The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap compounds and rarely stays contained to a workstation: an unverified finding can end up in a forensic report, a deposition, or in court.  At SANS, we created two new AI frameworks this year to help address this challenge: the Digital Forensics & AI Investigations Framework , which we mapped to the trusted standards established by the Scientific Working Group on Digital Evidence (SWGDE), and the Incident Response & AI Investigations Framework , which we mapped to the NIST Cybersecurity Framework 2.0. Both frameworks rest on the same principle: AI can accelerate investigative work, but the human examiner remains the final authority at every phase...

The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls. To that end, the Department of Telecommunications has issued a circular urging service providers to implement the Calling Name Presentation (CNAP) service. "At the time when a call is incoming, the calling name presentation service presents the calling name identity of the calling user on the user terminal of the called user," reads the circular released by the Indian Ministry of Communications dated October 13, 2026. "Calling name identity is the name of the calling user as recorded in subscriber data record of the originating telecommunication service provider and such identity is included in the calling line identification of such user." The caller...

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan Ferry and Guillaume Valadon said . GhostAction is the moniker for a supply chain attack campaign targeting developer infrastructure on GitHub. Originally discovered in September 2025, it involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories. Attackers have been found to gain write access to repositories using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps. Using the hijacked maintainer account, they push a malicious workflow file disguis...

Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of authenticated remote code execution impacting versions prior to 1.9.0. "Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the 'stdio' transport," reads an advisory released last month. "The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH ove...

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134 , which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier this month, Huntress said it observed threat actors combining the two flaws to achieve unauthenticated remote code execution and deploy web shells and cryptocurrency miners on exposed systems. Although the vulnerabilities were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has now confirmed that the patches did not completely plug them. The fixes are available in the following versions - AhsayCBS v10.3.4.45 hotfix AhsayCBS v9.15.2.70 hotfix "Given the severity of these risks, we strongly urge ...

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco  said in an advisory  on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware, and other threats, and only a gateway with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 is vulnerable. The fix has been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as fixed in a hardening release that day, which the company now says covered this flaw. It also arrives as a Content Scanner Tools update, version 25.3.0.5525 or later, which installs without a software upgrade or a restart. Cisco found the flaw, tracked as CVE-2026-76519 (CVSS score: 9.8), in its own internal security scanni...