The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code execution flaws and 250 information disclosure flaws. Over 70 flaws are rated Critical in severity. "Hundreds of CVEs in a single release used to be the exception; now it's the baseline," Dustin Childs, head of Threat Awareness at the Zero Day Initiative (ZDI), said . "Is AI to blame? Partly. It's accelerating bug-hunting on both sides of the fence, so vendors are finding (and fixing) more flaws, and researchers are finding them faster too." "But AI isn't creating these bugs out of thin air; it's just shortening the time between a vulnerability existin...

A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by authorities on October 9, 2026, the U.S. Department of Justice (DoJ) said. Alfozan had been employed at OpenAI since July 2025, working as an engineering lead. He has since been terminated. According to Alfozan's LinkedIn profile, he graduated from the University of California, Berkeley, with a master's in data science in 2025. He was previously employed at Meta as a senior systems engineer and went on to become the founding engineer at Nash. "Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer's executive conference room to secretly capt...

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off." Prior work has demonstrated that AI agents can act like one by scanning their network, executing an exploit, and copying model weights to a target machine across a GPU cluster with an aim to generate tailored attack strategies and use compromised machines as a botnet to run large language models (LLMs) in order to sustain its reasoning and expand in scale. "Such an 'AI worm' could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware," Anthropic said . "Eff...

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that  converts a personal account  into an organization, Docker said in a  security advisory  on October 12. Conversion transferred the account's personal access tokens (PATs) to the user designated as the organization's owner. A PAT is used in place of a password in the registry, and the person who created each token can still use it. The access was limited to the registry. It did not reach the Docker Hub web interface, and it could not be used to change a password, email address, or two-factor settings, or to take over an account. Docker tracks the flaw as CVE-2026-105445 and rated it critical. The  CVE record  it published on October 13 gives the flaw a CVSS 4.0 score of 9.4. The ...

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm  Volexity said  on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti, found the attack on one customer's appliance. The appliance was fully patched at the time and running version 22.8R2.4. The attacker, which Volexity tracks as UTA0576, began exploiting it on October 3. Ivanti said  on October 13 that it is aware of "limited exploitation in the wild." The first two flaws are an authentication bypass and a remote code execution flaw, tracked together as  CVE-2026-104935 . Together they let an attacker run code as the appliance's cgi-server user, and the third flaw, a privilege escalation, raises that to root, Volexity said. The CVE reco...

A flaw in SAP's  Cloud SDK for Python  can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a  security advisory  on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain, the name such an application passes to the SDK to say which tenant a request is for. The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10. The advisory names  version 0.45.2 , released on August 21, as the fix. The SDK handles authentication for those services with the application's client credentials, a client ID and a client secret. Version 0.45.2 added a check that rejects any tenant subdomain that is not a simple name. Six later releases do not apply that check in every case, The Hacker News found. Versions 0.53.0 through 0.55.0, published betwe...