China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

, ,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Broadcom VMware ESX vulnerability (CVE-2026-41709) to its Known Exploited Vulnerabilities catalog after CrowdStrike reported its exploitation by the China-linked threat actor Warp Panda. This zero-day flaw allows attackers with admin access to perform actions without logging, enabling reduced audit trail visibility; Warp Panda has used it to target U.S. legal sector organizations and maintain covert persistence by bypassing detection mechanisms. Agencies are advised to apply available patches by November 11, 2026, to mitigate this active threat.

https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html

Chrome Extensions with 13.4 Million Installs Caught Hijacking Searches

, , ,

A campaign involving 319 Chrome extensions with 13.4 million installs has been found hijacking users’ searches by redirecting them through tracking servers to generate ad revenue from Bing and Yahoo. These unlisted extensions, disguised as useful tools and promoted via shady ads, exploit Chrome’s settings to replace default search engines and funnel traffic through operator-controlled proxies, risking redirection to phishing sites or malware. Most identified extensions have been removed from the Chrome Web Store, but new variants continue to appear, prompting users to uninstall suspicious add-ons and run full antivirus scans.

https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

, ,

A critical race condition vulnerability (CVE-2026-98432) in the Linux kernel’s TCP code allows remote attackers to execute commands as root, affecting Ubuntu, Red Hat, and other distributions with a CVSS score of 9.8 assigned by the kernel’s CVE team. While Debian, Oracle Linux, SUSE, and Amazon Linux have released patches, Ubuntu and Red Hat have yet to provide fixed kernels, and the flaw primarily exploits the multipath TCP feature, with recommendations to update to patched kernel versions where available. Anthropic’s AI-generated exploit demonstrates how an attacker can leak kernel memory addresses and gain root access, highlighting the urgency to apply updates once released.

https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits

,

Anthropic’s unreleased internal AI model automatically discovered and chained multiple security flaws into working proof-of-concept exploits affecting Chrome, Safari, Android, Windows, and Linux, all of which have since been patched following coordinated disclosure. Notably, the AI combined several distinct vulnerabilities to achieve complex exploits such as running code outside browser sandboxes and obtaining root commands over a network, demonstrating an unprecedented automated capability previously attributed only to specialized human teams. Anthropic emphasizes these findings as a tool to aid defenders and offers vetted security professionals access to its AI models through a Cyber Verification Program.

https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html

PHP2Shell Security Flaws Now Sucessfully Exploited in the Wild

, ,

Two critical PHP vulnerabilities, collectively called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), have been confirmed to be exploited in the wild, with evidence of successful remote code execution on Apache mod_php running PHP 8.4.26. Security researchers and threat analysts observed active exploitation attempts before and after emergency patches were released on October 21, 2026, prompting advisories for immediate patching and mitigation measures to protect millions of exposed PHP-based web servers.

https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

, ,

A long-running hacking campaign since July 2025 has infected 953 online stores, predominantly running Magento, by injecting scanner-evading malicious JavaScript into CMS blocks to target real shoppers while avoiding detection by security tools. The attackers exploited vulnerabilities such as PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) to gain access, and use multiple rotating domains to host loader scripts that include bot filtering and persistent payload storage. Site owners are urged to audit for suspicious CMS blocks and administrator accounts, apply security patches, and enforce strong passwords to mitigate the threat.

https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html

Reports of PHP Bug Exploitation Attempts Grow as Experts Downplay Viability of Exploits

,

Reports of attempted exploits targeting two recent PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), have surged, with several large companies observing scanning and probe activities linked to botnets like Potassium and Mirai. However, cybersecurity experts emphasize that no successful widespread exploitation has been confirmed, noting that proof-of-concept exploits mostly function only under ideal lab conditions and are impeded by protections such as address space layout randomization (ASLR). Despite the current challenges for attackers, experts warn that evolving exploit techniques could overcome these barriers soon, urging organizations to promptly patch vulnerable PHP systems.

https://therecord.media/php-php2shell-exploitation-attempts-pocs

Autonomous Attack Agent in ‘Skynet Mode’ Hijacks Other Models to Carry Out Its Evil Deeds

,

Security researchers from Symantec uncovered an autonomous AI attack agent designed to hijack exposed AI models and execute up to 100,000 steps of malicious activity without human intervention. The AI-powered tool scans the internet for vulnerable OpenAI-style endpoints, exploits various web frameworks to steal data and credentials, executes remote code, and deploys covert cryptocurrency miners, operating in a “Skynet mode” that continuously reinfects hosts. Although the agent has not been observed in real-world attacks, its capability to use hijacked models for orchestrating complex cyberattacks marks a significant evolution in AI-driven threats.

https://www.theregister.com/security/2026/10/24/autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evil-deeds/5305215

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

, ,

Cybersecurity researchers uncovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups, centered around an autonomous offensive framework called Phantom. The attackers exploited multiple known vulnerabilities in edge and remote-access systems, leveraging AI-managed knowledge bases and a “human-approved” operational model to conduct scalable intrusions, credential harvesting, data exfiltration, and ransomware deployment targeting mainly U.S. industrial and healthcare sectors. Their diverse toolkit includes AI-powered penetration tools, polymorphic implants, and evasion techniques, enabling sophisticated intrusion campaigns and structured extortion efforts.

https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html

Meta Muse Exposes Users’ Personal and Business Secrets When They Share Conversations

, ,

Meta’s AI assistant Muse allows users to share conversations via public URLs, but a security flaw exposed sensitive personal and business information due to the inclusion of conversation titles in the URLs, making them easily discoverable through passive DNS searches. Researchers found thousands of such links revealing confidential data, prompting Meta to suspend the sharing feature while investigating and considering changes to prevent unintended access.

https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/

Cve.now: a Free CVE Feed for Agents

,

cve.now is a free, public vulnerability feed that consolidates data from multiple sources including the CVE List, GitHub Advisory Database, OSV, NVD, and others, providing up-to-date summaries and severity ratings for vulnerabilities. It supports integration with coding agents via an MCP server and offers features like stack checking through lockfile uploads, customizable vulnerability feeds, and multiple subscription formats. The platform requires no login or API key and aims to simplify tracking known security issues across diverse software ecosystems.

https://cve.now/

Pwn.watch · Live Security Incidents

,

Pwn.watch tracks live security incidents, reporting 43 ongoing patchable vulnerabilities and 20 breaches, including critical zero-day exploits with some lacking patches. Notable recent findings include an unpatched remote code execution in an abandoned Popcorn Time fork affecting millions of devices, leaked unpatched Linux kernel bugs with public exploit details, and a browser extension leaking cryptocurrency private keys for over 20 months. The platform highlights that while many critical flaws have been patched (e.g., in PHP, Chrome, Okta, and Citrix products), several remain actively exploited or unpatched, urging timely updates and mitigations.

https://pwn.watch/

PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

,

PHP has identified a new remote code execution vulnerability (CVE-2026-115560) affecting web applications with a rare configuration involving the session upload progress feature and session serialization settings. Unlike the recent critical PHP2Shell flaws patched on October 21, this issue is considered unlikely to be exploited and will be addressed in a routine future release; meanwhile, PHP advises disabling session upload progress as a mitigation. Exploitation attempts continue against the earlier PHP2Shell vulnerabilities, but no attacks targeting this new issue have been reported.

https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

, ,

Threat actors have launched millions of attempts to exploit the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 8.2 to 8.5, aiming to deploy a Mirai botnet variant called Potassium. Despite widespread scanning and exploit attempts, no successful remote code execution or payload deployment has been confirmed, indicating difficulties in weaponizing the flaws effectively; patching has been urged as more than 34 million PHP services remain vulnerable, with significant impacts leading to precautionary website shutdowns globally.

https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

,

Security researchers at Imperva demonstrated a remote code execution exploit, dubbed “Node2Shell,” targeting an official Node.js 24.22.0 build by using crafted malicious Brotli data to trigger a vulnerability in the bundled Brotli decoder (CVE-2026-111497). The flaw affects Node.js versions 22.x, 24.x, and 26.x lines, allowing attackers to execute arbitrary code via Brotli-compressed HTTP request or response bodies, and has been fixed in Node.js 24.22.1 by adopting an upstream Brotli patch that rejects malformed streams. Users and service providers are urged to update to patched Node.js releases and limit untrusted Brotli traffic, as no workaround exists within Node.js itself.

https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html

Scroll to Top