker News)ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicantshttps://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.htmlhttps://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.htmlWed, 23 Sep 2026 11:00:09 +0530info@thehackernews.com (The Hacker News)Check Point Warns of Management Server Zero-Day Exploited in Targeted Attackshttps://thehackernews.com/2026/09/check-point-warns-of-management-server.htmlhttps://thehackernews.com/2026/09/check-point-warns-of-management-server.htmlTue, 22 Sep 2026 23:59:39 +0530info@thehackernews.com (The Hacker News)WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servershttps://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.htmlhttps://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.htmlTue, 22 Sep 2026 23:33:10 +0530info@thehackernews.com (The Hacker News)Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentialshttps://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.htmlhttps://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.htmlTue, 22 Sep 2026 23:28:15 +0530info@thehackernews.com (The Hacker News)Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromiseshttps://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.htmlhttps://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.htmlTue, 22 Sep 2026 22:33:31 +0530info@thehackernews.com (The Hacker News)Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentialshttps://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.htmlhttps://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.htmlTue, 22 Sep 2026 22:11:12 +0530info@thehackernews.com (The Hacker News)Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updateshttps://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.htmlhttps://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.htmlTue, 22 Sep 2026 21:44:04 +0530info@thehackernews.com (The Hacker News)AI Agents Are Rewriting the Rules of Lateral Movementhttps://thehackernews.com/2026/09/ai-agents-are-rewriting-rules-of.htmlhttps://thehackernews.com/2026/09/ai-agents-are-rewriting-rules-of.htmlTue, 22 Sep 2026 18:00:00 +0530info@thehackernews.com (The Hacker News)New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setupshttps://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.htmlhttps://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.htmlTue, 22 Sep 2026 17:59:00 +0530info@thehackernews.com (The Hacker News)DORA Year Two: Can Your SOC Actually See the Attack?https://thehackernews.com/2026/09/dora-year-two-can-your-soc-actually-see.htmlhttps://thehackernews.com/2026/09/dora-year-two-can-your-soc-actually-see.htmlTue, 22 Sep 2026 17:15:00 +0530info@thehackernews.com (The Hacker News)New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memoryhttps://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.htmlhttps://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.htmlTue, 22 Sep 2026 17:08:40 +0530info@thehackernews.com (The Hacker News)SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCEhttps://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.htmlhttps://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.htmlTue, 22 Sep 2026 16:47:41 +0530info@thehackernews.com (The Hacker News)Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removalhttps://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.htmlhttps://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.htmlTue, 22 Sep 2026 15:08:18 +0530info@thehackernews.com (The Hacker News)SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishinghttps://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.htmlhttps://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.htmlTue, 22 Sep 2026 13:22:03 +0530info@thehackernews.com (The Hacker News)One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoorhttps://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.htmlhttps://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.htmlTue, 22 Sep 2026 12:03:57 +0530info@thehackernews.com (The Hacker News)WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Sessionhttps://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.htmlhttps://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.htmlTue, 22 Sep 2026 11:33:14 +0530info@thehackernews.com (The Hacker News)Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Accesshttps://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.htmlhttps://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.htmlTue, 22 Sep 2026 11:01:59 +0530info@thehackernews.com (The Hacker News)Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDRhttps://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.htmlhttps://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.htmlMon, 21 Sep 2026 23:01:01 +0530info@thehackernews.com (The Hacker News)Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Cryptohttps://thehackernews.com/2026/09/contagious-interview-campaign.htmlhttps://thehackernews.com/2026/09/contagious-interview-campaign.htmlMon, 21 Sep 2026 22:49:00 +0530info@thehackernews.com (The Hacker News)Google Fined €403 Million Over GDPR Violations Tied to Location Datahttps://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.htmlhttps://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.htmlMon, 21 Sep 2026 22:27:31 +0530info@thehackernews.com (The Hacker News)⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijackshttps://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.htmlhttps://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.htmlMon, 21 Sep 2026 19:54:13 +0530info@thehackernews.com (The Hacker News)TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Datahttps://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.htmlhttps://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.htmlMon, 21 Sep 2026 19:45:40 +0530info@thehackernews.com (The Hacker News)ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructurehttps://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.htmlhttps://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.htmlMon, 21 Sep 2026 14:09:38 +0530info@thehackernews.com (The Hacker News)Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoorshttps://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.htmlhttps://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.htmlMon, 21 Sep 2026 11:36:44 +0530info@thehackernews.com (The Hacker News)Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flawshttps://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.htmlhttps://thehackernews.com/2026/09/claude-opus-5-helped-researchers-take.htmlSun, 20 Sep 2026 00:06:53 +0530info@thehackernews.com (The Hacker News)Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinarhttps://thehackernews.com/2026/09/can-you-prove-new-cve-is-exploitable.htmlhttps://thehackernews.com/2026/09/can-you-prove-new-cve-is-exploitable.htmlSat, 19 Sep 2026 18:58:48 +0530info@thehackernews.com (The Hacker News)Identity Visibility in 2026: The Foundation of Identity Securityhttps://thehackernews.com/2026/09/identity-visibility-in-2026-foundation.htmlhttps://thehackernews.com/2026/09/identity-visibility-in-2026-foundation.htmlSat, 19 Sep 2026 18:58:41 +0530info@thehackernews.com (The Hacker News)SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCEhttps://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.htmlhttps://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.htmlSat, 19 Sep 2026 15:01:17 +0530info@thehackernews.com (The Hacker News)