The Hacker News

621 articles in the TruthFoundry index. Each links out to the original.

• Critical Ruby on Rails Flaw Allows Server File Access Via Image Uploads · Ruby on Rails patched critical Active Storage flaw enabling server file access via ImageMagick uploads.
• Binance discloses $6.43B theft via fake interviews and AI tool abuse · Binance revealed a $6.43 billion exchange theft used fake job interviews and compromised AI tools.
• Russia-aligned Gorbag hackers exploit WinRAR flaw against Ukrainian targets · Gorbag threat actor uses data-stealing malware to target Ukrainian government and defense organizations.
• Synology NAS Targeted By Ransomware Exploiting Patched DSM Vulnerability · Synology urges DSM software updates after ransomware attacks use patched flaws.
• Active exploitation of critical Siemens IoT2050 flaw installs remote backdoors · VulnCheck reports active exploitation of maximum severity Siemens IoT CVE-2026-58115 flaw.
• Weekly Cybersecurity Recap: Major Breaches, Crypto Theft And Threats · This roundup documents top cybersecurity incidents, breaches and threats reported this week.
• Google Disrupts 1.3M Device Android Botnet Tied To TV Box Maker Videostrong · Google took down a 1.3 million device Android botnet linked to manufacturer Videostrong.
• Iran-Aligned DarkBlinders Compromises Israeli And Iraqi Kurdish Government Targets · Cybersecurity researchers disclose DarkBlinders cyber espionage campaign targeting Israel and Iraqi Kurdistan.
• Attackers pose as IT on Microsoft Teams to steal data via AD CS flaws · Microsoft reports attackers used Teams social engineering and AD CS misconfigurations to breach companies.
• Hackers steal $2.7M from Polymarket traders via compromised DebugBear script · Hackers stole funds from Polymarket traders using a hijacked third-party performance script.
• OpenAI patched critical ChatGPT shared link code execution vulnerability · Security researchers disclosed a critical ChatGPT exploit allowing remote account access via shared links
• Cloudflare reports 38% rise in network-layer DDoS attacks for Q3 2026 · Cloudflare recorded 18.2 million network-layer DDoS attacks in Q3 2026, a 38% quarterly increase.
• TeamViewer fixes high severity reverse remote attack flaw · TeamViewer patched a flaw allowing controlled host machines to attack connecting viewer devices.
• Critical security fixes remain undone over operational breakage fears · Organizations fail to enable existing security protections due to service disruption concerns
• Trojanized Claude Code extension on Cursor Marketplace installs SSH backdoor · Malicious Claude Code update on Cursor Marketplace targeted up to 5000 users with an SSH backdoor.
• Drupal Commerce Core critical authorization bypass flaw actively exploited · Drupal warns threat actors are actively exploiting a critical Commerce Core security flaw.
• CISA adds actively exploited GitLab and Cisco flaws to KEV catalog · CISA added two actively exploited GitLab and Cisco security flaws to its KEV list.
• Binance suffers major security breach affecting $6.3 billion in assets · Cryptocurrency exchange Binance disclosed a large security breach impacting $6.3 billion in platform assets.
• Critical 9.8 CVSS Linux TCP flaw impacts major distributions · A high-severity Linux kernel TCP flaw affects Ubuntu, Red Hat and other distributions.
• Fake ChatGPT Claude apps use signed executables to deploy crypto miners · Check Point Research documents Yoba malware campaign abusing fake AI desktop applications.
• Google Launches Gemini 4 Carbon AI Leading Cybersecurity Benchmarks · Google unveiled Gemini 4 Carbon AI model which tops multiple cybersecurity performance benchmarks.
• Wiz Hosts Webinar On Building AI Threat Readiness For Security Teams · The Hacker News announces an upcoming Wiz webinar on AI threat readiness for security operations.
• AI Redefines Cybersecurity Operations And Creates New Threat Operator Role · AI automation is reshaping cybersecurity work and establishing the new Threat Operator profession.
• Cisco patches actively exploited VPN flaw crashing ASA and FTD firewalls · Cisco releases fixes for actively exploited high-severity firewall VPN denial-of-service flaw
• Alpine Linux GitLab Targeted By Critical CVSS 10.0 Vulnerability Exploit · Alpine Linux confirmed an attacker attempted to exploit a CVSS 10.0 flaw on its GitLab server.
• Hackers exploit critical Cisco SD-WAN flaw to steal encryption keys via malware · Cisco Talos disclosed attackers used CVE-2026-20127 to deploy KeyDrift malware on SD-WAN controllers.
• Palo Alto Networks confirms active exploitation of PHP2Shell vulnerabilities · Threat actors exploit PHP2Shell flaws on exposed Palo Alto management interfaces.
• Volt Typhoon used Silent Train network for four zero-day exploitation campaigns · Lumen Black Lotus Labs links Volt Typhoon to four zero-day campaigns via the Silent Train network.
• Google enables one-tap Android installs for approved third-party app stores · Google will allow one-tap app installs for verified third-party Android stores outside the US.
• AI-Assisted PHP2Shell Attack Breaches 25 Servers Including US Government Network · Suspected China-linked threat actor used AI-augmented exploits to compromise 25 global servers.