The Hacker News | #1 Trusted Source for Cybersecurity News

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m. PST. The following compromised versions were published - LiteLLM v1.107.0 (PyPI) v1.107.0, latest, main-latest, and main-stable (Docker) v1.107.0, latest, main-latest, and main-stable (GHCR) Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC are impacted. The poisoned version incorporated code to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote acce...

Node.js released  security updates  on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system. Each supported line has one fixed version:  22.23.4  and  24.22.1  on the long-term support lines, and  26.12.1  on the current line. Node.js 20.x and earlier have  reached end of life  and will not receive the fix, so they should be moved to a supported line. The Brotli flaw is in code Node.js bundles, not in a user's own program. Node.js runs that code whenever it decompresses Brotli data, either directly through the  node:zlib  module or automatically when code calls fetch() on a response sent with Brotli compression. An application is exposed where it decompresses Brotli data an att...

A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO  disclosed , releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server out of memory. The flaws cause only denial-of-service attacks, with no evidence of data theft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure. FoxIO found the same class of flaw in seven of ten HTTP/3 stacks it tested. The common cause is in QPACK, the scheme HTTP/3 uses to compress request headers so repeated fields travel as a short code instead of the full text. A server is supposed to cap the size of the headers after it unpack...

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure." The attempt, Amazon said, was recorded from " 103.216.220[.]92 ," an IP address geolocated to Australia. The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked ...

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX , a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims. The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. "Storm-0940's use of ARTEX accelerated the speed of comprom...

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as  CVE-2026-110264 , is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. GitLab has not said what those conditions are. The company reports no sign the flaw has been used in attacks, and it is not listed in the U.S. CISA catalog of known exploited vulnerabilities as of October 22. Only self-managed installations need to act. G...

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind . The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed. Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release. "We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen said . "The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. A...

OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment. "A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a Slack history search as a reason to suppress monitoring notifications," OpenAI said in a report. The end result of this action was that the misalignment monitor still ran and saved its reports, but automatic human alerts were disabled by setting "no_notify" to true and emptying the lists of people configured to receive the reports. In another task on October 6, a GPT-6 Astra agent migrating a program is said to have removed its monitoring integration in...

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell , sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs. Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers  CVE-2026-109618  and  CVE-2026-109619 . PHP published them around the scheduled release time of 14:00 UTC on October 21, a day after details leaked ahead of a planned October 22 disclosure. Researchers at Wiz, Calif, and OpenAI found and reported the flaws, which affect nearly every PHP version back to PHP 5.4. Who Is Affected Every PHP installatio...

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of these attacks, unsuspecting users who land on legitimate-but-compromised sites or click on malicious ads are redirected to phishing landing pages that display fake Cloudflare or Google reCAPTCHA verification or other non-existent errors and instruct users to copy and paste a command on the Windows Run dialog (or the Mac Terminal app) to address it. The moment a user presses the Enter key after pasting the command, it triggers a multi-stage infection chain that leads to the deployment of malware, such as information stealers or remote access trojans. In an attempt to blend in with re...

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published Tuesday. Between August 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.  DLL sideloading is a popular adversarial technique that exploits the way Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL . When an application is launched, it needs to load various DLLs in order to function correctly. If the application does not provide the f...

Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result. Proofpoint shared several examples of the shift at its Protect 2026 conference. In one, a single threat actor contacted more than 30 real estate agents at the same company, each from a different account, about a different property, and in different words, before closing every thread with the same request: join a video meeting. Federal data points the same way. The FBI's Internet Crime Complaint Center counted more than 22,000 complaints involving AI in 2025, with nearly $900 million in associated losses, and logged 24,768 business email compromise (BEC) complaints with about $3.05 billion in reported losses, according to its 2025 Internet Crime Report . What AI C...

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at  14:00 UTC on October 21  for two flaws it rates 9.2 out of 10, and has given no workaround of its own. Until you can install it, what lowers your risk is taking exposed PHP off the internet or behind access controls, cutting what a compromised server can reach, and having the update ready to apply the moment it lands. Cloudflare says it is seeing early attempts to exploit the flaws, and has pushed emergency rules for sites behind it that it calls a stopgap until you patch. No compromise has been confirmed, the public exploit code going around has not been shown to work, and neither flaw is in CISA's catalog of known exploited flaws. PHP has not said which versions are affected, which part of PHP is involved, or whether any setting ...

An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness is where the engineering in AI pentesting sits. The Hugging Face intrusion OpenAI disclosed in July showed what happens when that harness gives way, even inside an OpenAI evaluation built to contain the agents. Why Each Control Takes Rigorous Engineering Let’s take a closer look at the attack different stages and the role AI agents can take there Scope A pentesting agent makes thousands of decisions about where to send its next request, and the model judges each one against a rule written in plain language. A web app’s real boundary often extends past one domain through redirects and calls to outside services. Enforcing scope means code that inspects every request before it leaves, a...

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception server's host key, could have been captured. The Tor Project began flagging relays on October 4, and by October 5, none remained in the consensus, the list of relays that Tor clients use. At the peak on October 4, the relays carrying the attacker's exit policy made up 7.46% of Tor's exit capacity, measured by consensus weight, according to an  analysis of public Tor directory data  posted to the tor-relays mailing list. The researcher, who publishes as kaba,  scanned  all of Tor's roughly 3,000 exits on October 2 and found 333 redirecting SSH to the same 12 interception servers...

This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. ⚡ UPDATE — PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far. The  advance notice  followed a leak. On October 20, a  post on HN  said two PHP remote code execution flaws, rated CVSS 10.0 and affecting versions from PHP 5 onward, would be disclosed on Thursday, October 22. The poster said they had "no evidence beyond 'source: trus...